TF-CSIRT is turning 20!

And who is best to tell the story than those who lived it? To mark this special occasion, we have reached out to some of the most notable members of the community, who have contributed to TF-CSIRT as we know it today and asked them to share their memories and visions for the future. 

Andrew Cormack is a well known member of the TF-CSIRT community and one of the few who remembers how it all began. Throughout the years, Andrew held various positions at the UK Research and Education Network Jisc (earlier known as Janet), including running the JANET-CERT. But he is currently probably best known in the community for his superpower of speaking legalese. Andrew has a blog, where he mainly writes about data protection regulation, incident response and access management. He is one of the founding fathers of TRANSITS and has recently contributed to the updated Legal module. 

No network is an island – more incidents start outside our systems than within

Andrew Cormack

Andrew’s involvement with the international CERT community started in 1999, when he was appointed to run EuroCERT – the pilot incident response service for the European National Research and Education Networks. “The first thing I had to do was to close it down because we discovered that the needs and requirements were very different even amongst research networks”, remembers Andrew. After the EuroCERT pilot was ended, the need to continue collaboration in some other way remained and the security experts kept meeting to plan what can be done on a voluntary basis. After a few one day meetings in Amsterdam, they all flew to Vienna and because it was more difficult to reach, had a two day meeting with an evening activity in between. “We suddenly discovered that actually the social event and getting to know people better and having shared experiences to call back to was fantastically valuable”, says Andrew. 

One thing led to another and slowly the TF-CSIRT and Trusted Introducer were born. However, Andrew is most proud of the third member of this family – TRANSITS trainings – to which he has contributed a lot throughout the years. Before TRANSITS, everyone was training their new colleagues separately, until it became apparent that it would be more effective to combine these efforts. According to Andrew it was clear that one-to-one training is more expensive, but also running trainings for groups of new people from different organisations would help them to get used to working internationally and building their personal contact networks. TRANSITS modules were written by the volunteers from the community and are currently delivered all around the world. “When I look and think what have I achieved in my career, I think that’s at the top of the list”, says Andrew. 

Andrew would like to wish the community to “keep being open, keep welcoming people, keep being somewhere where people want to come”. TF-CSIRT has a reputation of an event where one can “hear interesting stuff, meet interesting people, learn important and useful stuff – and that’s a tremendous reputation to have”, says Andrew. 

LISTEN TO THE FULL CONVERSATION HERE: