 |
 |
I remember the related discussion from last month (http://serials.infomotions.com/code4lib/archive/2012/201203/thread.html#777) -- and kudos for bringing it up again -- and I find I'm still of mixed feelings about it. Security is an important aspect of software development, no argument, but I wonder if there is something separate or distinct for libraries about the topic. What I do wonder about, though, is if there is a role for a generic-to-libraries security incident response team that would responsibly take in reports of security problems, work with vendors and/or software developers, and publish outcomes. I could see a need for such a team that was respected in our field and had contacts with people from the vendor community and FOSS projects. Peter On Apr 20, 2012, at 12:35 PM, Erin Germ wrote: > At IUG I talked to a few people about security of library services and > applications. Becky had mentioned doing a breakout session to discuss > security at the next IUG or conference. > > Would anyone be interested in helping plan a breakout session and > discussing security of library services and application? A recent > presentation lead me to believe it would also be of great value to have a > set of good practices that are very accessible to those who do not have a > security, or even IT, background. > > Or would anyone be interested in forming an informal SEC4LIB discussion > group. This would be an informal group to discuss existing security > features and shortcomings of library services and applications. Ideally > this would include a blend of high and low level skills and knowledge. > > I am personally interested in documenting known and patched vulnerabilities > of current and past library software and services. -- Peter Murray Assistant Director, Technology Services Development LYRASIS [log in to unmask] +1 678-235-2955 1438 West Peachtree Street NW Suite 200 Atlanta, GA 30309 Toll Free: 800.999.8558 Fax: 404.892.7879 www.lyrasis.org LYRASIS: Great Libraries. Strong Communities. Innovative Answers.