<div dir="ltr">Hi <span style="font-family:arial,sans-serif;font-size:13px">Shohel,</span><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px"> Thanks for you update, I can understand the timezone problem, I will keep reading the wiki and if there are any questions I will post here, it's really appreciated to help to answer with that then.</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Thank you : )</span></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Fri, Mar 14, 2014 at 3:55 AM, Fiorentino, Cristian <span dir="ltr"><<a href="mailto:cristian.fiorentino@intel.com" target="_blank">cristian.fiorentino@intel.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Shohel and Everyone,<br>
<br>
I am new to OSSG, and I would be happy to support the OpenStack Threat Analysis activity.<br>
Most meeting time proposals in email thread below work for me.<br>
<br>
Thanks and Regards.<br>
Cristian.<br>
<br>
<br>
Date: Thu, 13 Mar 2014 18:18:48 +0200<br>
<div class="">From: Abu Shohel Ahmed <<a href="mailto:ahmed.shohel@ericsson.com">ahmed.shohel@ericsson.com</a>><br>
</div>To: Hui Xiang <<a href="mailto:hui.xiang@canonical.com">hui.xiang@canonical.com</a>><br>
Cc: "<a href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a> , "<br>
<<a href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a>><br>
<div class="">Subject: Re: [Openstack-security] OpenStack Threat Analysis activity -<br>
OSSG<br>
</div>Message-ID: <<a href="mailto:EAB3FB86-814A-443E-82AE-06045108004B@ericsson.com">EAB3FB86-814A-443E-82AE-06045108004B@ericsson.com</a>><br>
Content-Type: text/plain; charset="windows-1252"<br>
<div class=""><br>
Hi Hui Xiang,<br>
<br>
You are welcome to join the meeting and take part in the review / Threat modelling work we are currently working on. Or if you have some suggestion, please<br>
share with us.<br>
<br>
We will discuss the time schedule issue in the next meeting. I thinks it would be bit difficult cause we have some participants from US timezones.<br>
<br>
We are continuously updating the Wiki page ( although there is sometimes a lag) and related information, so that everyone is informed.<br>
<br>
Related information in the<br>
> <a href="https://wiki.openstack.org/wiki/Security/Threat_Analysis" target="_blank">https://wiki.openstack.org/wiki/Security/Threat_Analysis</a><br>
<br>
<br>
Thanks,<br>
Shohel<br>
<br>
On 13 Mar 2014, at 04:34, Hui Xiang <<a href="mailto:hui.xiang@canonical.com">hui.xiang@canonical.com</a>> wrote:<br>
<br>
> Hi all,<br>
><br>
> I am carefully asking you guys if it is possible to bring the meeting ##openstack-threat-analysis forward to 15.00 UTC, or more earlier? Because I am in UTC+8 timezone, always can't attend the OSSG meeting before due to sleepy, but I don't want to miss this meeting although I am not very familiar with the current topic, I want to contribute more here.<br>
><br>
> But if you are inconvenient to reschedule the time, I can understand and will keep follow the info from email and community.<br>
><br>
> Thanks for your understanding : )<br>
><br>
><br>
> On Fri, Mar 7, 2014 at 11:55 PM, Abu Shohel Ahmed <<a href="mailto:ahmed.shohel@ericsson.com">ahmed.shohel@ericsson.com</a>> wrote:<br>
> Hi all,<br>
><br>
</div>> Yesterday?s OSSG meeting, i promised to give the current status of the activity.<br>
<div class="">> The activity is ongoing. Based on feed back from last IRC call, we have updated the<br>
> Threat Modelling framework.<br>
><br>
> The wiki page is updated now..<br>
> <a href="https://wiki.openstack.org/wiki/Security/Threat_Analysis" target="_blank">https://wiki.openstack.org/wiki/Security/Threat_Analysis</a><br>
><br>
> We are almost finishing the analysis for Auth_token middleware, Token manager and token service.<br>
