**Salsa Call 15-May-08**

**Attending**
Chris Misra, U. Mass (chair)
Kevin Miller, Duke
Doug Pearson, REN-ISAC/Indiana U.
Joe St. Sauver, Internet2/U. Oregon
Mike Van Norman, UCLA
Jeff Schiller, MIT
Rodney Petersen, Educause
Chas DiFatta, CMU
Renee Frost, Internet2
Steve Olshansky, Internet2 (scribe)

**Discussion**
- Debian/SSL/and not-so-randomness
US-CERT now has an advisory out on this:
http://www.us-cert.gov/current/#debian_openssl_vulnerability

Derivatives of Debian/Ubuntu are a related question… Archived keys are also a potential concern. It appears that could be many key pairs out in the wild that were generated on compromised systems, and some SCADA systems are built on Debian, thus the impact could be very significant.

- NAC endpoint agents
There are some potential downsides to installing agents on hosts that could just as easily do harm as good. Much of the malware currently is targeted at security software. Installing a security agent on an otherwise clean machine potentially introduces a new attack vector. These agents intentionally have functionality that goes beyond what is normally seen in installed software, in terms of access to sensitive system data.

- Security Professionals Conference - recap
Largest to date, over 400, and very well received. There was interest in more technical hands-on sessions. Next year it will be held in Atlanta.

- NSF CyberSecurity Summit
Attendance was good, and the meeting went well. The program committee will continue to serve for a few months, to transition over to the new one.

- REN-ISAC member meeting - good attendance, meeting went well

- I2 strategic planning update
- Comments to wiki
https://wiki.internet2.edu/confluence/display/I2SP/2008+INTERNET2+STRATEGIC+PLANNING