| CARVIEW |
- About FIRST
- Mission Statement
- Strategy Framework
- History
- Sustainable Development Goals
- Organization
- FIRST Policies
- Anti-Corruption Policy
- Antitrust Policy
- Bylaws
- Board duties
- Bug Bounty Program
- Code of Conduct
- Conflict of Interest Policy
- Document Record Retention and Destruction Policy
- FIRST Press Policy
- General Event Registration Refund Policy
- Guidelines for Site Selection for all FIRST events
- Identity & Logo Usage
- Mailing List Policy
- Media Policy
- Privacy Policy
- Registration Terms & Conditions
- Services Terms of Use
- Standards Policy
- Statement on Diversity & Inclusion
- Translation Policy
- Travel Policy
- Uniform IPR Policy
- Whistleblower Protection Policy
- Partnerships
- Newsroom
- Procurement
- Jobs
- Contact
- Membership
- Initiatives
- Special Interest Groups (SIGs)
- SIGs Framework
- Academic Security SIG
- AI Security SIG
- Automation SIG
- Cybersecurity Communications SIG
- Common Vulnerability Scoring System (CVSS-SIG)
- CSIRT Framework Development SIG
- Cyber Insurance SIG
- Cyber Threat Intelligence SIG
- Curriculum
- Introduction
- Introduction to CTI as a General topic
- Methods and Methodology
- Priority Intelligence Requirement (PIR)
- Source Evaluation and Information Reliability
- Machine and Human Analysis Techniques (and Intelligence Cycle)
- Threat Modelling
- Training
- Standards
- Glossary
- Communicating Uncertainties in CTI Reporting
- Webinars and Online Training
- Building a CTI program and team
- Curriculum
- Detection Engineering & Threat Hunting SIG
- Digital Safety SIG
- DNS Abuse SIG
- Stakeholder Advice
- Detection
- Cache Poisoning
- Creation of Malicious Subdomains Under Dynamic DNS Providers
- DGA Domains
- DNS As a Vector for DoS
- DNS Beacons - C2 Communication
- DNS Rebinding
- DNS Server Compromise
- DNS Tunneling
- DoS Against the DNS
- Domain Name Compromise
- Dynamic DNS (as obfuscation technique)
- Fast Flux (as obfuscation technique)
- Infiltration and exfiltration via the DNS
- Lame Delegations
- Local Resolver Hijacking
- Malicious registration of (effective) second level domains
- On-path DNS Attack
- Stub Resolver Hijacking
- Detection
- Code of Conduct & Other Policies
- Examples of DNS Abuse
- Stakeholder Advice
- Ethics SIG
- Exploit Prediction Scoring System (EPSS)
- FIRST Multi-Stakeholder Ransomware SIG
- Human Factors in Security SIG
- Industrial Control Systems SIG (ICS-SIG)
- Information Exchange Policy SIG (IEP-SIG)
- Information Sharing SIG
- Law Enforcement SIG
- Malware Analysis SIG
- Metrics SIG
- NETSEC SIG
- Public Policy SIG
- PSIRT SIG
- Red Team SIG
- Security Lounge SIG
- Security Operations Center SIG
- Threat Intel Coalition SIG
- Traffic Light Protocol (TLP-SIG)
- Transportation and Mobility SIG
- Vulnerability Coordination
- Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)
- Women of FIRST
- CCB Initiatives
- FIRST CORE
- Internet Governance
- IR Database
- Fellowship Program
- Mentorship Program
- IR Hall of Fame
- Victim Notification
- Volunteers at FIRST
- Previous Activities
- Special Interest Groups (SIGs)
- Standards & Publications
- Events
- Education
- Blog
Incident Response Hall of Fame
Introduction
FIRST introduced the Incident Response Hall of Fame at the 31st annual FIRST conference in Edinburgh in 2019.
Description
The Incident Response Hall of Fame is a place to celebrate contributions to the Incident Response Community and cyber security in general.
Incident Response Hall of Fame Committee
The Incident Response Hall of Fame Committee (IRHoFC) is comprised of past Incident Response Hall of Fame inductees, a liaison from the FIRST Board of Directors, and any others appointed by the board.
Incident Response Hall of Fame Committee Chair
One individual from the IRHoFC shall be appointed to be the liaison between the IRHoFC and the rest of FIRST, e.g. the operations team, to drive the efforts and further drive the program.
Nomination
The Incident Response Hall of Fame recognizes a select group of visionaries, leaders, and luminaries who have made significant contributions to the development and advancement of the global security landscape.
The 2025 nomination deadline is March 14, 2025 23:59 UTC.
About The Nominations Process
Individuals who have played an extraordinary role in the conceptualization, building, and development of the incident response capabilities in any region or country are considered for induction into Incident Response Hall of Fame. In addition to those who have been more visible, the FIRST Hall of Fame seeks nominees who have made crucial, but potentially less visible contributions. Criteria for evaluation include:
- Impact: The contribution has made an extraordinary impact on the development or growth of the global Incident Response capabilities and continues to demonstrate relevance to the Internet's ongoing advancement and evolution.
- Influence: The contribution, relative to the Internet, has significantly influenced: 1) the work of others in the field; 2) society at large; or 3) another more defined but critical audience or region.
- Innovation: The contribution has broken new ground with original thinking/creativity that has established new paradigms, eliminated significant obstacles, or accelerated Internet advancements.
- Reach: The contribution has significantly impacted the Internet's reach among society at large, within key audiences or specific geographies, with global impact.
