1. OSG VO Security Policies and Requirements Mine Altunay OSG Security Team July 2007

2. Who am I? Recently joined OSG Security Team Ramping up to be full time OSG Security Working through the OSG Security Plan Helping develop any new items for the Security Plan in Year 2

3. grid job VO VO Infra. & Services Site Storage WN Three separate security domains: – Univ., VO and Site Two trust relationships Researcher accesses Site’s resources due to the trust between the VO and the Site. Researcher A from University X, which is a member of the VO VO trusts ResearcherSite trusts VO Site allows access by Researcher VO-accessible Site Resources

4. Site grants access to the VO. VO delegates the access privilege to its trusted members VO manages its members’ access rights – different access rights to different VO members – E.g. grouping of users based on tasks; or roles played in an experiment VO policy may define “groups” and “roles”

5. Researcher A from University X Researcher B from University Y Job 1’s Data Job 2’s Data VOMRS Group : Univ. X Role: Researcher Group : Univ. Y Role: Researcher VO mappings VOMRS manages member-role mappings Tanya’s talk GUMS retrieves membership info from VO enforces VO assigned privileges at the Site GUMS Retrieve VO mappings

6. Enforced Security Policy VO Policy Site Policy Enforced Policy VO Policy determines: each VO member’s privileges Site’s data storage Site Policy determines: VO has access to the storage can still blacklist particular VO members, if desired WN

7. Researcher A from University X grid job 1 VO VO Infra. & Services Site WN Researcher B from University Y Job 1’s Data Job 2’s Data Unauthorized access

8. What if something goes wrong? Incident Response Researcher A launches attack against the Site Site discovers the attack Site analyzes the attack, temporarily blacklists Researcher A (if it can trace it) Site can Call GOC at 1 317-278-9699, or submit a trouble ticket, Email goc@GOC@opensciencegrid.orgGOC@opensciencegrid.org Or email security-discuss-L@opensciencegrid.orgsecurity-discuss-L@opensciencegrid.org

9. – Inform VO security contact – Site trusts the VO, not individual members – VO finds which member has the privilege Logs and mapping repository (VOMRS) – Determines culpability and take measures over Researcher A’s privileges

10. VO Policy VO must: – List Security Contact and Administrative Contact For incident handling, reporting VO-service problems – Comply with Grid Security Policies: archival, accounting and audit (logs and changes) – Maintain a membership service to generate authentication and authorization data for accessing resources – Treat the membership and logged information confidentially and exercise due diligence – Ensure availability of VO services, comply with grid operational policies – Respond promptly to member’s queries, inform any status changes –