Difference between revisions of "SVG:Deployment View"
(Created page with '{{svg-header}} This provides information on the view and responsibilities of those deploying the software, useful to both NGIs and Sites. {{under construction}} {{svg-issue-vi…') |
|||
Line 4: | Line 4: | ||
{{under construction}} | {{under construction}} | ||
== Sites should install up to date software == | |||
Sites should ensure that the software they install is up to date, including Grid Middleware distributed by the EGI UMD and take note of appropriate advisories. | |||
In a small number of cases, if a vulnerabilities are considered 'Critical' CSIRT may wish to take action if software installed on a site is not up to date. | |||
== Advisories from SVG == | |||
Site security contacts will receive copies of advisories sent by the EGI SVG, as will NGI Security Contacts. In most cases, these will be to advise to update software as a vulnerability has been eliminated. Most advisories will also be placed on a public EGI web page (location TBD). | |||
In some cases, advisories will not be distributed publicly, at least initially, if early release is too helpful to an attacker. An example of this is if there is no fix to the software, but operational action is recommended and revealing this is useful to an attacker. | |||
Note that advisories from the EGEE Grid Security Vulnerability Group are placed at | |||
[http://www.gridpp.ac.uk/gsvg/advisories http://www.gridpp.ac.uk/gsvg/advisories]. | |||
== Sites should report any vulnerabilities they find == | |||
Sites should report vulnerabilities if they find them. | |||
== Some Site admins are in the SVG == | |||
Some experienced site administrators, who have knowlege of software security, are also members of the EGI SVG. | |||
{{svg-issue-views}} | {{svg-issue-views}} |
Revision as of 17:05, 2 November 2010
Main page | Software Security Checklist | Issue Handling | Advisories | Notes On Risk | Advisory Template | More |
Deployment View
This provides information on the view and responsibilities of those deploying the software, useful to both NGIs and Sites.
This page is under construction. |
Sites should install up to date software
Sites should ensure that the software they install is up to date, including Grid Middleware distributed by the EGI UMD and take note of appropriate advisories.
In a small number of cases, if a vulnerabilities are considered 'Critical' CSIRT may wish to take action if software installed on a site is not up to date.
Advisories from SVG
Site security contacts will receive copies of advisories sent by the EGI SVG, as will NGI Security Contacts. In most cases, these will be to advise to update software as a vulnerability has been eliminated. Most advisories will also be placed on a public EGI web page (location TBD).
In some cases, advisories will not be distributed publicly, at least initially, if early release is too helpful to an attacker. An example of this is if there is no fix to the software, but operational action is recommended and revealing this is useful to an attacker.
Note that advisories from the EGEE Grid Security Vulnerability Group are placed at http://www.gridpp.ac.uk/gsvg/advisories.
Sites should report any vulnerabilities they find
Sites should report vulnerabilities if they find them.
Some Site admins are in the SVG
Some experienced site administrators, who have knowlege of software security, are also members of the EGI SVG.
| Issue Handling Summary |
Reporters |
SVG View |
Software Providers |
EGI MW Unit |
Deployment |
Notes on Risk |