Climbing Toward the Summit of Defense: Practical Methods for Strengthening CSIRT Organizations

Climbing Toward the Summit of Defense: Practical Methods for Strengthening CSIRT Organizations

Speakers: Aya Ohara (Onayami leader and founder, SimpleForm, Inc.); Kaori Fukuda (DNV Business Assurance Japan); Ikuya Hayashi (Chair of the NCA steering committee, NTT-CERT)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=kQ5x8J8F_fQ

Overview

In an era where cyber threats evolve at an unprecedented pace, the effectiveness of CSIRT (Computer Security Incident Response Team) organizations hinges not just on technical prowess, but crucially, on their ability to adapt, collaborate, and foster internal growth. The FIRSTCON talk, "Climbing Toward the Summit of Defense: Practical Methods for Strengthening CSIRT Organizations," presented by Aya Ohara, Kaori Fukuda, and Ikuya Hayashi, unveils a unique and highly successful model for achieving this: Onayami. Meaning "worries" in Japanese, Onayami is a casual, peer-driven space that emerged from the Nippon CSIRT Association (NCA) to address the everyday challenges and anxieties faced by security professionals.

This presentation chronicles Onayami's five-year journey, detailing its organic growth from an informal online gathering during the COVID-19 pandemic into an officially recognized and highly impactful community initiative. The speakers elucidate how this seemingly simple concept—a safe space for sharing worries—has profoundly strengthened individual CSIRT professionals, their respective organizations, and the broader Japanese security community. By blending practical insights with robust academic frameworks, the talk provides a compelling blueprint for how any security organization or community can cultivate resilience, knowledge transfer, and psychological safety, ultimately elevating collective cyber defense capabilities.

Background

▶ Watch: Introducing Onayami: a casual space for sharing worries (0:00)

The foundational problem addressed by this talk is the relentless pace of cyber threat evolution, which frequently outstrips the adaptive capacity of individual CSIRT teams. While the mantra "collaboration is key" has long been recited within the cybersecurity community, practical methodologies for fostering effective, sustained collaboration often remain elusive. The challenge lies in translating this slogan into actionable practices that genuinely empower security professionals and their organizations.

The Nippon CSIRT Association (NCA), established in 2007, serves as Japan's central community for CSIRT teams, boasting 630 member teams today. Within NCA, official activities include regular workshops and regional committee meetings. However, the genesis of Onayami lies in the "unofficial activities"—the informal conversations and networking that often occur after formal sessions. When the COVID-19 pandemic disrupted face-to-face interactions in September 2020, the regional activity committee, including Kaori Fukuda and Aya Ohara, recognized a critical void. This led to the experimental creation of Onayami as an online space, initially conceived as a casual outlet for connection, born out of a humorous suggestion to do online comedy sketches. This informal origin, driven by the simple need for continued interaction, proved to be its greatest strength, allowing it to evolve into a vital support system precisely because it wasn't burdened by rigid structures or formal expectations.

Key Findings

▶ Watch: Shifting from pyramid to network knowledge flow (23:00)

The central discovery of the Onayami initiative is the profound impact of cultivating a psychologically safe and continuous informal space for cybersecurity professionals. Over five years, 60 sessions involved 551 organizations and 583 participants, demonstrating a sustained and growing need for such a platform. The primary findings can be summarized as:

1. Psychological Safety as a Foundation: The relaxed, non-judgmental atmosphere of Onayami, where participants could drop in late, leave early, and even just vent, was paramount. This safety fostered trust, allowing individuals to share genuine worries, weaknesses, and complaints without fear of blame or judgment. This directly contributed to a sense of not being alone in their struggles.

1. The "Onayami Loop" of Growth: The talk described a self-reinforcing cycle:

• Step 1: Feeling Safe: Regular attendance by familiar faces creates a comfortable environment.
• Step 2: Real Feelings Emerge: Participants open up about complaints and weaknesses.
• Step 3: Weight Lifted: Realizing shared struggles brings relief and perspective.
• Step 4: Return and Discover: Encouraged by positive experiences, participants return, finding new insights and connections, perpetuating the loop.

1. Unique Value Propositions: Onayami provided three benefits not easily found elsewhere:

• Cross-Organizational Trust and Fresh Ideas: Conversations transcended company boundaries, offering diverse perspectives.
• Real-World Cases, Not Textbooks: Practical challenges and solutions were shared directly from experience, bypassing theoretical or idealized scenarios.
• Quiet Relief: The emotional benefit of knowing peers face similar issues helped prevent burnout and foster resilience.

1. Shift from Receivers to Contributors: Over time, participants transitioned from merely seeking answers to actively contributing solutions and support, signifying a deeper engagement and ownership of the community. This demonstrated that "growing people" directly leads to "growing organizations."

