Joint CSIRT meeting

3 Feb 2025, 09:00 → 5 Feb 2025, 17:00 Europe/Zurich

2/R-030 (CERN)

Monday 3 February

09:00 → 09:15 Introduction

09:15 → 09:30 Training activities

09:30 → 10:00 Monitoring + Vulnerablility Management

Present the work done during the last months and the status of the project.

10:00 → 10:30 SVG

10:30 → 11:00 SSC

11:00 → 11:45 Comms Challenge January 2025 Results

• Results
• Feedback/learnings
• Decide who will run the following campaign

Speaker: Pau Cutrina Vilalta (CERN)

11:45 → 12:00 Coffee Break

12:00 → 13:00 Documents Review

Review recertification process
Review Letter of Intent for remote forensics
Review IRTF infrastructure access rights
Review usage and clarify purpose of csirt SSO group and mailing list

Speaker: Pau Cutrina Vilalta (CERN)

13:00 → 14:00 Lunch Break

14:00 → 15:00 Documents Review

Review recertification process
Review Letter of Intent for remote forensics
Review IRTF infrastructure access rights
Review usage and clarify purpose of csirt SSO group and mailing list

Speaker: Pau Cutrina Vilalta (CERN)

15:00 → 15:15 Coffee Break

15:15 → 16:45 WLCG initiatives and collaboration with VOs

• Newsletter
• Forensics toolkit
• Hands-on workshop

Speakers: Jose Carlos Luna Duran (CERN), Pau Cutrina Vilalta (CERN)

17:00 → 17:30 IRTF Handover meeting

18:30 → 18:50 Group Dinner

Tuesday 4 February

09:00 → 10:30 EGI Security Traceability and logging policy

Daniel will present the EOSC logging guidelines as a reference for EGI Guidelines or Policies updates.
"Logging and Monitoring security standard.pdf" from https://commission.europa.eu/document/c102d646-a331-4de6-b6f1-5726ff49e024_en
Barbara will share her experience implementing NIST 2 standards for logging.
After the presentations there will be a discussion to define what can be done to improve the current logging status.

Speaker: Pau Cutrina Vilalta (CERN)

10:30 → 11:15 TIFR Incident Debrief

Speaker: Pau Cutrina Vilalta (CERN)

11:15 → 11:35 Coffee Break

11:35 → 12:20 Yearly Report

Finish the review and use feedback from EGI Webinar

Speaker: Pau Cutrina Vilalta (CERN)

14:15 → 15:00 Review suspended sites

Speaker: Pau Cutrina Vilalta (CERN)

15:00 → 16:00 Summary and recap of actions

• Review JIRA tickets done
• Define actions for the next 6 months

Speaker: Pau Cutrina Vilalta (CERN)

16:00 → 16:20 EGI Checkin User Misbehaviour Detection

Wednesday 5 February

13:00 → 15:00 Token-based operations - security discussion

Held by EUGridPMA 63: https://indico.cern.ch/event/1461429/