By Graciela Martínez, Head of LACNIC CSIRT | Member of the FIRST Board of Directors
In cybersecurity, we frequently talk about threats, vulnerabilities, and technology. But when a real incident occurs, what matters most is not only the tools we have, but how we coordinate with each other. With more than 23 years of experience in cybersecurity, and in my current roles with LACNIC CSIRT and on the Board of Directors of FIRST, I always return to three ideas that support Internet resilience: trust, community, and capacity building.
A Global Perspective: Considering the Internet as a Single Ecosystem
The Internet is global by design, and so are incidents. A malicious campaign, an exploited vulnerability, or a failure in a supply chain can affect multiple countries and sectors in a very short time. That’s why, even when we operate in local or regional contexts, we must maintain a global perspective: understand trends, adopt shared practices, and collaborate beyond our borders.
Thinking globally doesn’t distance us from our region. Instead, it strengthens it by incorporating more context, coordination, and learning.
(Free access, no subscription required)
Trust: The Invisible Infrastructure of Incident Response
There is a pillar that is rarely mentioned in presentations, yet it defines the effectiveness of any response: trust. Coordinating with other teams, asking for support, sharing sensitive information, and making decisions under pressure only works when clear agreements are in place and relationships have been built over time.
And here’s a key observation: in-person interaction makes a difference. Face-to-face meetings help turn contacts into true networks. Then, when an incident occurs, that previously established trust shortens response times and improves coordination.
FIRST: A Global Community and Spaces for Deeper Understanding
For years, FIRST has served as a benchmark for response teams worldwide, including ourselves. Its greatest value lies in what it enables: a global community that shares experiences, practices, and frameworks.
Trust: The Invisible Infrastructure of Incident Response
There is a pillar that is rarely mentioned in presentations, yet it defines the effectiveness of any response: trust. Coordinating with other teams, asking for support, sharing sensitive information, and making decisions under pressure only works when clear agreements are in place and relationships have been built over time.
And here’s a key observation: in-person interaction makes a difference. Face-to-face meetings help turn contacts into true networks. Then, when an incident occurs, that previously established trust shortens response times and improves coordination.
FIRST: A Global Community and Spaces for Deeper Understanding
For years, FIRST has served as a benchmark for response teams worldwide, including ourselves. Its greatest value lies in what it enables: a global community that shares experiences, practices, and frameworks.
Under this umbrella, I would like to highlight Special Interest Groups or SIGs, which are groups of professionals who organize around specific topics to share different approaches, discuss specific challenges, and produce practical knowledge. In a constantly evolving environment, these spaces foster ongoing technical dialogue and accelerate collective learning.
I also take this opportunity to invite you to learn more about how to become a member of FIRST:https://www.first.org/membership/. Being part of the community allows you to connect with other teams, exchange experiences, and build relationships that always make a difference in situations where real coordination is required.
Capacity Building Means Investing in Resilience
If there is one element that supports everything else, this element is capacity building. This is not merely about training people. It is about strengthening teams, processes, coordination, culture, and continuous improvement. It means moving from reacting to incidents to being prepared to respond appropriately.
At LACNIC CSIRT, we have relied on FIRST as a benchmark for many years, precisely because of its focus on standards, best practices, and continuous learning. And this bond has grown stronger over time because we share a common conviction: when the region strengthens its capabilities, it gains faster response times, coordination, and collective learning.
At LACNIC, this commitment is expressed through resilience programs and spaces for technical collaboration. I would like to highlight two milestones that are gaining momentum:
LAC CSIRTs meetings, organized in conjunction with partners such as CERT.br. These meetings promote exchanges among teams with varying levels of maturity, encourage practical discussions, and help build trusted networks.
The LACNIC-FIRST Symposium, held during our October events. This symposium brings global dialogue, best practices, and community to our region, strengthening the bridge between local capabilities and international collaboration.
Call for Papers: Upcoming LAC CSIRTs Session
The call for papers for the next LAC CSIRTs session, which will be held on May in Panama, is already open. We are seeking short, practical contributions: lessons learned, coordination and trust, capacity building, daily operations, and trends. If you’re part of a CSIRT or in the process of building one, we encourage you to participate.
Because ultimately, resilience goes beyond technical aspects: it is built on connected people, sustained trust, and capabilities that grow over time.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of LACNIC.
