First.org

First.org
Name	First.org
Type	Non-profit organization
Abbreviation	FIRST
Founded	1990
Location	Global
Membership	Computer security incident response teams

First.org is an international consortium of computer security incident response teams (CSIRTs) and related organizations that coordinates responses to cybersecurity incidents, promotes information sharing, and develops incident-handling best practices. Founded in 1990, the organization brings together diverse actors from nationalCERTs to corporate security teams, linking operational capabilities across regions and sectors. FIRST serves as a focal point for incident coordination involving prominent entities such as National Cyber Security Centre (United Kingdom), US-CERT, European Union Agency for Cybersecurity, Interpol, and major technology companies like Microsoft, Google, Amazon (company).

Overview

FIRST functions as a global membership association that enables collaboration among specialist groups including Computer Emergency Response Team (CERT)],] Security Operations Center (SOC), National Computer Emergency Response Team (CNERTs), Internet Service Provider (ISP) security teams, and academic research labs such as MIT Computer Science and Artificial Intelligence Laboratory and Carnegie Mellon University. The organization publishes operational standards influenced by bodies like International Organization for Standardization and Internet Engineering Task Force, and aligns with incident response frameworks used by NIST, ENISA, and multinational consortia including OASIS. FIRST also engages with technology vendors including Cisco Systems, IBM, FireEye, and cloud providers such as Oracle Corporation.

History

FIRST was established through cooperation among early response teams linked to major technical institutions like NASA, CERT/CC, and the Lawrence Berkeley National Laboratory. Over time, membership expanded to include national teams from Australia, Canada, Japan, Germany, Brazil, and South Africa, and collaborations increased with international organizations including United Nations Office on Drugs and Crime and World Bank. Milestones include development of operational standards coincident with publications by RFC 2350 authors and coordination during major incidents like the Conficker (malware) outbreak and responses to multinational campaigns such as those attributed to advanced persistent threat groups linked in reporting to Equation Group and Fancy Bear. FIRST has adapted to shifts in the threat landscape through initiatives reflecting lessons from incidents like the WannaCry cyberattack and supply-chain compromises similar to those involving SolarWinds.

Membership and Structure

Membership categories encompass full members from established CSIRTs, affiliate members representing vendor or research organizations, and individual contributors drawn from entities including Symantec, Kaspersky Lab, Trend Micro, and university labs such as Stanford University cybersecurity groups. The governance structure features volunteer-led working groups and steering committees with representation from regional hubs such as Asia-Pacific Computer Emergency Response Team (APCERT), African Union-linked teams, and European national CSIRTs associated with CERT-EU. Committees coordinate technical tracks covering incident handling, vulnerability disclosure, and legal issues informed by institutions like International Criminal Police Organization and regional regulators including Information Commissioner's Office (United Kingdom).

Activities and Services

FIRST facilitates secure information sharing among members through services modelled on standards promulgated by IETF and driven by use cases encountered by organizations such as AT&T, Verizon, and financial sector teams including those at SWIFT-connected banks. Core services include incident coordination, vulnerability disclosure frameworks aligning with practices from MITRE Corporation (including Common Vulnerabilities and Exposures), and development of playbooks used by teams from Deutsche Bank and HSBC. FIRST publishes best-practice documents and runs training programs akin to workshops at SANS Institute and exercises comparable to national-level drills conducted with NATO partners. It also supports technical tools and data exchange formats used by vendors like Splunk and Elastic (company).

Events and Conferences

FIRST organizes annual conferences and regional meetings that attract speakers and attendees from major institutions such as European Commission, US Department of Homeland Security, FBI, GCHQ, and leading technology firms including Apple Inc. and Intel Corporation. These events host technical sessions, tabletop exercises, and training tracks comparable to offerings at Black Hat and DEF CON, while also featuring panels with representatives from Interpol and World Health Organization when addressing sectors like healthcare incident response. Regional summits connect participants from consortia such as Asia-Pacific Economic Cooperation and the Association of Southeast Asian Nations to address cross-border incident response challenges.

Partnerships and Collaborations

FIRST partners with a wide range of organizations across the public-private spectrum, including standards bodies like ISO, policy organizations such as OECD, and security consortia including Cyber Threat Alliance. Collaborative work occurs with law enforcement agencies like Europol and capacity-building programs funded by institutions such as the World Bank and United Nations Development Programme. FIRST also engages with large platform operators including Facebook (now Meta Platforms), Twitter (now X), and Cloudflare for coordinated disclosure and mitigation of large-scale threats.

Governance and Funding

Governance relies on an elected board and volunteer working groups with officers drawn from established CSIRTs such as CERT/CC, national teams including JPCERT/CC, and corporate teams from Amazon Web Services and Google Cloud. Funding is derived from member dues, conference fees, and sponsorships from industry partners including Palo Alto Networks, CrowdStrike, and McAfee. Financial oversight and policy development follow practices comparable to nonprofit governance models used by organizations such as The Internet Society and The Apache Software Foundation.

Category:Computer security organizations Category:Non-profit organizations