SVG:Deployment View

Main page

Software Security Checklist

Issue Handling

Advisories

Notes On Risk

Advisory Template

More

---

Deployment View

This provides information on the view and responsibilities of those deploying the software, useful to both NGIs and Sites.

This page is under construction.

Sites should install up to date software

Sites should ensure that the software they install is up to date, including Grid Middleware distributed by the EGI UMD and take note of appropriate advisories.

In a small number of cases, if a vulnerabilities are considered 'Critical' CSIRT may wish to take action if software installed on a site is not up to date.

Advisories from SVG

Site security contacts will receive copies of advisories sent by the EGI SVG, as will NGI Security Contacts. In most cases, these will be to advise to update software as a vulnerability has been eliminated. Most advisories will also be placed on a public EGI web page (location TBD).

In some cases, advisories will not be distributed publicly, at least initially, if early release is too helpful to an attacker. An example of this is if there is no fix to the software, but operational action is recommended and revealing this is useful to an attacker.

Note that advisories from the EGEE Grid Security Vulnerability Group are placed at http://www.gridpp.ac.uk/gsvg/advisories.

Sites should report any vulnerabilities they find

If sites find vulnerabilities, they should report them as in Reporters View

Some site administrators are in the SVG

Some experienced site administrators, who have knowlege of software security, are also members of the EGI SVG.

| Issue Handling Summary | Reporters | SVG View | Software Providers | EGI MW Unit | Deployment | Notes on Risk |