The annual conference is a 5 day global event that focuses on the issues of incident response and security teams and brings together incident response and security professionals from around the world who share their experiences and expertise. The conference is organized and hosted by FIRST with support from a local/regional team. Security professionals in all areas will find the interaction with incident response teams educational. The presentations are made by a mix of international speakers and includes invited speakers and keynotes from outside the FIRST membership for timely and focused related subjects and experiences. Topics are international in scope and include the latest in incident response and prevention, vulnerability analysis, computer security, management and policy issues. All conference sessions are open to both members and non-members and are not hands on focused. The conference is draws industry sponsorships and also attended by a cross section of operational/technical through management from the incident response community.
Symposia are regional or industry themed events that are run by FIRST or co-hosted with a local team(s) and sponsors. The format is formal and the topics are usually less technical and may have a hands-on component. A co-hosted Symposium is generally a small conference of 100-300 attendees with one or more days open to the security community placed beside (before/after) a 1-2 day FIRST organized event. Alternatively, FIRST hosted Symposia is a 1-2 day event which may have some closed/invite only sessions and invited international speakers. Ideally, the event has sponsors to help underwrite the Symposia costs to attendees. FIRST may hold 2-3 Symposia per year in various regions or industries organized with FIRST conference management and another local CSIRT Community or FIRST Team. The January Symposium is typically co-hosted with TF-CSIRT in Europe.
FIRST Technical Colloquia (TCs) provide a discussion forum for FIRST member teams and local members of the community or a specific industry/sector to share information about vulnerabilities, incidents, tools and all other issues that affect the operation of incident response and security teams.
The TC events are hosted and organized by a local team and may be co-hosted with joint events and have open (public) or members-only meetings.
The colloquia are typically ½ day to 2 day programs including a plenary session and possibly hands-on classes. TCs are hosted and managed by a local team or jointly with regional CSIRT. FIRST desires that several may occur per year in various regions. Overlap on dates is more than possible across regions since the targeted audiences are regional or industry specific. Presenters include local leading security experts who sit down with small groups of FIRST team members, and work through technical topics (like forensics) in a highly interactive hands-on fashion. Occasionally, a corporate sponsored TC may be conducted iteratively across each region. Attendance ranges from 10 to 80 attendees.
FIRST/TRANSITS and Train the Trainers (T3) are some of the regular workshops applied by FIRST.