A brainstorming discussion topic.
"How to cope with Security Emergencies?"
This is not the same as Incident Response. We should assume that Incident Response procedures are well defined and have been followed. But what else needs to be done?
Topics to be discussed could include:
What is the scope?
Inter-site information flow.
External information - incl. interface to the Press
How do we keep the infrastructure operational?
Is this our aim?
What do we take down? And who decides?
Can optical private networks remain up?
And are they sufficient for LCG data taking?
How do we deal with Tier 2 problems?