On Tuesday 4th June, the 4th Annual WARP forum was held in London. Unfortunately, I had to drop out at the last moment, but I retain a keen interest in the WARP (Warning, Advice and Reporting Point) concept, so I'm going to take the opportunity to introduce you to the idea, if you're one of the many security professionals who haven't come across it. A WARP is a sort of junior CERT/CSIRT ("small, personal and not-for-profit": it represents the interests of a fairly narrow community, and there isn't a presumption of high-grade security knowledge on the part of the WARP operator(s), not necessarily armed with the direct technical response capability to resolve every upcoming probem, but acting as a conduit for advice and warnings to the community. The world is full of advice and warnings, but the WARP concept is about filtering, so that only the warnings most likely to be applicable to members of the client community are passed on. The WARP operator is also likely to manage a service desk function, processing some form of trouble ticket and forwarding incident reports.
This actualy maps quite well to the security functions of many IT support teams, especially in smaller organizations that don. However, there are a couple of crucial differences: one is that the WARP philosophy is two-way (or even multi-way), so that the operator can also draw on the experience and expertise of other members of the community to address a reported problem. The second is that the WARP can be run very economically (in many cases, it will be shared/voluntary responsibility). Yet another is that behind the immediate WARP community, there is, potentially, a wider community of trust sharing incident reports, experience and expertise (albeit anonymously and selectively).
There is a temptation for a larger organization to regard an arrangement like this as a cheap substitute for an industrial-strength security management solution. (Yes, I do have an instance in mind, but I'm not sharing that!) That entails major risks (not least of scaling). Nevertheless, in many contexts (resource-starved groups like the charity sector and other voluntary initiatives) the concept offers a very viable alternative to having an overworked volunteer sitting at a PC trying to filter out the sound, relevant information from a tsunami of data.
