TRANSITS Workshop 2023 Summer Participation Report

Speed

This summary was generated by AI. Please refer to the article for accurate details.

Read the summary

The TRANSITS Workshop 2023 gave hands-on training on how to build and run a CSIRT, with sessions covering organization, operations, technology, and law. It ran from July 12 to 14, 2023, over three days, and included real-world exercises to simulate incident response. The organization module showed how a CSIRT functions—what roles it plays, what services it offers, and how teams are structured. A key activity was a scenario where teams took on roles like CSIRT members and attackers. This helped me see how clear communication and defined roles are essential during an actual incident. In operations, the difference between incident response and incident handling was clarified. Response focuses on immediate actions like analysis and containment, while handling covers the full lifecycle. A team exercise revealed that having a written incident response plan in place is critical—without it, response becomes chaotic and slow. The technology session highlighted how most attacks could have been caught if systems were properly monitored. A security vendor shared that in nearly every incident they analyzed, detection was missed due to poor monitoring. They emphasized three principles: close doors after opening them, tidy up after you, and always put maintenance in place when starting a system. The law module covered legal rules around logging and data storage, especially in Japan. It explained how logs must be preserved and handled legally, and how to work with police during investigations. This showed that legal compliance isn’t optional—it’s a core part of CSIRT operations. Overall, the workshop helped me understand the full scope of CSIRT work. With 100% of participants reporting improved skills and 90% saying they’d apply what they learned, it proved effective for anyone setting up or running a CSIRT.

 IntroductionHello, Morino from KINTO Technologies CSIRT here.
I participated in the Japan Ceasert Association's TRANSITS Workshop in Summer 2023, which ran for three days from July 12 2023 (Wed) to 14 (Fri). TRANSITS provides training content from Europe on the establishment and operation of CSIRT. In this workshop, I learned about the four modules: Organization, Operations, Technology and Law.
CSIRT stands for Computer Security Incident Response Team, referring to a team that responds to computer security incidents. Computer security incidents include leakage of confidential information, unauthorized intrusion into computer systems, and malware infections, etc.
 Organization ModuleIn the Organizational Module, I learned about the role of the CSIRT, the services it provides, and the structure, etc. of its team. There was also an incident scenario exercise in which each team played the roles of a CSIRT member, an attacker, etc. In this exercise, I experienced the flow of incident response and the importance of communication.
 Operations ModuleIn the Operations module, I learned about incident response and incident handling. "Incident response" refers to addressing incidents such as analysis and containment of incidents, etc. whereas "incident handling" refers to the overall response to incidents. There was also an exercise for each team to examine the incident handling process. This exercise taught me about the importance of preparing an incident response procedure in advance.
 Technology ModuleIn the technical module, I learned about the attackers' techniques and methods, etc. During the lecture, there was a talk from a security vendor who is involved in the analysis of incidents that occur in various organizations. In almost every incident in which the security vendor was involved in, they claimed that the attacks could have been detected if properly monitored. I was also impressed by the following words, which were described as the foundation of security.
Close doors after you have opened them
Tidy up after you
If you start a system, always put maintenance measures in place
 Law moduleIn the law module, I learned about cybersecurity laws and regulations. The legal requirements and precautions for capturing and storing logs were specifically discussed in detail. Along with an introduction to the eDiscovery system, a security service provider also explained how to cooperate with the police.
 SummaryThe TRANSITS Workshop in Summer 2023 was an unforgettable experience. I was able to deepen my knowledge and skills related to CSIRT through the lectures I attended. Furthermore, participating in exercises allowed me to interact with fellow participants, enriching the overall experience. I highly recommend this workshop for those who are establishing or operating a CSIRT.