1. Grid Security Policy: EGEE to EGI David Kelsey (RAL) 16 Sep 2009 JSPG meeting, DFN Berlin david.kelsey at stfc.ac.uk

2. 216 Sep 2009 Kelsey, Security Policy Overview Joint Security Policy Group –The mandate –Interoperability of policies Overview of current JSPG policies New policy framework for EGI era –Feedback very welcome EGI Security Policy Group –Proposed operation

3. 316 Sep 2009 Kelsey, Security Policy Joint Security Policy Group This started as a WLCG activity in 2003 –LHC Grid (CERN) –To advise GDB and Deployment Manager On all matters related to security In 2004, EGEE started –JSPG remit expanded to cover both projects –Strong participation by OSG, NDGF, … Revised mandate (2008) –http://www.jspg.org/http://www.jspg.org/ –prepares and maintains security policies for its primary stakeholders (EGEE and WLCG) –also able to provide policy advice on any security matter Policies approved and adopted by Grid management

4. 416 Sep 2009 Kelsey, Security Policy Policy Interoperability Wherever possible, JSPG aims to –prepare simple and general policies –applicable to the primary stakeholders, but –also of use to other Grid infrastructures (NGI's etc) The adoption of common policies by multiple Grids eases the problems of interoperability (and scaling) Users, VOs and Sites all accept the same policies during their (single) registration (with Grid or VO) Other participants then know that their actions are already bound by the policies –No need for additional negotiation, registration or agreement

5. 5 Interoperability (2) User registers (once) with his/her VO –Must accept Grid AUP Sites willing to delegate registration to VO knowing that VO procedures must follow same VO policy –And that User will have accepted AUP The use of common policies –Allow VOs to easily use resources in multiple Grids as move to EGI in Europe, for example Other Grids are welcome to use our policies –With appropriate acknowledgements! 16 Sep 2009 Kelsey, Security Policy

6. 6 Overview of current JSPG Policies 16 Sep 2009 Kelsey, Security Policy

7. 716 Sep 2009 Kelsey, Security Policy Grid Security Policy The main policy document https://edms.cern.ch/document/428008/ To fulfil its mission, it is necessary for the Grid to protect its resources. This document presents the policy regulating those activities of Grid participants related to the security of Grid services and Grid resources.

8. 816 Sep 2009 Kelsey, Security Policy Grid Security Policy (2) Objectives –This policy gives authority for actions which may be carried out by certain individuals and bodies and places responsibilities on all participants. Scope –This policy applies to all participants. Every site participating in the Grid autonomously owns and follows their own local security policies with respect to the system administration and networking of all the resources they own, including resources which are part of the Grid. This policy augments local policies by setting out additional Grid-specific requirements.

9. 916 Sep 2009 Kelsey, Security Policy Grid Security Policy (3) Additional Policy documents –Appendix 1 defines additional policy documents which must exist for a proper implementation of this policy. These documents are referred to in section 2. Roles and Responsibilities: Participants –Grid Management –Grid Security Officer & Grid Security Operations –Virtual Organisation Management –Users –Site Management –Resource Administrators

10. 1016 Sep 2009 Kelsey, Security Policy Grid Security Policy (4) Limits to Compliance –Wherever possible, Grid policies and procedures are designed so that they may be applied uniformly across all sites and VOs. If this is not possible, for example due to legal or contractual obligations, exceptions may be made. Such exceptions must be justified in a document submitted to the Grid Security Officer for authorisation and, if required, approval at the appropriate level of management. –In exceptional circumstances it may be necessary for participants to take emergency action in response to some unforeseen situation which may violate some aspect of this policy for the greater good of pursuing or preserving legitimate Grid objectives. If such a policy violation is necessary, the exception should be minimised, documented, time-limited and authorised at the highest level of the management commensurate with taking the emergency action promptly, and the details notified to the Grid Security Officer at the earliest opportunity.

11. 1116 Sep 2009 Kelsey, Security Policy Grid Security Policy (5) Sanctions, Liability, Disputes and Intellectual Property Rights –Sites or resource administrators who fail to comply with this policy in respect of a service they are operating may lose the right to have that service instance recognised by the Grid until compliance has been satisfactorily demonstrated again. –Users who fail to comply with this policy may lose their right of access to and/or collaboration with the Grid, and may have their activities reported to their home institute or, if those activities are thought to be illegal, to appropriate law enforcement agencies. –VOs which fail to comply with this policy, together with all the users whose rights with respect to the Grid derives from that VO, may lose their right of access to and/or collaboration with the Grid. –The issues of liability, dispute resolution and intellectual property rights, all of which may be Grid-specific, should be addressed in the additional policy documents.

