1. www.egi.eu EGI-InSPIRE RI-261323 EGI-InSPIRE www.egi.eu EGI-InSPIRE RI-261323 EGI SVG F2F Virtual Machines VM images, software run on VMS. 3 rd March 2015 SVG F2F1

2. www.egi.eu EGI-InSPIRE RI-261323 Endorsed VMs The policy of only running endorsed VM images is an important part of incident prevention One of the things that makes the Fed Cloud different from other Clouds These VM images in the AppDB need to be maintained, software patches (e.g. Linux kernel vulnerabilities) applied in a timely manner 3 rd March 2015 EGI SVG F2F2

3. www.egi.eu EGI-InSPIRE RI-261323 Vulnerabilities in AppDB VMs Would it be possible to monitor for Critical vulnerabilities in endorsed VMs in the AppDB? 3 rd March 2015 EGI SVG F2F3

4. www.egi.eu EGI-InSPIRE RI-261323 Running VM images Need to think about patching of these – whether kernel vulnerabilities, other software vulnerabilities etc. Probably this is more of an operational security issue. 3 rd March 2015 EGI SVG F2F4

5. www.egi.eu EGI-InSPIRE RI-261323 Contact details needed Need contact details for those responsible for VM images. Need contact details for those running VM images This is to inform people of at least Critical and high risk vulnerabilities. VO security contact e-mail list? plus VM image security contact list 3 rd March 2015 EGI SVG F2F5

6. www.egi.eu EGI-InSPIRE RI-261323 For Vulnerabilities in e.g. Linux Where does the responsibility lie? Of course primarily with endorser How many linux flavours in endorsed VMs? Do we inform a mailing list of endorsers of ‘High’ and ‘Critical’ vulnerabilities? We also know less of the impact in Fed Cloud, depending on how VMs used. 3 rd March 2015 EGI SVG F2F6

7. www.egi.eu EGI-InSPIRE RI-261323 AAI to connect to VMs One weakness is how VM operators allow others to connect Possibly FedCloud should have some recommended tools Carry out vulnerability assessment These tools properly maintained, vulnerability handling here. 3 rd March 2015 EGI SVG F2F7

8. www.egi.eu EGI-InSPIRE RI-261323 Other software running on VMs Only act if there is a known problem Is a checklist useful for people setting up VMs? Best practice? Possibly a CSIRT rather than SVG function. E.g. VO specific. 3 rd March 2015 EGI SVG F2F8

9. www.egi.eu EGI-InSPIRE RI-261323 VO and other user software on VMs Not everything can be tracked But it is important to be able to trace who is responsible for a running VM, Who is responsible for any software running on multiple VMs So if there is a problem (whether we are alerted to a vulnerability or potential incident) we can track who is responsible 3 rd March 2015 EGI SVG F2F9

10. www.egi.eu EGI-InSPIRE RI-261323 3 rd March 2015 EGI SVG F2F10

11. www.egi.eu EGI-InSPIRE RI-261323 3 rd March 2015 EGI SVG F2F11