IRTF
====
Ongoing security incident
*Grid-Sec 001 update 19
*EGI-20110301-01 Incident Detected at AUVERGRID
Toby updated EGI IR Site Checklist
Leif updated EGI IR flowchar down, thank Leif
Wiki page update: https://wiki.egi.eu/wiki/EGI_CSIRT:Incident_reporting
operational procedure development
--https://wiki.egi.eu/csirt/index.php/Security_Officer_on_Duty_tasks
Quote from David
"As someone working in the WET/WEST timezone (like the UK and Portugal) I find the Monday morning 09:30 CET/CEST deadline for publishing the agenda for the IRTF meeting to be tricky, as I often don't get to the office until after 10:00 CET/CEST. The alternative is to publish something on Friday before leaving for the weekend"
-- https://wiki.egi.eu/csirt/index.php/Handling_critical_vulnerabilities, probably broken?
Example:
https://rt.egi.eu/rt/Ticket/ShowEmailRecord.html?id=1479&Transaction=53095&Attachment=14227
vs.
https://rt.egi.eu/rt/Ticket/ShowEmailRecord.html?id=1389&Transaction=50840&Attachment=13364
RTIR in operation?
Security monitoring
===================
Update:
Security dashboard and integration
Pakit and Nagios development
Security drill
==============
progress of SSC4 development work
preparation for SSC4 NGI run - Spanish NGI, when to start?
progress of SSC cross NGIs
Other development work?
Security training & dissemination
=================================
= internal wiki
Good progress have been made, any comment?
header on each page?
Latests news of the wiki are at:
https://wiki.egi.eu/csirt/index.php/Main_Page
This month news:
16th march 2011:
- Site IR checklist available. See Incident reporting or Policies page on the public wiki.
10th march 2011:
- New NGI security contact added: David Durvaux from Belnet. see Team members and internal procedures .
9th march 2011:
- Creation of a page which provide a list of Security Officer on Duty tasks.
- Update of Handling critical vulnerabilities procedure.
7th march 2011:
- F2F april 2011 at Karlsruhe: registration and information page is now online. See EGI-CSIRT Face 2 Face Meeting April 2011.
- Next IRTF DC rota ( from 28/03/2011 to 13/06/2011), creation of the related Avaibility for DC role page.
4th march 2011:
- Informations about past security incidents are now online. See updates from Incident Response TF.
21st february 2011:
- Update of the procedure for handling critical vulnerabilities. See Handling critical vulnerabilities.
= public wiki
Any comment/suggestion since last meeting?
=== security training of the EGI TF
Proposal for an agenda:
* A 2 sessions security tutorial: operational procedures and middleware.
* operational security procedures session:
- incident workflow and forensic tools.
- advanced pakiti tutorial: What configuration if you want to monitor all hosts of the site? - dealing with scalability issues.
- using the security challenge framework.
Are task leader for irtf, monitoring, sec drills happy to find trainers for these talks ?
* middleware security session:
- EMI security architecture
- advanced security tutorial for cream ce.
- setting up argus server
- ?
