The Forum of Incident Response and Security Teams (FIRST) released its code, “Ethics for Incident Response and Security Teams,”[1] a document that informs teams in the computing industry how to conduct themselves professionally and ethically.
The code includes several duties teams should understand and carry out during incidents, including the duty of coordinated vulnerability disclosure and the duty for evidence-based reasoning. The code was designed based on the understanding that the public good is always the primary consideration. For example, the code states that teams have the duty to keep the public informed of security threats and vulnerabilities, but also must understand that teams are often privy to a wide range of personal and sensitive data and therefore must be able to recognize and respect the civil and human rights of each stakeholder.
FIRST came into being in 1989 and has handled thousands of computing-related incidents and responses while also providing relevant information to both the public and to cybersecurity and incident response professionals.