The EGI Software Vulnerability Group (SVG) Face to Face meeting

Tuesday 3 Mar 2015, 09:30 → 17:00 Europe/Amsterdam

H 3.20 (nikhef)

This is adjacent to the EGI SPG meeting, which will take place on 4-5th March. Details including registration are available at:

https://www.nikhef.nl/grid/meetings/spgsvg2015/

Registation IS required, and includes the option for either on-site or remote. Remote access details are also available.

Main objective is to discuss how to update the EGI SVG issue handling to take account of the evolving infrastructure and situation. Issue handling procedure last underwent major revision at the start of EGI in late 2010, and was very geared to Grid middleware. In recent months there have been a wider range of vulnerabilities which are relevant to the EGI infrastructure.Th  

Most sessions will comprise of a short presentation followed by a discussion. The majority of the time is planned to be spent on discussion and finding solutions rather than on presentations.

Introduction and vulnerability handling

This will introduce plans for the day.

Then we will discuss the general vulnerability handling, where problems are and how we solve them.

Convener: Linda Cornwall (STFC)

1 Welcome, introduction

2 SVG issue handling - problems and how to solve them

Is the process working? Where are the problems? How do we solve them?

Slides EGI-SVG-F2F-IssueHandlingPrinciples.ppt EGI-SVG-F2F-IssueHandlingProblems.ppt

Coffee break

Non-Issue handling SVG matters.

This session covers things other than issue handling.

3 Checklist for S/W on infrastructure

Slides EGI-SVG-F2F-SoftwareChecksAndAssessment.ppt

4 Vulnerability Assessment

5 Security Threat Risk Assessment

Slides EGI-SVG-F2F-SecurityThreatRiskAssessment.ppt

Lunch

Cloud specific Vulnerability issues

This addresses cloud specific issues concerning software vulnerabilities. The main focus is on Software which enables the Cloud, from hypervisors to s/w enabling the federation.

slides EGI-SVG-F2F-IssueHandlingCloud.ppt

Coffee break

Virtual Machines and vulnerabilities in the Cloud, plus AOB

This focusses on vulnerabilities in the cloud associated with Virtual machines, both images in the AppDB, and images in use.

Then AOB.

slides EGI-SVG-F2F-VirtualMachines.ppt