1. Prevention is better than Cure
Linda Cornwall
DI4R lightning talk – 30th September 2016

2. Preventing What? Preventing Security incidents
In EGI the majority of the work done by the security teams goes into preventing incidents
We can’t prevent all security incidents
Incidents can occur due to exploitation of Software Vulnerabilities
EGI Software Vulnerability Group purpose is
“To minimize the risk to the EGI infrastructure arising from software vulnerabilities“
Linda Cornwall – Preventing Security Incidents – DI4R 30th September 2016

3. Largest activity is to handle vulnerabilities reported
Anyone may report an issue by to
Vulnerabilities are handled according to the SVG issue handling procedure
This includes investigating the issue, it’s relevance and affect in EGI
If relevant to EGI the risk in the EGI environment is assessed, and put in 1 of 4 categories – ‘Critical’, ‘High’, ‘Moderate’ or ‘Low’
If it has not been fixed, Target Date (TD) for resolution is set - ‘High’ 6 weeks, ‘Moderate’ 4 months, ‘Low’ 1 year
Advisory issued, if the risk is ‘Critical’ or ‘High’ or other good reason
Linda Cornwall – Preventing Security Incidents – DI4R 30th September 2016

4. Some Numbers Year Number of Vulnerabilities Number of Advisories
CRITICAL
HIGH
2011 34 14 3 6
2012 22 17 2 4
2013 38 15
2014 36 26 11
2015 46 8
2016 (to Sept) 31 20 5
Linda Cornwall – Preventing Security Incidents – DI4R 30th September 2016

5. Reaching out
EGI Software Vulnerability Group activities are currently very EGI focussed
+ Worldwide Large Hadron Collider Grid (WLCG)
Looking at how to collaborate/share information with other infrastructures
Risk in distributed Infrastructures often different from other software deployment
Linda Cornwall – Preventing Security Incidents – DI4R 30th September 2016

6. Summary We aim to prevent security incidents
We handle software vulnerabilities
We want to work with others
We have a wiki
Prevention is better than cure!
Thank you for your attention
Linda Cornwall – Preventing Security Incidents – DI4R 30th September 2016