Special consideration may also be given to a nominee's lifelong accomplishments, contributions to more than one area of FIRST, and the overall benefit of his or her technological contribution to society. There is no requirement for the length of time the nominee has worked in/contributed to the industry, and nominations can be made posthumously. Individuals previously nominated must be re-nominated to be considered, and individuals cannot nominate themselves. Current members of the board of directors cannot be nominated.
Nominations are welcomed from:
- Past inductees
- Members of the FIRST Board of Directors
- FIRST Members including representatives, team members, liaisons and associates
- Individuals in the Incident Response community
Nominations are reviewed and screened to ensure they meet the nomination criteria and eligibility.
If you have any questions about the nominations process, please contact ir-hof-advisory-committee@first.org.
Selection
Once the nomination window is closed, all nominations will be distributed by the Incident Response Hall of Fame Committee Chair to the whole Incident Response Hall of Fame Committee with a due date to cast a vote. The votes will be cast by IRHoF committee members through the FIRST eVoting platform.
Once the voting window is closed, the Incident Response Hall of Fame Committee Chair will present the voting results to the FIRST Board of directors who then will approve the decision. The board is not bound to the voting results of the IRHoF committee, but are encouraged to confirm the results.
The nominees, the votes, and any concerns raised shall not be shared outside the Incident Response Hall of Fame Committee and will be kept TLP:RED within the committee.
Once the selection is made, the Incident Response Hall of Fame Committee Chair will inform the inductees with the positive news and outline next steps and logistics around when and how to announce the achievement.
Introduction
The introduction is planned to take place at the annual FIRST conference. To celebrate the outstanding contribution, the introduction will happen during the AGM and FIRST Update. FIRST may release a press statement announcing the introduction. The introduction will also be reflected on the FIRST website.
Opportunities for the Incident Response Hall of Fame members
FIRST shall provide a platform for the newly inducted Incident Response Hall of Fame member(s) to share their experiences and insight, potentially via:
- Podcast interviews
- Blog posts
- Videos
- Keynotes and or Talks
Benefits
To show the appreciation to the individuals introduced to the hall of fame, FIRST offers a lifetime Liaison membership for free of charge. In addition to that, inductees are invited to the FIRST conference at which they are introduced to the IRHoF, with travel expenses and conference registration covered by FIRST.
Timetable
- At the conference
- Incident Response Hall of Fame Committee Chair with the FIRST chair introduces the new individual(s) to the IRHoF
- FIRST media team announces the introduction via PR statements
- Four weeks before the conference
- FIRST media team get approval of PR statement from FIRST BoD and upcoming Incident Response Hall of Fame Member
- FIRST Secretariat organizes travel plans with upcoming Incident Response Hall of Fame Member
- Eight weeks before the conference
- FIRST board votes on the actual selection of upcoming Incident Response Hall of Fame Member
- Ten weeks before the conference
- Incident Response Hall of Fame Committee Chair provides the list of votes and any concerns raised
- Initiatives
- Special Interest Groups (SIGs)
- SIGs Framework
- Academic Security SIG
- AI Security SIG
- Automation SIG
- Cybersecurity Communications SIG
- Common Vulnerability Scoring System (CVSS-SIG)
- CSIRT Framework Development SIG
- Cyber Insurance SIG
- Cyber Threat Intelligence SIG
- Curriculum
- Introduction
- Introduction to CTI as a General topic
- Methods and Methodology
- Priority Intelligence Requirement (PIR)
- Source Evaluation and Information Reliability
- Machine and Human Analysis Techniques (and Intelligence Cycle)
- Threat Modelling
- Training
- Standards
- Glossary
- Communicating Uncertainties in CTI Reporting
- Webinars and Online Training
- Building a CTI program and team
- Curriculum
- Detection Engineering & Threat Hunting SIG
- Digital Safety SIG
- DNS Abuse SIG
- Stakeholder Advice
- Detection
- Cache Poisoning
- Creation of Malicious Subdomains Under Dynamic DNS Providers
- DGA Domains
- DNS As a Vector for DoS
- DNS Beacons - C2 Communication
- DNS Rebinding
- DNS Server Compromise
- DNS Tunneling
- DoS Against the DNS
- Domain Name Compromise
- Dynamic DNS (as obfuscation technique)
- Fast Flux (as obfuscation technique)
- Infiltration and exfiltration via the DNS
- Lame Delegations
- Local Resolver Hijacking
- Malicious registration of (effective) second level domains
- On-path DNS Attack
- Stub Resolver Hijacking
- Detection
- Code of Conduct & Other Policies
- Examples of DNS Abuse
- Stakeholder Advice
- Ethics SIG
- Exploit Prediction Scoring System (EPSS)
- FIRST Multi-Stakeholder Ransomware SIG
- Human Factors in Security SIG
- Industrial Control Systems SIG (ICS-SIG)
- Information Exchange Policy SIG (IEP-SIG)
- Information Sharing SIG
- Law Enforcement SIG
- Malware Analysis SIG
- Metrics SIG
- NETSEC SIG
- Public Policy SIG
- PSIRT SIG
- Red Team SIG
- Security Lounge SIG
- Security Operations Center SIG
- Threat Intel Coalition SIG
- Traffic Light Protocol (TLP-SIG)
- Transportation and Mobility SIG
- Vulnerability Coordination
- Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)
- Women of FIRST
- CCB Initiatives
- FIRST CORE
- Internet Governance
- IR Database
- Fellowship Program
- Mentorship Program
- IR Hall of Fame
- Victim Notification
- Volunteers at FIRST
- Previous Activities
- Special Interest Groups (SIGs)