|Main page||Software Security Checklist||Issue Handling||Advisories||Notes On Risk||Advisory Template||More|
This provides information on the view and responsibilities of those deploying the software, useful to both NGIs and Sites.
Sites should install up to date software
Sites should ensure that the software they install is up to date, including Grid Middleware distributed by the EGI UMD and take note of appropriate advisories.
In a small number of cases, if a vulnerabilities are considered 'Critical' CSIRT may wish to take action if software installed on a site is not up to date.
Advisories from SVG
Site security contacts will receive copies of advisories sent by the EGI SVG, as will NGI Security Contacts. In most cases, these will be to advise to update software as a vulnerability has been eliminated. Most advisories will also be placed on a public EGI web page.
In some cases, advisories will not be distributed publicly, at least initially, if early release is too helpful to an attacker. An example of this is if there is no fix to the software, but operational action is recommended and revealing this is useful to an attacker.
Sites should report any vulnerabilities they find
If sites find vulnerabilities, they should report them as in Reporters View
Some site administrators are in the SVG
Some experienced site administrators, who have knowlege of software security, are also members of the EGI SVG. New members who wish to contribute to SVG are welcome.