TRANSITS I Course Overview

visual_roman_I

The TRANSITS I introductory incident management course is primarily aimed at less experienced incident handling personnel - or those working for such teams in less technical roles - who wish to gain a solid understanding in the main aspects of working in an incident management team, be it a CSIRT, SOC, ISAC or PSIRT. It offers experience and expertise in the organisational, operational and legal areas, plus an introduction into technical aspects - which form your knowledge base. Practical exercises make sure that the theory also is grounded in real-life incident response.

TRANSITS I Course Modules

TRANSITS I offers participants a unique opportunity to mix with their peers and discuss security issues in a safe and trusted environment, whilst being tutored by seasoned experts with many years of real-life experience in the field of incident management.

The course opens with a short group exercise which naturally leads into the following modules:

  • Organisational – covers how incident management entities fit within their organisations and includes planning the team, defining its constituency, determining which services to offer, staffing, communicating with external parties, funding, and obtaining management authority. Modeled after SIM3.
  • Operational – covers the incident management process from initial reports, through triage, investigation, resolution, closure, to post-analysis. Includes practical exercises and a survey of useful tools. Based on the ENISA IM process.
  • Technical introduction – covers how intruders attack systems and their motivations, how network protocols can be abused, vulnerabilities of operating systems and services, (distributed) denial-of-service attacks, hiding traces, and information gathering techniques. Includes several practical exercises.
  • Legal – covers areas of European legislation likely to affect incident management entities in their work, and that operatives should be familiar with. This includes data protection, computer misuse, network monitoring, collection of evidence, and working with law enforcement agencies. Discussion based.

Other topics such as relevant best practices and standards, PGP/GPG keys and secure messaging are also covered during the course, as well as a (pgp) key-signing party.

For more detail and timings, see the generic TRANSITS I course layout. Further preparatory information is available on the separate pages Preparing for TRANSITS I, and PGP/GPG Key Signing.

TRANSITS I is an excellent opportunity for the staff of incident management entities to acquire knowledge from some of the most experienced experts in the field, and at the same time build their networks with peers from different countries and backgrounds, which ultimately benefits their teams: trusted networks are the very foundation of the global CSIRT cooperation.

The course is open to individuals currently working for incident management entities, be they CSIRT (CERT), SOC, ISAC or PSIRT - and those with a bona-fide interest in establishing one. Participation is welcome from educational, commercial, governmental, NREN, law enforcement, research, NGOs, sectoral, military organisations ... from the whole field of society and economy.

Who Should Attend?

Typical participants are more or less experienced IT and/or cybersecurity professionals with the growing interest and professional need to become experts in a SOC, ISAC, CSIRT or PSIRT. Basic familiarity with Internet protocols, addresses and port numbers is assumed. The basic expectation is that all participants are aware of security issues involved in connecting computers to the Internet and are committed to using their skills to improve the security of computers and networks, and to manage vulnerabilities, threats, incidents and related even ts. Individuals from other backgrounds and with different interests are welcome to contact the organisers to discuss their suitability for the course: we have also regularly had higher-up managers, PR staff and legal people working in the same field join the TRANSITS I course!

Dates & Locations

There are at least two TF-CSIRT TRANSITS I courses per year, one in spring and one in autumn. The course lasts three days and involves 20-30 participants. 

NOTE: the last TRANSITS I course operated by GÉANT on behalf of TF-CSIRT will be in September 2025 in Prague. There are still a few spots open, apply here - use e-mail to the Géant team in case of questions.

As of 2026 TF-CSIRT runs the courses themselves, the first one will be 24-26 March 2026 in Kraków, Poland. Registration opens early June 2025, if you have questions about this or future trainings in 2026, feel welcome to contact transits@tf-csirt.org.

Course Fees

The fee includes accommodation for three nights (including breakfast), three lunches, one joint evening meal, coffee breaks, and course materials.

  • Non commercial organisations: €1,350 (plus VAT, if applicable)
  • Commercial companies: €1,700 (plus VAT, if applicable)