multiple perspectives—civil, commercial, criminal

"precovery"—addressing crises before they break

fires and rainbows—how to learn from disaster

aftermath: crafts and lessons of incident recovery

That calamity will strike the globe somewhere, somehow, sometime, is a certainty; what is always uncertain is where, how, and when.

Whether caused by nature, carelessness, chance, vandalism or criminality, the consequences are almost always the same: casualty, chaos and devastation, followed by an aftermath of shock and secondary damage, and then the long, arduous process of recovery.

And these macro-shocks that shake the globe are echoed in the micro-shocks caused within organizations and communities when local variations of the same crises invade, twist and paralyze their lives.

Communications networks are the nervous systems of disaster relief and recovery, and computers are always at the center of modern communications, which is why computers themselves are often the target for attack, and their breakdown or malfunction can in itself precipitate institutional or social chaos.

As the world's premier body of Computer Incident Response and Recovery Teams and individuals, FIRST has unique experience of crises and crisis management, and at its 21st annual conference in Kyoto, Japan, knowledge will be pooled and practices refined with contributions by experts drawn from every continent.

FIRST's volunteer members are top computer emergency professionals, brought together by a common dedication to discovering, sharing and promoting best practice.

Commercial collapse, civil attack and criminal subversion will all be addressed in Kyoto, and a series of keynote speeches, supported and elaborated in specialized seminars, will constitute the first time ever that such a comprehensive review and analysis of Incidents, Incident Response and Incident Recovery has been staged.

Kyoto was for over a thousand years the seat of the Japanese Imperial Court
(its name means "capital city") and is still the country's cultural center. It's a
tribute to the city's own powers of recovery that its architecture and heritage
have survived through cycles of social and political upheaval.

Indeed, Japan herself is a world-model of incident recovery, over the
centuries repeatedly finding routes back to prosperity and harmony from
siege, occupation, civil war and destruction.

In a happy coincidence of timing, as FIRST's conference closes, the Kyoto
festival of Gion Matsuri begins, a purification ritual inaugurated some 1100
years ago to appease the gods who cause fire, flood, earthquakes and
pestilence.

FIRST is honored to be Kyoto's guest in 2009, and in a spirit of gratitude
promises to devise, share, collect and publish some practical advice as
collateral to the ceremonies of prevention.

As well deliberating and investigating Incident Recovery, FIRST delegates at
Kyoto will continue their pioneering work towards the better globalization of
security, and collaboration between Incident Response Teams and Law
Enforcement agencies.

Also on the agenda are:

• Specialist tracks with increased focus on Management, Incident Response and Technical topics relevant to CSIRTs.
• Case Studies — Lessons learned in dealing with real events, from discovery to remediation. Share practical experiences in dealing with cyber incidents along with the tools that provided most valuable.
• SIG (Special Interest Group) meetings.
• Vendor Showcase where vendors demonstrate their equipment.

Conference hours run from 8:30AM-5:30pm. The 2009 event will have built into its agenda more time and opportunities for delegates to network and share ideas, including a networking hour, SIGs, and Birds-of-a-Feather. Session times will be broken down into three separate tracks—technical, IR opportunities, and managerial.

With ever-more sophisticated communications systems offering ever-more complex possibilities for breakdown, and humanity suffering or witnessing sequential catastrophes which show that no amount of human ingenuity will ever frustrate the operations of chaos and the interventions of disaster, it is an imperative that anyone who has a role to play in incident recovery or security planning should seriously consider attending FIRST's 21st conference in Kyoto.

Writing about FIRST, the leading British commentator David Lacey declared in Computer Weekly:

Of all the security clubs and associations, the one that impresses me most is FIRST
http://www.first.org, the Forum for Incident Response and Security Teams. Why? Because
it's focused, born out of real business requirements and it's highly selective, i.e. you have to be
sponsored and audited to gain membership. FIRST is not a club that exists to make an income
for its organizers. It's an international community that serves a real purpose: helping Government,
Industry and Academia to respond quickly and effectively to new security threats. So I have no
hesitation in recommending that you book a space in your busy diary to attend their Annual
Conference.