1. Organic Leadership and Knowledge Flow: The space fostered the emergence of natural leaders without formal appointments. Knowledge flow shifted from a "pyramid" model (expert-driven, top-down) to a "network" model (peer-to-peer, real-time sharing of problems and solutions not found in books or AI). This organic, distributed knowledge creation proved far more dynamic and relevant.

1. Addressing Core CSIRT Challenges: Onayami directly addressed common pain points:

• Career Uncertainty: Providing a space for new CSIRT members assigned without warning to ask "anything."
• Vague Job Descriptions: Offering real-world examples of diverse CSIRT structures when managers say "go build a CSIRT."
• Community Intimidation: Creating an accessible entry point for those intimidated by larger, more formal working groups.

These findings collectively underscore that informal, psychologically safe, and persistent communities are not merely social amenities but critical infrastructure for sustainable organizational and individual growth in the cybersecurity domain.

Technical Deep Dive

▶ Watch: Maslow's Hierarchy: psychological safety as the foundation (26:00)

While the talk doesn't delve into specific code or network protocols, its "technical deep dive" lies in the meticulous methodology and academic frameworks underpinning the successful creation and sustained growth of the Onayami space. This constitutes a social engineering approach to community building, designed to optimize human interaction for knowledge transfer and resilience.

The initial design philosophy for Onayami was deliberately ambiguous, termed the "Onayami working title" approach: "friendly but professional enough for work." This ambiguity was a strength, avoiding the pitfalls of overly casual (unsuitable for work hours) or overly formal (deterring participation) structures. The commitment to monthly sessions, regardless of attendance, was a non-negotiable principle that established continuity and reliability, crucial for building habit and trust.

Initially, founding members Kaori Fukuda and Yamaga attempted to answer all questions. However, the space rapidly evolved to become a peer-to-peer support system, actively inviting other committee members to share real cases and encouraging participants to contribute their own ideas. This transition from an expert-centric model to a networked collaboration model was critical for scalability and relevance. The continuous improvement loop, driven by surveys after every single session, ensured the space remained responsive to participant needs, demonstrating an agile approach to community development.

The academic foundations presented by Ikuya Hayashi provide robust theoretical backing for Onayami's success:

1. Maslow's Hierarchy of Needs (1943): This theory highlights that humans prioritize psychological needs, then safety, before moving to social connection, esteem, and finally self-actualization. Onayami directly addresses the foundational need for safety. As Hayashi states, "Unless we are safe, nothing follows." The space consciously built an "open door" and "safe inside" environment, allowing for self-actualization and community development to emerge.

1. Nonaka and Takeuchi's SECI Model (Socialization, Externalization, Combination, Internalization): This model explains how tacit knowledge (personal, experience-based) becomes explicit knowledge (codified, shareable). Onayami facilitates this by creating a space where "people who understand each other share it" continuously. The informal conversations allow tacit knowledge from real-world CSIRT challenges to be externalized and shared, then internalized by others.

1. Lave and Wenger's Legitimate Peripheral Participation (LPP) Theory: This theory describes how newcomers (peripherals) gradually move towards the center of a community of practice through active participation. Onayami functions as an accessible "open doorway" where individuals can start on the periphery, gradually gaining confidence and contributing more as they feel recognized by peers. This fosters sustainable development over time because the context is shared, enabling mutual understanding among CSIRT professionals.

1. Shini Fukuoka's Concept of Living Systems: Drawing from biology, Fukuoka's observation that a mouse's body is constantly replacing its molecules, yet remains a "mouse," is applied to organizations. A CSIRT organization is not a fixed structure but a "continuous flow" of changing people and knowledge. Strengthening organizations, therefore, is not about stasis but about "continuously replacing components" and focusing on "people over long time horizons." This perspective emphasizes that the continuous, dynamic interaction within Onayami is essential for a CSIRT's long-term vitality.

These frameworks coalesce into a practical "implementation checklist" for building similar spaces:

1. Easy to Enter: Low barrier to participation (online, casual, no prerequisites).
2. Sense of Safety: Non-judgmental, accepting atmosphere, clear rules against blame.
3. Lasting Value: Provides tangible benefits (real cases, peer support, confidence).
4. Continuity and Improvement: Regular sessions, feedback loops, and adaptability.

The "network" model of knowledge flow, where "everyone asks and everyone helps," stands in stark contrast to the hierarchical "pyramid" model. This decentralized approach ensures that solutions are relevant, timely, and derived from collective, lived experience, rather than solely from "experts" or theoretical texts.

Demo / Proof of Concept

▶ Watch: Practical tips for ensuring psychological safety in discussions (35:05)

The talk itself serves as a comprehensive proof of concept for the Onayami methodology, rather than featuring a live technical demonstration. The speakers presented compelling evidence of Onayami's success through its five-year journey, statistical data, and qualitative accounts. They showcased photographs of the physical Onayami booth at the NCA annual conference in 2023, illustrating its transition from an online-only space to an integrated, hybrid model.