12. 1216 Sep 2009 Kelsey, Security Policy Security Policy Site & VO Policies Certification Authorities Traceability and Logging Security Incident Response Accounting Data Privacy Pilot Jobs and VO Portals Grid & VO AUPs JSPG Security Policies

13. 1316 Sep 2009 Kelsey, Security Policy Sites Operations Policy Accepted and signed by authorized person during registration of Site with the Grid https://edms.cern.ch/document/819783

14. 1416 Sep 2009 Kelsey, Security Policy VO Operations Policy Accepted and signed by authorized person during registration of VO with the Grid https://edms.cern.ch/document/853968

15. 1516 Sep 2009 Kelsey, Security Policy Grid AUP Acceptable Use Policy Accepted by User during registration with VO https://edms.cern.ch/document/428036

16. 1616 Sep 2009 Kelsey, Security Policy Recent JSPG work Five recently approved and adopted policies Virtual Organisation Registration Security Policy https://edms.cern.ch/document/573348/8 Virtual Organisation Membership Management Policy https://edms.cern.ch/document/428034/3 Grid Policy on the Handling of User-Level Job Accounting Data https://edms.cern.ch/document/855382/5 VO Portal Policy https://edms.cern.ch/document/972973/6 Security Incident Response Policy https://edms.cern.ch/document/428035/7

17. 17 Ongoing revisions Site Registration Security Policy –One remaining policy to be revised Grid AUP –Some Grids use it but have modified our text –Some find it does not meet their needs –Explore why and standardise where possible DEISA, TeraGrid, EU infrastructures, national Grids, … 16 Sep 2009 Kelsey, Security Policy

18. 18 From EGEE to EGI 16 Sep 2009 Kelsey, Security Policy

19. 19 New policy framework for EGI A framework to enable interoperation of collaborating Grids Identify policy components necessary to create trust between collaborating Grids Not imposing a single policy for all We started from the current set of JSPG policies –Not re-writing these –Taking high-level view to identify those components which are necessary Other components of current JSPG policies which are either too EGEE-specific or are operational rather than related to security are not part of this framework Each Grid will have security policies consisting of the framework components and their own Grid-specific components 16 Sep 2009 Kelsey, Security Policy

20. 20 Framework (2) Specifies the issues that need to be addressed in a Grid's security policy At this stage does not define minimum standards or requirements –Standards will (hopefully) come later This is aimed at Grids preparing or revising security policies, not at end users, sites, application communities etc. As an aside... we found it very useful to have been through the whole JSPG "experience" to identify those issues which need to be addressed! 16 Sep 2009 Kelsey, Security Policy

21. 16 Sep 2009 Operational Security User Responsibilities Includes VOs & application communities Site Responsibilities Includes Resource providers & Service providers Data Protection Incident Response Security Policy Framework We have considered and deliberately excluded: IPR, liability, software licensing, copyright.

22. 16 Sep 2009 Operational Security Vulnerabilities Patching Security officer User Responsibilities AUP Traceability VO managmnt Site Responsibilities Traceability Collaboration with Grid Ops Controlling access Data Protection Confidential information handling Personal data protection Incident Response Inform others Collaborate Timely handling Policy Framework (2) Some early ideas of policy components

23. 16 Sep 2009 Operational Security Vulnerabilities Patching Security officer User Responsibilities AUP Traceability VO managmnt Site Responsibilities Traceability Collaboration with Grid Ops Controlling access Data Protection Confidential information handling Personal data protection Incident Response Inform others Collaborate Timely handling Policy Framework (3) EGEE- specific components JSPG today - mixing general components and EGEE issues

24. 24 Now to the details… http://www.jspg.org/wiki/Policy_Framework 16 Sep 2009 Kelsey, Security Policy

25. 25 Framework – Next steps Create template of generic wording for the policy components –This will necessarily involve setting minimum standards and therefore reaching agreement will take time There is also a need for people with different roles (Site/resource managers, users, etc.) to easily identify policy components that apply to them 16 Sep 2009 Kelsey, Security Policy

26. 26 Policy in EGI EGI Proposal V1 includes a Security Policy Group (SPG) –Development and maintenance of security policies –Advice on any security policy issue –Primary stakeholders: NGIs, Sites, Application communities – but include other infrastructures –Build on JSPG work –Continue to aim for common, simple policies for interoperation 16 Sep 2009 Kelsey, Security Policy

27. 27 EGI SPG(2) Membership: NGI reps, Sites, VOs, middleware, security ops Participate in EUGridPMA, IGTF, OGF, TERENA federations, etc. Small editorial team to prepare policies –Meet face to face Full consultation by e-mail Annual face to face meeting? Coordination with other security activities and informing everyone are important 16 Sep 2009 Kelsey, Security Policy

28. 2816 Sep 2009 Kelsey, Security Policy JSPG Meetings, Web etc Meetings - Agenda, presentations, minutes etc http://indico.cern.ch/categoryDisplay.py?categId=68 JSPG Web sites http://www.jspg.orghttp://www.jspg.org and http://proj-lcg-security.web.cern.ch/ Membership of the JSPG mail list is closed, BUT –Volunteers to work with us are always welcome! Policy documents at http://www.jspg.org andhttp://www.jspg.org http://proj-lcg-security.web.cern.ch/proj-lcg- security/documents.html

29. 2916 Sep 2009 Kelsey, Security Policy Where are JSPG security policies? http://www.jspg.org/wiki/JSPG_Docs http://proj-lcg-security.web.cern.ch/proj-lcg- security/documents.htmlhttp://proj-lcg-security.web.cern.ch/proj-lcg- security/documents.html https://edms.cern.ch/nav/CERN-0000022711

30. 16 Sep 2009Kelsey, Security Policy Discussion

31. 31 Discussion topics General approach? Merge Operational Security and Incident Response? Do we need a Security Officer? Does Operational Security include “banning users”? What should we say about AuthN and AuthZ? 16 Sep 2009 Kelsey, Security Policy