Minutes taker and Project update Minutes taker - DC of the week or the backup

incident at GRISU-COMETA-INFN-CT[EGI-20101018-01] and open vulnerabilities: CVE-2010-3847 and CVE-2010-3904 Incident at GRISU-COMETA-INFN-CT - compromised system reinstalled without backup/analysis - What went wrong and how to improve it? Open vulnerabilities - Current status - How to monitor site patching status? Vulnerability disclose??

Group activities update and forward planning Update from group coordinators: --IRTF (Leif) Wiki page update: https://wiki.egi.eu/wiki/EGI_CSIRT:Incident_reporting update incident handling flowchart? Vulnerability handling procedure (See Linda's draft)? Risk assessment procedure (SVG or joint SVG and CSIRT)? Other procedure? Detail plan for the coming month and quarter? --Security monitoring (Daniel) Pakiti development and new requirement Operational dashboard integration Nagios development Detail plan for the coming month and quarter? --Security drill (Sven) How can NGIs run SSC4? Detail plan for the coming month and quarter? --Security training & dissemination (Helene on behalf of Dorine) Plan for next 12 months * put security training and dissemination materials on the EGI-CSIRT public site. * build a database of grid security expert * organize a training event at each user forum and technical forum. * Define with NGI security officer which support they want from EGI-CSIRT . * Define an security training strategy ( agenda of training EGI events, contents of security materials). [ Actors implied: EGI-CSIRTS, SPG, SSG . ] * Define common training strategy with other EGI operational group (like COD, operationnal procedures, ...).

post-mortem: handling CVE-2010-3081 Things need to be improved - Procedure? - Template? - Communication? - Assistant tool like RTIR? * http://espinete.rediris.es/ * Anyone tried it? - Monitoring tool improvment and integration? * Access control (pull DNs from GOCDB) * One time link * Adding kernel exception * fine-grain filter (e.g X86_64) - ??? ???

update from team members A quick roundtable update

Action review and AOB To review any pending actions and ongoing issues https://rt.egi.eu/rt/index.html A list of new actions from this meeting AOB Next monthly meeting: 18-Nov-2010