Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

Difference between revisions of "SEC05 Security Resource Centre Certification Procedure"

From EGIWiki
Jump to navigation Jump to search
Line 13: Line 13:
= Introduction  =
= Introduction  =


<br>This page provides steps to certify Resource Centre from scurity point of view, as part of [[PROC09|PROC09 Resource Centre Registration and Certification]] procedure. The monitoring is performed using the tools used by the EGI CSIRT and enabled upon request of Resource Centre. <br><br>N.B. The steps below are under development and may change until the process is discussed inside EGI CSIRT and with the EGI operations team. <br><br>  
<br>This page provides steps to certify Resource Centre from security point of view, as part of [[PROC09|PROC09 Resource Centre Registration and Certification]] procedure. The monitoring is performed using the tools used by the EGI CSIRT and enabled upon request of Resource Centre. <br>  


This step of the security certification procedure checks that the resources under certification do not contain known CRITICAL software vulnerabilities.  
This step of the security certification procedure checks that the resources under certification do not contain known CRITICAL software vulnerabilities.


= Steps  =
= Steps  =

Revision as of 09:32, 15 July 2015

EGI-CSIRT web site EGI-CSIRT Public wiki EGI-CSIRT Contacts EGI-CSIRT Activities EGI-CSIRT Private wiki



Title Security Resource Centre Certification Procedure
Document link [https://wiki.egi.eu/wiki/EGI_CSIRT:Security_Resource_Centre_Certification_Procedure
Last modified 1.1 - 30 September 2014
Policy Group Acronym Provide the acronym of the group creating this procedure !
Policy Group Name EGI CSIRT
Contact Group EGI CSIRT
Document Status Approved
Approved Date Provide date of the approval!
Procedure Statement Security Resource Centre Certification Procedure applies to Resource Centres under certification process and re-certification of suspended Resource Centres (sites). This step of the security certification procedure checks that the resources under certification do not contain known CRITICAL software vulnerabilities.
Owner Owner of procedure


Introduction


This page provides steps to certify Resource Centre from security point of view, as part of PROC09 Resource Centre Registration and Certification procedure. The monitoring is performed using the tools used by the EGI CSIRT and enabled upon request of Resource Centre.

This step of the security certification procedure checks that the resources under certification do not contain known CRITICAL software vulnerabilities.

Steps

HTC (Grid) Resource Center


Responsible Action Prerequisites, if any
1
RC

Ask the EGI CSIRT to enable monitoring of the site.

It is done by opening a ticket in "csirt" queue of EGI RT or sending a mail to csirt@rt.egi.eu.

The mail must contain:

  • the name of the Resource Centre
  • NGI 
2 EGI CSIRT

Activate the monitoring of the site

After monitoring has been activated the EGI tools will start gathering data and will keep it for evaluation.

The monitoring has to run for at least 3 consecutive calendar days.


3 EGI CSIRT If no security alert is raised via the monitoring over 3 consecutive calendar days period, the EGI CSIRT will communicate back a positive assessment.

Cloud Resource Center


Responsible Action Prerequisites, if any
1
RC

Fill the EGI security survey  and inform EGI Operations (operations@egi.eu)

  • This survey contains the basic security related checks which must be carried out with Cloud Resource providers offering “Infrastructure-as-a-Service” clouds based on the execution of virtual machine images.
2 EGI Operations

Send filled in survey to EGI CSIRT


3
EGI CSIRT

the EGI CSIRT will communicate back an assessment result.

In case of issues EGI CSIRT contact RC to better understand situation.


Revision history

Version Authors Date Comments