SVG:Deployment View

From EGIWiki
Jump to: navigation, search
Main page Software Security Checklist Issue Handling Advisories Notes On Risk Advisory Template RAT/Membership Documents Assessment Secure Coding Info for SVG members


Deployment View

This provides information on the view and responsibilities of those deploying the software, useful to both NGIs and Sites.

Sites should install up to date software

Sites should ensure that the software they install is up to date, including Grid Middleware distributed by the EGI UMD and take note of appropriate advisories.

In a small number of cases, if a vulnerabilities are considered 'Critical' CSIRT may wish to take action if software installed on a site is not up to date.

Advisories from SVG

Site security contacts will receive copies of advisories sent by the EGI SVG, as will NGI Security Contacts. In most cases, these will be to advise to update software as a vulnerability has been eliminated. Most advisories will also be placed on a public EGI web page.

In some cases, advisories will not be distributed publicly, at least initially, if early release is too helpful to an attacker. An example of this is if there is no fix to the software, but operational action is recommended and revealing this is useful to an attacker.


Sites should report any vulnerabilities they find

If sites find vulnerabilities, they should report them as in Reporters View

Some site administrators are in the SVG

Some experienced site administrators, who have knowlege of software security, are also members of the EGI SVG. New members who wish to contribute to SVG are welcome.

| Issue Handling Summary | Reporters | SVG View | Software Providers | EGI MW Unit | Deployment | Notes on Risk |

Personal tools