Call for Speakers
30^th Annual FIRST Conference

The 30th Annual FIRST Conference is coming back to Asia next June 24-29, 2018 and we are looking for engaging speakers to present on relevant incident response and information security topics. FIRST brings together a wide variety of security and incident response professionals from public, private and academic sectors around the world in an information exchange and co-operation of trust on issues of mutual interest.

From the first workshop in Pittsburgh in 1989, FIRST has been at the forefront of incident response and has been the leading professional organization dedicated to strengthening our individual and collective capability to respond to incidents. Over these past thirty years, the conference has grown from a small community of responders to a large, international presence which includes multiple speaker tracks, special interest groups, and workshops. The conference helps incident response professionals and managers learn and grow whether they are just starting or whether they have thirty years of experience.

About FIRST Conference

From June 24-29, 2018, the Forum of Incident Response and Security Teams (FIRST) will be holding their Annual Conference in Kuala Lumpur, Malaysia.

FIRST brings together a wide variety of security and incident response professionals from public, private and academic sectors around the world along with product security professionals to exchange information, build trust relationships and co-operate on issues of mutual interest.

The conference will offer the opportunity for information security experts and managers to exchange ideas and learn from one another about the latest incident response topics and ideas. We intend to have three major tracks running in parallel, covering various subjects which are explained in detail below.

Novice members of incident response and security teams are always welcome and are strongly invited to become part of our worldwide community. Perspectives from all experience levels are valuable in the security and incident response fields, and new members often bring new solutions to the problems we all face.

Contributions We Are Looking For

FIRST Conferences are known for presentations and tutorials/workshops taught by leading researchers, managers, or practitioners in the operations of incident response, product security or other security teams. Presentations are great opportunities for practitioners, who do not have the time to write a full paper as usually expected at other conferences. What we are looking for are leading-edge research, challenging discoveries, effective solutions and established best practices already adopted by more than a single team. We also invite fresh ideas and challenges presented to the global community for discussion and consideration. We look to stimulate discussion on ways to improve capability, effectiveness and efficiency in the work performed by CSIRTs, PSIRTs, SOCs, or other security teams. We also invite original contributions as research papers, tutorials/workshops, panels, or demonstrations.

While our conference has attendees of varying levels of expertise, we are not seeking introductory presentations, such as why response teams are needed, the basic steps to create a response team, or how basic security tools such as firewalls and intrusion detection systems work. We are, however, interested in the latest practices to make response teams more effective or more scalable, or how to counter new attacks on security tools.

Submitted proposals are initially reviewed to filter out sales pitches and to confirm whether there is enough information available. Please take into account that 10 lines of text might not relay the concept or idea you have in your head or discussed in your peer group to others. In such cases we will request more information about the content of the submission before continuing our review process.

We will ensure that each selected proposal is relevant to our audience and will assess the overall value for our audience through an international Program Committee. This is composed of experts and practitioners from the field, representing a diverse set of teams and organizations across six continents.

Topics of Interest

The following list is not exhaustive, but indicates the wide range of topics that are considered of interest to the global audience:

Thirty years incident response
- The evolution of incident response and lessons learned over 30 years
- Reflections on the future of incident response
Privacy
- How privacy and incident response work together effectively
- How changes in privacy laws, regulations, and best practices impact incident response
- Managing privacy incidents
- Privacy issues for sensors and data analysis crossing international borders
Teams – establishing and maturing
- Creation of cyber defense entities including but not limited to: CSIRTs, PSIRTs, ISACs, SOCs and any other organization
- Dealing with limited resources and unlimited needs
- Measuring maturity of entities, processes and/or co-operation
- Mandatory vs. discretionary attack / incident / vulnerability reporting
Best Practices in Incident Management / Product Security Operations / Forensics / Threat Hunting
- Standardization, metrics and life cycle
- Formats, protocols and tools
- Workflows and processes
- Incident management by / for activists
- Handling large scale incidents in an organisation
- Reverse engineering
- Incident analysis including live analysis
- Triage and classification / categorization
- Automation and Orchestration
- Attribution and choosing the right type of reaction
- Takedown of botnets, upload or download servers, drop zones, etc.
Management of Collaboration and Coordination
- Communication of expectations and requirements
- Identifying the appropriate team and channel
- Briefing the world: communication on a global level
- Effective exercising of response capabilities inter- and intra-organisation
- Developing the bigger picture: enabling situational awareness and early warning
- Dealing with multiple international stakeholders and potential conflict of interest
Emerging Challenges and New Insights
- Legal and regulatory aspects in global coordination
- Non-traditional incident management scenarios and approaches (e.g. Internet of Things (IoT), vehicles, medical devices, control systems, and SCADA)
- Incident Management in developing regions
- New roles in other kind of disasters: responding to floods, hurricanes and earthquakes or bombs, terrorists, etc.
- New types of attacks (cyber extortion, ransomware, embedded system malware)
- New threats beyond the technological application: compromising medical implants, etc.
- Results of collaboration with other fields like psychology or education which have a positive impact on team performance or improve their responses in other ways

