TF-CSIRT is turning 20!

And who is best to tell the story than those who lived it? To mark this special occasion, we have reached out to some of the most notable members of the community, who have contributed to TF-CSIRT as we know it today and asked them to share their memories and visions for the future.

Don Stikvoort can be called one of the founding fathers of TF-CSIRT. He is one of the people who have been involved in the European and global CSIRT collaboration efforts way before TF-CSIRT was conceived – in the early 90s, when the National Research and Education Networks started focusing more on security. The Danish NREN was first to create a CERT team, followed by the Dutch SURFnet, which Don chaired for six years. In the early days, the NRENs were learning from each other, but also teams from the USA and Australia, and organised the first European meeting dedicated to cyber security in 1993 in Amsterdam.

“Trust was and is absolutely essential to how we do our work, and you can only achieve trust through community building”

Don Stikvoort

After working together informally for years, the first format they tried to establish in 1998 was EuroCERT – a hierarchical structure where everybody reports to one organisation. “One aspect of EuroCERT worked very well and that was getting people together”, remembers Don. “The other aspect – coordinating European incidents, people reporting incidents, didn’t work, because apparently people didn’t want to do that.” So it was decided to only continue having meetings and collecting the contact data, which in 2000 became the foundation of TF-CSIRT.

According to Don, at that time there was a dire need to professionalise and get more organised and that is where the idea to form an official cooperation for computer security incident response teams came from. This was formalised as a GEANT Task Force and the Trusted Introducer service was conceived as a trust backbone for TF-CSIRT and also a way to channel the money needed to run it. When asked about the first TF-CSIRT meeting in Paris 20 years ago, Don remembers that the atmosphere was very open and the idea to have different levels of CSIRT team membership was already introduced then – listed and accredited teams first (certified came in 2010). “We already had at the beginning several volunteers who wanted to be the first ones to be accredited. It was an incredibly positive take up and that is why it was very easy to get started”, says Don. And from then on, the number of the teams joining the TF-CSIRT has been constantly growing, to almost 400 teams now.

Shortly after the beginning of the TF-CSIRT and Trusted Introducer, TRANSITS training joined the family, to fulfil the need for affordable high-quality training for new teams and team members. Everyone who contributed in making the modules did that for free. “And we have kept that spirit because most of the materials are still being made on a voluntary basis”, says Don.

Throughout the years, Don has met many people who joined the community, and he is still pleasantly surprised by how cooperative and enthusiastic most people are: “One of the reasons why we see people coming back into the community is that the work we do is absolutely challenging but it also needs a lot of creativity. There is continuous change and innovation, it never gets boring so this attracts a certain kind of people who enjoy that. And because of the need for cooperation and trust building there is also social coherence”.

Don hopes that we will soon be able to come back to having live meetings and trainings, which is essential to building trust. He enjoys the interaction with the people in the TF-CSIRT community and thinks that getting new people is great: “they have new ideas and keep the older ones like myself awake”.

If you are one of the new members or have not yet had a chance to chat with Don, next time you see him, ask about his passion – mountaineering. He might even invite you to hike together!

LISTEN TO THE FULL CONVERSATION HERE: