1. 1 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 ISS e G Integrated Site Security for Grids EU-FP6 Project 026745 Experience with Integrated Site Security Alan Silverman, CERN on behalf of the ISSeG project HEPiX 07, St Louis, 9 November 2007

2. 2 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 The ISSeG project  EU co-funded project  3 partners  CERN  FZK, Forschungszentrum Karlsruhe GmbH  STFC, Science and Technology Facilities Council, UK (formally CCLRC, RAL)  Started in February 2006  Ends March 2008

3. 3 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 What is ISS? Integrated Site Security - ISS  ISS is the concept of integrating the technical, administrative and educational aspects of information security at your site so that they work together to improve your overall site security.  While this is not specific to Grid environments, it is extremely relevant to all Grid sites as we all work together.

4. 4 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 ISS - Integrated Site Security Know who is using your network Close accounts when people leave Establish a computer Security Incident Response Team Require computer users to be officially registered Explain technical changes to users before, during and after implementation Create and maintain training and awareness campaigns for security polices and best practice. Raise awareness for security policies Use security mechanisms and tools, e.g. anti-virus, firewall management, central patch management, intrusion detection

5. 5 I ntegrated S ite S ecurity for G rids www.isseg.eu What is ISSeG producing? www.isseg.eu

6. 6 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Risk assessments Risk assessments – What are they and why bother? Organizations are often required to establish a process to manage risks as part of a corporate governance strategy. Risk assessment includes the following steps: Identify the assets and risks Analyse the existing security controls Implement any identified and resourced improvement plan Monitor the existing controls to see that they are effective

7. 7 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 ISSeG questionnaire The ISSeG risk assessment questionnaire  can help you start the risk assessment process and identify what assets you have and some of the risks.  Based on ISO/IEC 17799:2005 standard (a long list of technical controls*)  Adapted as a result of practical experience at a number of Grid sites (CERN, FZK, STFC (ex CCLRC)) * A control is a means of managing risk. It can include policies, procedures, guidelines, practices or organizational structures, which may be of an administrative, technical, managerial or legal nature. The term control is also used as a synonym for a safeguard, mitigation, countermeasure.

8. 8 I ntegrated S ite S ecurity for G rids www.isseg.eu ISSeG questionnaire  Security is not a “thing” you do, it is a continuous process. You need some way of working out where to start and measure progress.  The questionnaire helps you identify and prioritise what security controls need to be implemented first.  It has been developed as a Microsoft Excel® spreadsheet that requires the use of macros. (We hope you trust us!)  If not, just reading the questionnaire is a very useful exercise! © Members of the ISSeG Collaboration, EU-FP6 Project 026745

9. 9 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 ISSeG questionnaire http://cern.ch/ISSeG- training/RiskAssessment/RiskAssessment.htm

10. 10 I ntegrated S ite S ecurity for G rids www.isseg.eu Recommendations, training material  Recommendations  Around 60 in total  Varying level of detail  Short, as PRACTICAL as possible  Training material  Targeted populations  System administrator  Developer  General user  Manager © Members of the ISSeG Collaboration, EU-FP6 Project 026745

11. 11 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Example Recommendations Broaden the use of centralised management  R1: Centrally manage accounts  R2: Centrally manage patches and system configurations  R3: Centrally manage Internet Services Integrate identity and resource management  R4: Provide integrated identity management  R5: Ensure resources link to the people in charge of them  R6: Define responsibilities using roles and groups Manage your network connectivity  R7: Restrict Intranet access to authorised devices  R8: Restrict Internet access to authorised connections  R9: Segregate networks dedicated to sensitive devices  R10: Expand the use of application gateways

12. 12 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Example Recommendations Use security mechanisms and tools  R11: Strengthen authentication and authorisation  R12: Increase the use of vulnerability assessment tools  R13: Adapt incident detection to meet evolving trends  R14: Strengthen and promote network monitoring tools  R15: Enhance span filter tools and mailing security  R16: Extend policy enforcement Strengthen administrative procedures and training  R17: Adapt training to requirements of users, developers and system administrators  R18:Integrate security training and best practice into organisational structures  R19:Maintain administrative procedures in step with evolving security needs  R20: Extend policy regulations  R21: Regulate the use and coexistence of legacy Operating Systems

13. 13 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 And more recommendations  R51: Create an information security policy  R52: Review your information security policy  R53: Allocate information security responsibilities  R54: Establish confidentiality agreements  R55: Maintain contacts with special interest groups  R56: Maintain an inventory of assets  R57: Establish ownership of assets  R58: Define acceptable use for assets  R59: Establish information classification guidelines  R60: Develop information labeling and handling procedures  R61: Define terms and conditions of employment  R62: Encourage information security awareness, education and training  R63: Ensure access rights are up to date  R64: Establish a physical security perimeter  R65: Implement physical entry controls  R66: Provide physical protection and guidelines for working in secure areas  R67: Protect equipment from disruptions in supporting facilities  R68: Assure secure disposal or reuse of equipment  R69: Document your operating procedures  R70: Manage changes to information processing facilities and systems  R71: Separate you development, test, and operational facilities  R72: Implement capacity management  R73: Install and regularly update malicious code detection and repair software  R74: Manage the execution of mobile code  R75: Establish backup and restoration procedures  R76: Implement intrusion detection and prevention mechanisms  R77: Control access to your network  R78: Use cryptographic techniques for information confidentiality and integrity  R79: Establish agreements for exchange of information and software with external parties  R80: Enhance the security of your e-mail communications  R81: Protect the integrity of publicly available information  R82: Enable audit logging of user activities, exceptions and security events  R83: Establish procedures for monitoring system use and reviewing results  R84: Ensure protection of log information  R85: Establish an access control policy based on security requirements  R86: Establish a formal procedure to control the allocation of access rights  R87: Restrict and control the allocation of privileges  R88: Implement a formal management process for password allocation  R89: Enforce good practices in the selection and use of passwords  R90: Ensure that unattended equipment is appropriately protected  R91: Prevent unauthorized access to network services  R92: Implement strong authentication for external connections  R93: Adopt appropriate security measures for mobile computing  R94: Implement appropriate policy, procedures, and guidelines for teleworking  R95: Establish training and guidelines for secure programming  R96: Establish a formal application integration/qualification process  R97: Implement an automated patch managementS5: Strengthen administrative procedures and training (cont.)