We hope this list helps you think of topics you or your team members can present to help advance the state of the practice. We welcome new, original ideas from people in research, academia, industry, government, and law enforcement, or from service providers and vendors who are interested in sharing their results, knowledge, and experience. Submitters are strongly encouraged to demonstrate the applicability of their work to practical issues.

We do not allow presentations with the aim of gaining the audience's interest in any commercial application, solution or product. In other words, NO SALES OR MARKETING PRESENTATIONS.

Submissions

The language of the Annual Conference is English. Submissions with fewer than 10 lines (not counting biographical or other meta-information) will be rejected automatically. In such cases, you will get a chance to re-submit within 14 days. We will ask for more concrete and informative text enabling the members of the Program Committee to really understand the topic and your views on this topic that you like to raise or present at the conference. Only then the submission will be considered for further review! The more information you can submit, including draft slides, the more informed decision the program committee can make.

A submission should typically answer the following questions:

the impact of both the problem and the proposed solution;
who will benefit from the work you are presenting; and
how will you bring your points across and convince the audience

All materials (PDF only) and proposals must be submitted through the EasyChair site at:

https://easychair.org/conferences/?conf=first2018

Submissions received after the deadlines (see "Important Dates" below) may not be considered. Contact the Program Committee Chair for cases of exceptions.

We invite the following types of submissions:

presentations from practitioners
research papers
tutorials or workshops (must also provide details on maximum number of attendees, special equipment or network requirements)
panels (must include details on moderator and tentative list of panelists)
demonstrations

Presentations by practitioners or researchers may be either 20 minutes (with 5 minutes of questions) or 45 minutes (with 10 minutes of questions). The Program Committee may decide to structure Q&A sessions differently in the final conference program, such as having multiple presentations followed by a combined Q&A session at the end.

Tutorials or workshops may be either 90 minutes or 180 minutes (with one break after 90 min). These are distinct from training sessions, as the training offerings during the Annual Conference are separated from the main program and are organized by the FIRST Educational Committee.

Panel submissions should include an estimate of how long the submitters believe they will need for a successful, lively and interactive panel. Further discussion after the selection process will give both the submitters and the Program Committee a chance to select the best time slot.

Copyright and Publishing

FIRST requires a non-exclusive copyright license for all materials delivered at the Conference.

Where employer, client or government authorization is needed, it is the responsibility of the author(s) to obtain that authorization prior to submitting the final materials.

Accepted submissions will be published in the Conference Proceedings with associated speaker biographies and head shots (if applicable), for which the same usage rights are required by FIRST.

Materials will be distributed on the FIRST websites. The Proceedings are provided free of charge to Conference attendees. After the Conference, materials will be published to the "Members Only" area of the FIRST website.

FIRST welcomes media to attend the Conference and report on activities. If your presentation is sensitive in nature and requires special handling, please discuss this with the Program Committee Chair before submission of the final materials.

Speaker Privileges

Speakers with 40-60+ minute presentations (including Q&A) will receive a complimentary conference admission (1 per presentation). Speakers for 20-30 minute presentations will receive their choice of a complimentary 1-day pass, or a discounted rate of $1200 USD for a full registration pass (1 per presentation).

Important Dates

Submissions Close: December 15, 2017
Notice of Acceptance: February 20, 2018
Final Presentation Due: May 15, 2018
Conference Dates: June 24-29, 2018

Questions

If you have any questions about the Conference submission process or need additional information, please contact the Program Chair, Jeffrey Carpenter at first-2018chair@first.org. On behalf of the Program Committee and the Conference Planning Team, we are creating a compelling program for you and look forward to seeing you in Kuala Lumpur!

Sincerely,

Jeffrey Carpenter
FIRST Program Chair, 2018
first-2018chair@first.org