The growth from an informal experiment to an officially recognized activity, receiving NCA awards in 2021 and 2023, is a testament to its efficacy. The continuous participation of 551 organizations and 583 individuals over 60 sessions further validates the demand and impact of such a space. The shift in worry types, from predominantly personal to increasingly organizational questions, demonstrates the evolving and deepening utility of Onayami. The ultimate "proof" is the organic growth, the emergence of leaders, and the anecdotal evidence of managers encouraging their teams to attend, signaling a tangible return on this investment in human connection.

Defensive Implications

▶ Watch: Optimal group size for effective interaction in Onayami (37:10)

The Onayami model offers critical defensive implications for CSIRT organizations and the broader cybersecurity community, extending beyond purely technical controls. By fostering psychological safety and continuous peer interaction, defenders can significantly enhance their resilience and adaptive capacity.

1. Burnout Prevention and Retention: The "quiet relief" and sense of "not being alone" directly combat the high rates of burnout prevalent in cybersecurity. By providing an outlet for sharing frustrations and finding support, organizations can improve job satisfaction and retention among their security professionals. This is a crucial, often overlooked, aspect of a robust defense.

1. Enhanced Knowledge Transfer and Skill Development: Onayami's peer-to-peer knowledge sharing model accelerates the transfer of tacit knowledge—the practical, experiential insights that often remain unwritten. This enables new CSIRT members to quickly ramp up, and experienced professionals to learn about novel threats and incident response strategies directly from their peers' real-world cases, bypassing the limitations of formal training or documentation. This organic learning is crucial for adapting to zero-day exploits and rapidly evolving attack vectors.

1. Strengthened Cross-Organizational Collaboration: In an interconnected threat landscape, collaboration across corporate groups, supply chains, and industry sectors is paramount. Onayami provides a blueprint for building trusted networks that facilitate rapid information sharing, coordinated defense strategies, and collective intelligence against sophisticated adversaries. This strengthens the overall "summit of defense" by creating a more unified front.

1. Objective Problem Solving and Innovation: A psychologically safe space allows teams to openly discuss internal challenges, organizational weaknesses, and even failures without fear of reprisal. This objective self-assessment is vital for continuous improvement, identifying systemic issues, and fostering innovative solutions that might otherwise be suppressed in hierarchical environments.

1. Cultivating Future Leaders: The organic emergence of leaders within Onayami demonstrates that empowering individuals through safe spaces cultivates proactive contributors. These individuals, having experienced the value of peer support, are better equipped to lead and mentor others, strengthening the organizational fabric from within.

By embracing the principles demonstrated by Onayami—easy entry, safety, lasting value, and continuity—defenders can build more resilient, knowledgeable, and collaborative teams, ultimately leading to more effective incident response and a stronger overall security posture.

Key Takeaways

• Psychological safety is the bedrock of effective CSIRT collaboration and growth. Without it, individuals hesitate to share vulnerabilities, hindering learning and mutual support.
• Informal, continuous peer-to-peer spaces are critical for knowledge transfer and preventing burnout. The "Onayami loop" demonstrates how a safe environment fosters open sharing, relief, and sustained engagement.
• Knowledge flow is optimized through networks, not pyramids. Real-world problems and solutions are best shared in real-time among peers, complementing formal training and expert-driven approaches.
• The "living system" perspective highlights that organizational strength comes from continuous adaptation and the growth of its people. Organizations are not static structures but dynamic flows requiring constant nurturing of their human components.
• Implementing a successful peer-support space requires four key elements: ease of entry, a strong sense of safety, demonstrable lasting value, and unwavering continuity with a commitment to improvement.
• The Onayami model is universally applicable. Its principles can be used within internal teams, across corporate groups, or within broader industry communities to strengthen cybersecurity defenses.

About the Speaker(s)

Aya Ohara is the Onayami leader and founder, currently working at SimpleForm, Inc. Her mission involves leveling up startup security within the NCA. She has served as the vice chair of the regional activity committee for approximately eight years and is also a licensed wildlife handler. Ohara guided the audience through Onayami's five-year journey.

Kaori Fukuda is a founding member of Onayami and a professional at DNV Business Assurance Japan. She handles a wide range of security aspects, including CSIRT, PSIRT, automotive security, and privacy. Fukuda is also a board member at NCA and serves as a storyteller for Onayami, focusing on analyzing why the space continued to grow. Her central question is whether security work can actually be fun.

Ikuya Hayashi is a member of NTT-CERT, a Japanese Telecom company CSIRT, and serves as the chairperson of the NCA steering committee. His expertise lies in connecting practical insights from real-world work with solid academic foundations, reinforcing these insights through validation. Hayashi provided the academic framing for Onayami's success, drawing on established theories from psychology, organizational development, and biology.