> We looking for reviewer of those documents. There is a meeting<br>
> today at 17.00 GMT in ##openstack-threat-analysis (unofficial channel)<br>
><br>
><br>
> Thanks,<br>
> Shohel<br>
><br>
><br>
><br>
><br>
> We are going to have a OpenStack Threat m<br>
><br>
><br>
>> From: Abu Shohel Ahmed <<a href="mailto:ahmed.shohel@ericsson.com">ahmed.shohel@ericsson.com</a>><br>
>> Subject: Re: [Openstack-security] OpenStack Threat Analysis activity - OSSG<br>
>> Date: 21 Feb 2014 13:15:08 GMT+2<br>
>> To: "<a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a>" <<a href="mailto:openstack-security@lists.openstack.org">openstack-security@lists.openstack.org</a>><br>
>> Cc: Sriram Subramanian <<a href="mailto:sriram@sriramhere.com">sriram@sriramhere.com</a>>, "Clark, Robert Graham" <<a href="mailto:robert.clark@hp.com">robert.clark@hp.com</a>><br>
>><br>
>> Hi guys,<br>
>><br>
>> Sorry for not including the whole OSSG in the initial call. So, we are having an initial call<br>
</div>>> for Threat modelling of OpenStack (first one is Keystone) today, 21 Feb, 17.00 UTC. Let?s<br>
<div class="">>> have the discussion today then decide what time suits us best for later meetings. It is in Free node<br>
>> channel ##openstack-threat-analysis (unofficial channel).<br>
>><br>
</div>>> Today?s topics of discussion:<br>
<div class="">>> 1. Threat modelling process<br>
>> <a href="https://drive.google.com/file/d/0B1aEVfmQtqnoMmpPZ3hmUHpBa1k/edit?usp=sharing" target="_blank">https://drive.google.com/file/d/0B1aEVfmQtqnoMmpPZ3hmUHpBa1k/edit?usp=sharing</a><br>
>><br>
>> First, we t need to agree on this, so we have conformity around the whole work. Please feel<br>
>> free to provide your feedback.<br>
>><br>
>> 2. Some concrete example use of the modelling process<br>
>> Keystone over all : <a href="https://drive.google.com/file/d/0B1aEVfmQtqnobzB6M21uMEFXNUE/edit?usp=sharing" target="_blank">https://drive.google.com/file/d/0B1aEVfmQtqnobzB6M21uMEFXNUE/edit?usp=sharing</a><br>
>> Keystone Token-provider: <a href="https://drive.google.com/file/d/0B1aEVfmQtqnoejN1T1kybjlnMkk/edit?usp=sharing" target="_blank">https://drive.google.com/file/d/0B1aEVfmQtqnoejN1T1kybjlnMkk/edit?usp=sharing</a><br>
>><br>
>> (Now this documents are work in progress work, things are not always in order and complete)<br>
>><br>
>><br>
>> See you in the meeting,<br>
>> Shohel<br>
>><br>
>><br>
>><br>
>><br>
>> On 20 Feb 2014, at 20:47, Sriram Subramanian <<a href="mailto:sriram@sriramhere.com">sriram@sriramhere.com</a>> wrote:<br>
>><br>
>>> Damn - i missed the meeting again :(. I will check the logs to catch up. Sorry<br>
>>><br>
>>><br>
>>> On Thu, Feb 20, 2014 at 10:26 AM, Clark, Robert Graham <<a href="mailto:robert.clark@hp.com">robert.clark@hp.com</a>> wrote:<br>
>>> Including the whole security group as there was significant interest during the OSSG weekly meeting.<br>
>>><br>
>>><br>
>>><br>
>>> From: Sriram Subramanian [mailto:<a href="mailto:sriram@sriramhere.com">sriram@sriramhere.com</a>]<br>
>>> Sent: 20 February 2014 16:35<br>
>>> To: Abu Shohel Ahmed<br>
</div>>>> Cc: Clark, Robert Graham; Grant Murphy; Mats N?slund; Makan Pourzandi<br>
<div class="">>>> Subject: Re: OpenStack Threat Analysis activity - OSSG<br>
>>><br>
>>><br>
>>><br>
>>> Shohel,<br>
>>><br>
>>><br>
>>><br>
>>> Friday 17.00 UTC works - though 18.00 UTC would work better for me. Are we meeting tomorrow?<br>
>>><br>
>>><br>
>>><br>
>>> thanks,<br>
>>><br>
>>> -Sriram<br>
>>><br>
>>><br>
>>><br>
>>> On Wed, Feb 19, 2014 at 4:25 AM, Abu Shohel Ahmed <<a href="mailto:ahmed.shohel@ericsson.com">ahmed.shohel@ericsson.com</a>> wrote:<br>
>>><br>
>>> Hi,<br>
>>><br>
</div>>>> From our last week?s, it becomes clear that we need set up a way of working process in place<br>
