Jump to: navigation, search


< Security
Revision as of 10:51, 9 January 2015 by Tim Kelsey (talk | contribs) (adding anchor)


This page tracks the ongoing security efforts within the OpenStack community. Most of the work here is being performed by members of the OpenStack Security Group (OSSG). There are many ways that you can get involved:

  1. Contact one of the project leads listed below to help with a specific project.
  2. Learn about other ways to contribute.
  3. Attend the weekly OSSG IRC meetings to learn more.

OpenStack Security Guide

This is the book that was originally created in a book sprint in June 2013. Ongoing work to maintain and improve the book is being led by the following group:

  1. Ben de Bont
  2. David Mortman
  3. Sriram Subramanian

Cross Project Security Guidelines

A cross-project set of security guidelines for OpenStack development should be established and followed, similar to the way that coding standards are handled. More details are available on the Security Guidelines wiki page.

This project is being worked on by the following people:

Bandit Source Code Analyzer

Bandit is a Python AST-based static analyzer from the OpenStack Security Group. More details are available on the Bandit wiki page.

Core project team:

  • Jamie Finnigan (chair6)
  • Travis McPeak (tmcpeak)
  • Nathan Kinder (nkinder)
  • Tim Kelsey (tkelsey)


Anchor is an ephemeral PKI system built to enable cryptographic trust in OpenStack services in a way that doesn't rely on broken provisioning and revocation mechanisms that undermine most PKI deployments. Mor info can be found on the Anchor wiki page.

Core project team:

  • Robert Clark (hyakuhei)
  • Tim Kelsey (tkelsey)
  • Doug Chivers (dg)