LCG Security Status and Issues Ian Neilson Grid Deployment Group CERN LHCC 15 November, 2005 - 1

LCG Security Status and Issues Overview Security Policy Joint Security Policy Group Authentication & Authorization Infrastructure International Grid Trust Federation LHC Experiment Virtual Organisations Operational Security Operational Security Coordination Team Incident Response Planning Security Monitoring Tools Security Service Challenges plus some related activities LHCC 15 November, 2005 - 2

Security Policy Joint Security Policy Group LCG & EGEE with strong input from OSG Policy Set - Security & Availability Policy Usage Rules Certification Authorities Audit Requirements Incident Response User Registration & VO Management Application Development & Network Admin Guide VO Security LHCC 15 November, 2005 - 3

Security Policy Policy Revision In Progress/Completed Grid Acceptable Use https://edms.cern.ch/document/428036/ common, general and simple AUP for all VO members using many Grid infrastructures EGEE, OSG, SEE-GRID, DEISA, national Grids… VO Security https://edms.cern.ch/document/573348/ responsibilities for VO managers and members VO AUP to tie members to Grid AUP accepted at registration Incident Handling and Response https://edms.cern.ch/document/428035/ defines basic communications paths defines requirements (MUSTs) for IR reporting response protection of data analysis not to replace or interfere with local response plans LHCC 15 November, 2005 - 4

Security Policy Issues Can generic ‘simple’ policies be binding? can they protect across legislative domains? Release of accounting data some site policies restrict release of per-user data legal implications of EU directives on privacy needed to properly manage and account to VOs More policy updates needed but revision process is slow top-level security and availability policy new policy for Data Handling/Protection needed Depth of policy review and discussion varies Risk Analysis should be repeated http://cern.ch/proj-lcg-security/RiskAnalysis/risk.html LHCC 15 November, 2005 - 5

Authentication Infrastructure IGTF – International Grid Trust Federation LCG currently accepts certificates from EUGridPMA CAs plus FNAL Kerberized CA IGFT officially formed at GGF15 3 regional PMAs: Europe, Asia Pacific, Americas addresses scalability issues felt by EUGridPMA separate the management of authentication profiles EUGridPMA: ‘classic’ CA TAGPMA: Short-lived Credential Generation Services brings FNAL KCA under an IGTF profile in future for myproxy and Shibboleth based services For LCG – “relying parties” what service is expected beyond credential issuing? revocation processing CA world is still “settling down”, will it stabilize? move from grid sites to NRENS LHCC 15 November, 2005 - 6

Authorization Infrastructure LHC Experiment Virtual Organisations VO Management service now deployed in beta at CERN VOMRS registration interface – good collaboration with FNAL Managed CERN Oracle service DB All 4 LHC experiments Back-end tied to CERN HR database view (ORGDB) allows use of existing exp. registration relies on membership lifecycle maintenance! but VO manager retains control e.g. https://lcg-voms.cern.ch:8443/vo/atlas/vomrs LHCC 15 November, 2005 - 7

Authorization Infrastructure VOMS+VOMRS gives managed VO group+role flexibility BUT grid service authorization now based on simple group/role only authorization workshop discussed near-term requirements – SC4 http://agenda.cern.ch/fullAgenda.php?ida=a054503 VO Management and Authorization Services Critical service but has been hard to deploy HR interface Oracle support gLite packaging Limited experience in real operation Debug Performance LHCC 15 November, 2005 - 8

Operational Security Coordination Team OSCT membership = EGEE ROC security contacts What it is not: Not focused on middleware security architecture Not focused on vulnerabilities Vulnerabilities Group formed and operational Focus on Incident Response Coordination Assume it’s broken, how do we respond? Planning and Tracking Focus on ‘Best Practice’ Advice Monitoring Analysis Coordinators for each EGEE ROC plus OSG LCG Tier 1 + Taipei LHCC 15 November, 2005 - 9

Operational Security Coordination Team Incident Response Monitoring Tools Security Service Challenge Policy HANDBOOK Procedures Resources Reference Playbook Infrastructure Agents Deployment SSC1 - Job Trace SSC2 - Storage Audit Infrastructure LHCC 15 November, 2005 - 10

Operational Security Coordination Team Incident Response issues Contact management Use of site registration process and GOCDB Shift from site-based to regional/grid coordination Operational role for OSCT Live incident Lack of real incident experience incidents WILL happen and they WILL be disruptive OSCT can plan BUT cannot anticipate all eventualities Lack of dedicated resources Should be provided by EGEE-II NREN CSIRTS – overlap of IR activities understanding how/when/if to use Security Service Challenges Lessons from SSC1 Plan for SSC2 (storage) and beyond LHCC 15 November, 2005 - 11

LCG Security Status and Issues Related activities Optical Private Network Security Working group formed by GDB Disaster Recovery Planning Recent presentations at HEPiX and EGEE-4 ISSeG Proposed EU-funded project on Integrated Site Security for Grids CERN/Openlab lead LHCC 15 November, 2005 - 12

Thank You LHCC 15 November, 2005 - 13