14. 14 I ntegrated S ite S ecurity for G rids www.isseg.eu Recommendations  Initial versions exist for all of them and the first batch of basic ones should be on the web site before the end of the year  Work will continue, adding the rest and improving them, until the project ends in March 2008  The web site will also be adapted to make it easier and quicker to access the most useful material © Members of the ISSeG Collaboration, EU-FP6 Project 026745

15. 15 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Recommendation structure  Common structure:  What  Why  How  Links

16. 16 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Technical recommendations  Restrict Internet access to authorized connections  Closing firewall access impacts used applications  Update mechanism is required  Segregate networks dedicated to sensitive devices  Requires careful analysis of requirements and impact  Expand the use of application gateways  Reduces spread of incidents  Useful for untrusted devices  Restrict Intranet access to authorized devices  802.1x functionality  A mapping to the device owner is recommended Finance network Controls networks Campus network

17. 17 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Administrative recommendations  Extend policy regulations  Policy writing requires both technical and administration knowledge  clarity is important for both users and administrators  Maintain administrative procedures in step with evolving security needs  Regular reviews need to be planned  ISS methodology is a useful tool  Examples:  Strengthened policies for controls networks  Strengthened firewall policies  Strengthened account policies  Use of application gateways  Use and coexistence of legacy operating systems  Define rights and duties for administrators

18. 18 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Training recommendation  General users  Computer users just want to get on and use the systems. Security needs to invisible.  They need to know why security is relevant to them. this is not good security…

19. 19 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 General users  General advice & material for users  http://cern.ch/ISSeG-training/DownLoad/Computer- Advice-General-Users.pdf http://cern.ch/ISSeG-training/DownLoad/Computer- Advice-General-Users.pdf

20. 20 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Developers  Application developers  Check lists can be useful aids to secure software.

21. 21 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Checklist for Developers Checklist addresses the various stages of the development process 1. Architecture 2. Design 3. Cryptography 4. Implementation 5. Coding 6. After Implementation

22. 22 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Developers  General advice & material for developers  http://cern.ch/ISSeG- training/Training/DeveloperCheckList.htm http://cern.ch/ISSeG- training/Training/DeveloperCheckList.htm

23. 23 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 System Administrators  System Administrators  Check lists can be useful aids

24. 24 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Checklist for System Administrators 1. Harden the OS and Applications 2. Keep the OS and Applications up-to-date 3. Use a local firewall 4. Take advantage of the logs 5. Ensure that all passwords are secure 6. Take extra precautions for privileged accesses 7. Use security products when relevant 8. Take into account physical security 9. Keep your security knowledge up-to-date.

25. 25 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 System Administrators  General advice & material for Sys. Admins.  http://cern.ch/ISSeG- training/Training/SysAdminCheckList.htm http://cern.ch/ISSeG- training/Training/SysAdminCheckList.htm

26. 26 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Managers  http://cern.ch/ISSeG-training/myRole/myRole_Manager.htm http://cern.ch/ISSeG-training/myRole/myRole_Manager.htm

27. 27 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Managers How to sell security – working with managers  We want resources (staff time and money)  We need support  Managers want reassurance  Managers see security as a necessary evil Guidance notes are being developed  http://cern.ch/ISSeG- training/Recommendations/myRole_manager.htm http://cern.ch/ISSeG- training/Recommendations/myRole_manager.htm

28. 28 I ntegrated S ite S ecurity for G rids www.isseg.eu Summary  All the ISSeG material is on the web site at http://www.isseg.eu  Risk assessment questionnaire http://cern.ch/ISSeG-training/RiskAssessment/RiskAssessment.htm http://cern.ch/ISSeG-training/RiskAssessment/RiskAssessment.htm  Checklist for system administrators http://cern.ch/ISSeG-training/Training/SysAdminCheckList.htm http://cern.ch/ISSeG-training/Training/SysAdminCheckList.htm  Checklist for developers http://cern.ch/ISSeG-training/Training/DeveloperCheckList.htm http://cern.ch/ISSeG-training/Training/DeveloperCheckList.htm  Training/advice for general users http://cern.ch/ISSeG-training/DownLoad/Computer-Advice-General-Users.pdf http://cern.ch/ISSeG-training/DownLoad/Computer-Advice-General-Users.pdf  Advice and material for managers http://cern.ch/ISSeG-training/Recommendations/myRole_manager.htm http://cern.ch/ISSeG-training/Recommendations/myRole_manager.htm  Recommendations – will be added soon! © Members of the ISSeG Collaboration, EU-FP6 Project 026745