Video conference
...
meeting of the WISE SCIV2-WG
4 13 May 2016 at 1413:00 UTC
Agenda
•Mandate of the working group
•Additional work topics
•Next steps and timetable
•Meeting logistics
•Next meeting
Slides shown by DaveK Kelsey4may16.pdf
Minutes
Present: Eli Beker, Dave Kelsey (Chair), Alf Moens, Vincent Ribaillier, Mischa Salle, Adam Slagell (Vice-chair), Romain Wartel.
Apologies: Sven Gabriel, Ian Neilson, Hannah Short, Von Welch, Eric Yen.
1. 14:05 - DaveK welcomes all to this kick-off meeting of the SCIV2 working group and shows slides (above). The agenda is agreed (slide 2).
2. Mandate of the working group (see slide 5).
DaveK starts by presenting some background information on the SCI activity (see slides 3 and 4)
RomainW: How will we keep the working group real and connected to the currently existing operational activities and trust groups?
DaveK: via members of the working group and their connections to these activities. We should encourage wide membership of the WG but not demand formal representation.
AlfM: I agree. We are also not competing with other activities, e.g. TF-CSIRT. We should address areas that are not covered elsewhere.
It is agreed that we are defining best practices and building a trust/policy framework - we are very much NOT an operational group!
3. We go "round the virtual table" to allow people to introduce themselves and to say what hat they are wearing (who they represent).
EliB - ISSC (Israel NREN)
DaveK - EGI and WLCG
AlfM - GEANT, NL Surf
VincentR - Idris CNRS security officer, SCI member and PRACE.
MischaS - EGI Software Vulnerability Group (SVG)
AdamS - NCSA and XSEDE
RomainW - CERN, WLCG and various trust groups
4. Back to the mandate and scope. Additonal topics (slide 6).
We agree to create a child page on the wiki where issues of what is in and out of scope can be discussed/developed.
AlfM: I would like to compare the SCIV1 framework with one we have in the Netherlands. And what is the overlap with ISO27000?
DaveK: reminds people that we already have one successful development from the SCIV1 document, namely the work on Sirtfi being done by REFEDS and AARC.
https://refeds.org/sirtfi
https://wiki.refeds.org/display/GROUPS/SIRTFI
The Sirtfi version 1 document was developed from SCI V1 using the Creative Commons copyright.
DaveK: EU H2020 AARC NA3 is also now working on another development from SCIV1 to prepare a policy/trust framework for IdP/SP proxy/gateways bridging research communities to the identity federations.
This was discussed and agreed that it would be very good to avoid all the branching of the SCI document if at all possible.
Can we at some point merge back in with Sirtfi? And the IdP/SP proxy framework?
It may not be possible but we should at least consider that possibility and at the very least make sure we keep in touch with other activities.
Moving on - RomainW: we need to be aware of what is already going on in (and between) the various operational security groups and trust groups and encourage appropriate membership of the WG.
It was agreed that a review of existing communication channels would be a good place to start.
We then moved to a somewhat lengthy discussion about the desirability of including in the scope of the working group, information exchange about the handling of software vulnerabilities
between various infrastructures (a discussion that had previously started between EGI and CTSC). There are lots of different possibilities: sharing the work on assessing and handling a new vulnerability when notified (ie. in producing an advisory), sharing advisories after they have been produced, or even sharing intelligence about an upcoming vulnerability before announcement. Lots of interesting discussion involving how to share information and what to share, e.g. MischaS: EGI is dependent on Globus software and would be useful to receive advance notice and details of any new vulnerability.
In the end RomainW convinced us all that this should be OUT of scope of our working group. It is an operational issue that can be best handled by bi-lateral discussions between infrastructures.
...
•Minutes of last meeting (4th May 2016)
•Discuss questions raised by Adam Slagell
What are we trying to accomplish beyond creating the self-assessment, and did we meet those goals?
Do we need to extend the scope of the document, or should we focus on getting more impact from the first document (especially if we didn’t meet all our goals the first time)?
What does it mean to get acceptance by the DII’s, and have we achieved that?
Depending on where these lead, we might conclude that what we really want is more organizations doing the self-assessment and to have these results published centrally or otherwise. I could see that certainly helping those of us looking for resources or justification for the different components of our security program efforts.
Taking this hypothetical further, if that is our goal, a reasonable next step is to develop a guideline for the assessment.
•Next steps
•Next meeting
Slides shown by DaveK Kelsey4may16.pdf
Minutes
Present:
Apologies:
...
DaveK: thanks to all for your participation.
Meeting ended at 15:05 UTC
Notes by DaveK - 7 May 2016