Day 1 - Dave McKenzie & Gerard Barrett: Introducing CSIRT global The UK Chapter

### Overview Dave McKenzie and Gerard Barrett introduce the UK Chapter of CSIRT Global, an initiative expanding out of the Dutch volunteer security research organization DIVD (Dutch Institute for Vulnerability Disclosure). The speakers trace their personal backgrounds transitioning into cybersecurity, their collaboration during the pandemic with efforts such as the COVID-19 Cyber Threat Coalition, and their current roles as chapter leads for the UK pilot of CSIRT Global alongside Scott. The primary mission of CSIRT Global is to make the internet safer through coordinated, ethical vulnerability disclosure by bridging international researchers with local organizations.

### Key Topics - **Origins in DIVD:** DIVD, founded in the Netherlands and led by Victor Gevers (noted in the talk for checking Donald Trump's passwords), searches for vulnerabilities and scans the internet to notify affected parties. They are known for research surrounding events such as Kaseya and SolarWinds. - **The Trust and Communication Gap:** When a Dutch research organization reaches out to notify foreign companies (such as UK or US entities) of critical security flaws, they face massive trust deficits. Approximately 99% of outbound notification emails receive silence, and organizations often react defensively or threaten legal action when approached by unknown foreign actors offering free help. - **Legal and Social Barriers:** Internet security laws, scanning legality, and cultural norms vary drastically across borders. Dutch legal frameworks and disclosure mechanisms do not directly translate into UK law or other international jurisdictions. - **CSIRT Global Chapter Model:** To address these trust and jurisdictional hurdles, DIVD is establishing localized chapters under CSIRT Global. The UK chapter serves as the pilot chapter, acting as the local conduit to communicate with regional organizations, establish trusted sector connections, and ensure compliance with domestic legal frameworks.

### Technical Details & Operational Realities - **Vulnerability Landscape & Supply Chain:** The speakers address the overwhelming volume of CVEs, the legacy of internet software built rapidly without security controls, and pervasive supply-chain vulnerabilities highlighted by cases like Log4j. - **Handling Sensitive Disclosures:** Volunteer researchers handle zero-day vulnerabilities and severe enterprise flaws (such as Exchange or Kaseya bugs) prior to public patches. Because premature disclosure carries serious operational and security risks, secrecy and strict confidentiality are essential until mitigations exist. - **Governance and Code of Conduct:** CSIRT Global enforces a strict code of conduct. Participants cannot remain anonymous; individuals must be vetted and verified by peers to build a circle of trust. Bragging about findings on platforms like Twitter is prohibited. - **Localization of Policies:** The UK pilot is actively refining organizational documents, such as translating and adapting Dutch-drafted codes of conduct into suitable English and UK legal contexts.

### Takeaways CSIRT Global UK is actively recruiting dedicated volunteers across all skill levels—from university students to seasoned industry practitioners with enterprise and government contacts. Volunteers benefit from hands-on exposure to critical security disclosures and a global network of peers, while contributing regular volunteer hours to maintain coordinated vulnerability disclosure worldwide.