EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI EGI SVG F2F Virtual Machines VM images, software run on VMS. 3 rd March 2015 SVG F2F1

EGI-InSPIRE RI Endorsed VMs The policy of only running endorsed VM images is an important part of incident prevention One of the things that makes the Fed Cloud different from other Clouds These VM images in the AppDB need to be maintained, software patches (e.g. Linux kernel vulnerabilities) applied in a timely manner 3 rd March 2015 EGI SVG F2F2

EGI-InSPIRE RI Vulnerabilities in AppDB VMs Would it be possible to monitor for Critical vulnerabilities in endorsed VMs in the AppDB? 3 rd March 2015 EGI SVG F2F3

EGI-InSPIRE RI Running VM images Need to think about patching of these – whether kernel vulnerabilities, other software vulnerabilities etc. Probably this is more of an operational security issue. 3 rd March 2015 EGI SVG F2F4

EGI-InSPIRE RI Contact details needed Need contact details for those responsible for VM images. Need contact details for those running VM images This is to inform people of at least Critical and high risk vulnerabilities. VO security contact list? plus VM image security contact list 3 rd March 2015 EGI SVG F2F5

EGI-InSPIRE RI For Vulnerabilities in e.g. Linux Where does the responsibility lie? Of course primarily with endorser How many linux flavours in endorsed VMs? Do we inform a mailing list of endorsers of ‘High’ and ‘Critical’ vulnerabilities? We also know less of the impact in Fed Cloud, depending on how VMs used. 3 rd March 2015 EGI SVG F2F6

EGI-InSPIRE RI AAI to connect to VMs One weakness is how VM operators allow others to connect Possibly FedCloud should have some recommended tools Carry out vulnerability assessment These tools properly maintained, vulnerability handling here. 3 rd March 2015 EGI SVG F2F7

EGI-InSPIRE RI Other software running on VMs Only act if there is a known problem Is a checklist useful for people setting up VMs? Best practice? Possibly a CSIRT rather than SVG function. E.g. VO specific. 3 rd March 2015 EGI SVG F2F8

EGI-InSPIRE RI VO and other user software on VMs Not everything can be tracked But it is important to be able to trace who is responsible for a running VM, Who is responsible for any software running on multiple VMs So if there is a problem (whether we are alerted to a vulnerability or potential incident) we can track who is responsible 3 rd March 2015 EGI SVG F2F9

EGI-InSPIRE RI rd March 2015 EGI SVG F2F10

EGI-InSPIRE RI rd March 2015 EGI SVG F2F11