TRANSITS-I courses are aimed at new or potential computer security incident response team (CSIRT) personnel who wish to gain a good grounding in the main aspects of working in such a team. They cover basic incident handling and response techniques, operational practices, organisational and legal issues. Trainees get a unique opportunity to mix with their peers and discuss security issues in a secure and trusted environment, while being tutored by leading members of the European CSIRT community.
TRANSITS-I courses are open to individuals currently working for a CSIRT or network security related organisation, and to those with bona-fide interest in establishing a CSIRT. Applications are welcome from commercial, governmental, law enforcement and military organisations, as well as national research and education networking organisations (NRENs) and research and education institutes.
GÉANT normally organises two TRANSITS-I courses per year. These are two and a half days in duration and involve 30 trainees at a time. You can read a student's perspective in this blog post.
The TRANSITS-I course materials may also be licensed to those wishing to organise their own courses.
The following modules are covered:
- Organisation - how CSIRTs fit within their organisations and includes planning the team, defining its constituency, determining which services to offer, staffing, communicating with external parties, funding, and obtaining management authority;
- Technical - how intruders attack systems and their motivations, how network protocols can be abused, vulnerabilities of operating systems and services, denial-of-service attacks, hiding traces, information-gathering techniques, and includes several practical exercises;
- Operational - the incident handling process from initial reports, through triage, investigation, resolution, closure, to post-analysis, and includes practical exercises and a survey of useful tools;
- Legal - covers areas of European legislation likely to affect CSIRTs in their work that operatives should be familiar with, including data protection, computer misuse, network monitoring, collection of evidence, and working with law enforcement agencies.
Other topics such as PGP keys and relevant RFCs are also covered during the course.
TRANSITS-I course fees are €1,500 for commercial companies, or €1,200 for non-commercial organisations. These fees include accommodation for three nights, two lunches, two evening meals, coffee breaks, and course materials.
Applicants to TRANSITS-I courses are subject to a vetting procedure and are usually required to provide references. This is to ensure that individuals fulfil the course requirements and have a legitimate interest in network security. Application forms should therefore be completed as fully as possible.
Trainees are typically experienced system, network or IT administrators, although interested persons from other backgrounds are welcome to contact the organisers to discuss the suitability of the course for them. They are expected to have an awareness of the security issues involved in connecting computers to the internet, and must be committed to using their skills to improve the security of computers and networks. Familiarity with internet protocols, addresses and port numbers is assumed.
Forthcoming TRANSITS-I courses
For information about the upcoming courses, please refer to: https://tf-csirt.org/transits/transits-events/transits-i/