Incident Response Task Force


Handle day to day operational security issues and coordinate Computer-Security-Incident-Response across the EGI infrastructure.


  • Swift response to any reported computer security incident affecting EGI infrastructure
  • Security Incident Management
    • Existing communication channel (mail list/security wiki) migration
    • New communication channel (if needed) setup
    • Incident response tools development, evaluation and adaptation
    • Incident handling procedures update/maintenance
  • Establish additional operational and/or escalation procedures when required
    • a procedure to suspend a site from the EGI infrastructure
    • a procedure and agreed criteria to ban (blacklist) a user, a group of users and/or a VO
  • Maintain and extend open source intelligence and information exchange with trusted partners
    • Gather information about current cyber attack and threats
    • Derive monitoring rules applicable to EGI


  • Pinja Koskinen from CERN