<div class="">>>> to take this activity forward.<br>
>>><br>
>>> So here are some ideas (Please also share yours):<br>
>>><br>
>>> 1. WoW:<br>
>>><br>
>>> In the short time frame,<br>
>>><br>
>>> - First, We should define the purpose and the concrete output of this work ( which i think, most of us here has some ideas, if we still have question -<br>
>>> we can clear that up before moving forward).<br>
>>><br>
>>> - Second issue is, how we can do threat analysis contribution in an effective manner. Here comes the collaboration issues within<br>
>>> this group. For this, I have created a free node IRC channel ##openstack-threat-analysis ( unofficial channel, as you can see from name).<br>
>>> Lets start biweekly (15 days) meetings from this week. Lets vote for what is the suitable time for meeting for all of us.<br>
>>> I propose Friday at 17.00 UTC. However, i am happy to schedule the meeting based on most people preference.<br>
>>><br>
>>> In the longer time frame, we should think about setting up a Threat analysis working group (could be under OSSG) to perform threat modelling of all OpenStack components<br>
>>> - Define a clear out from this working group e.g., Threat documentation, Design guidance.<br>
>>> - Engage developers and security minded people to the work.<br>
>>><br>
>>><br>
>>> 2. Now on the technical side,<br>
>>><br>
>>> First and foremost, we should agree on a threat modelling process that can be applied for all OpenStack services and internal components. We have some ideas that<br>
</div>>>> can be applied for this work? Here is the link of our proposal :<br>
>>><br>
>>> <a href="https://drive.google.com/file/d/0B1aEVfmQtqnoMmpPZ3hmUHpBa1k/edit?usp=sharing" target="_blank">https://drive.google.com/file/d/0B1aEVfmQtqnoMmpPZ3hmUHpBa1k/edit?usp=sharing</a><br>
>>><br>
>>> and here are two concrete implementation of applying the threat modelling process?<br>
<div class="HOEnZb"><div class="h5">>>><br>
>>> Keystone over all : <a href="https://drive.google.com/file/d/0B1aEVfmQtqnobzB6M21uMEFXNUE/edit?usp=sharing" target="_blank">https://drive.google.com/file/d/0B1aEVfmQtqnobzB6M21uMEFXNUE/edit?usp=sharing</a><br>
>>> Keystone Token-provider: <a href="https://drive.google.com/file/d/0B1aEVfmQtqnoejN1T1kybjlnMkk/edit?usp=sharing" target="_blank">https://drive.google.com/file/d/0B1aEVfmQtqnoejN1T1kybjlnMkk/edit?usp=sharing</a><br>
>>><br>
>>> (These are work in progress documents, so by no means provide a complete picture)<br>
>>><br>
>>> Lets discuss what do you guys think about the Modelling steps and its applicability with OpenStack (e.g., Keystone)<br>
>>><br>
>>><br>
>>><br>
>>> Thanks,<br>
>>> Shohel<br>
>>><br>
>>><br>
>>><br>
>>><br>
>>><br>
>>><br>
>>><br>
>>> --<br>
>>><br>
>>> Thanks,<br>
>>><br>
>>> -Sriram<br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> Openstack-security mailing list<br>
>>> <a href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a><br>
>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a><br>
>>><br>
>>><br>
>>><br>
>>><br>
>>> --<br>
>>> Thanks,<br>
>>> -Sriram<br>
>>> _______________________________________________<br>
>>> Openstack-security mailing list<br>
>>> <a href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a><br>
>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a><br>
>><br>
><br>
><br>
> _______________________________________________<br>
> Openstack-security mailing list<br>
> <a href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a><br>
><br>
><br>
<br>
<br>
_______________________________________________<br>
Openstack-security mailing list<br>
<a href="mailto:Openstack-security@lists.openstack.org">Openstack-security@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security</a><br>
</div></div></blockquote></div><br></div>