Table of Contents
Attendees: Petr, Aram, Michal N., Michał K., Everett, Evan, Chuck, Mark, Ondrej, Peter, Cathy, Vicky, Artem, Aram.
We need more people (arguably everyone on the BIND 9 team in the long run?) to take part in Incident Manager rotation. This year, we had 5 BIND CVEs which were handled by a total of three unique IMs/deputy IMs. 2020 was similar. Similarly to Escalation Engineer duties, this leads to burnout and stalling other work, so the load should be spread across more people. "LRU order" sounds like a fair arrangement?
Thoughts
Vicky: Are there any special skills the IM needs to have? For example, access to security officer emails, ability to send email as security officer.
Michał: said nothing more than organization and meeting deadlines. But this did cause some confusion in the most recent CVE.
So far, only Michał has been IM. Petr and Cathy will be new for the recently reported one.
Can anyone use the checklist and do it by following the checklist?
Presentation
Chuck: Would it be beneficial to have an experienced IM give a short presentation on the process? This would help remove some of the mystery of it.
Yes, Michał going through the checklist at the end of the meeting.
Peter: Would it help if there was one person from support and one from Sweng (IM/Deputy).
Michał: It wouldn't hurt, but not sure if there is a real benefit.
Cathy: This shouldn't be confused with the "security officer" role being discussed in another forum: that is specific to handling security vulnerabilities.
Ondrej: Not everybody should do the IM. Some people are better at cracking whips, some are not
Evan: I don't know what it entails, I don't know if I am good it, but we need more people than just Michal doing this, so volunteering.
Matthijs agrees.
Chuck: There is a gitlab issue and there is nothing mystifying.
-
Link to most recent completed CVE checklist: https://wiki.isc.org/bin/view/Main/SecurityIncident20210909LameCache
-
Link to explanations: https://wiki.isc.org/bin/view/Main/SecurityIncidentChecklistExplanations
Petr: doing this for the first time, agrees with Chuck.
Everett: Perhaps a try at deputy-IM to get one's feet wet before taking on full IM duty.
Matthijs: Think it's better to do the IM first and use deputy as advisor role.
Ondrej: do we actually need the deputy IM role?
It helps:
- Cathy: used for sparring ("Should we do this step?", "Is this sufficient?")
- Chuck: In different timezone, deputy can help out.
- Matthijs: Predictable who should take over.
Ondrej: Everyone has lots of tasks to do, do we really need a deputy? It means two persons are distracted.
Ondrej: Whomever is next in the rotation can be the 'deputy' (or better name is 'standby') for the current IM.
Takeaways
- More people have to take part in the IM rotation.
- Perhaps not everyone? It is a bad job, but some can handle it better than others.
- Create a LRU list. The first one on the list is the IM. The second person on the list is the standby.
- Update IM process wrt assigning CVE numbers.