1. DTI Mission – 29 June 2004 - 1 LCG Security Ian Neilson LCG Security Officer Grid Deployment Group CERN

2. DTI Mission – 29 June 2004 - 2 LCG Security environment The players UsersVOs Sites Personal data Roles Usage patterns … Experiment data Access patterns Membership … Resources Availability Accountability … Grid

3. DTI Mission – 29 June 2004 - 3 The Risks Top risks from Security Risk Analysis http://proj-lcg-security.web.cern.ch/proj-lcg-security/RiskAnalysis/risk.html Launch attacks on other sites Large distributed farms of machines Illegal or inappropriate distribution or sharing of data Massive distributed storage capacity Disruption by exploit of security holes Complex, heterogeneous and dynamic environment Damage caused by viruses, worms etc. Highly connected and novel infrastructure

4. DTI Mission – 29 June 2004 - 4 Policy – the LCG Security Group Security & Availability Policy Usage Rules Certification Authorities Audit Requirements GOC Guides Incident Response User Registration Application Development & Network Admin Guide http://cern.ch/proj-lcg-security/documents.html

5. DTI Mission – 29 June 2004 - 5 Authentication Infrastructure Users and Services own long-lived (1yr) credentials Digital certificates (X.509 PKI) European Grid Policy Management Authority “… is a body to establish requirements and best practices for grid identity providers to enable a common trust domain applicable to authentication of end-entities in inter-organisational access to distributed resources. …” www.eugridpma.org covers EU (+ USA + Asia)www.eugridpma.org Jobs submitted with Grid Proxy Certificates Short-lived (<24hr) credential which “travels” with job Delegation allows service to act on behalf of user Proxy renewal service for long-running & queued jobs Some Issues… Do trust mechanisms scale up ? “On-line” certification authorities & Certificate Stores Kerberized CA Virtual SmartCard Limited delegation

6. DTI Mission – 29 June 2004 - 6 Authorization Infrastructure User Registers Accepts Usage Rules Provides personal/contact data Request to join VO VO managers add to VO servers Certificate Identity (DN) captured Submits jobs Creates short-lived proxy using long-lived certificate Proxy ‘travels’ with the job Resources authorize access Checks certificate validity Trusted CAs and revocation lists Checks user authorization Downloaded from Registration/VO servers Maps certificate DN to a local account Runs job

7. DTI Mission – 29 June 2004 - 7 User Registration (2003-4) lcg-registrar.cern.ch VOs 1. “I agree to the Usage Rules please register me, my VO is XYZ” 2. Confirm email 3. User Details User XYZ VO Manager 4. Register 5. Notify 6. User Details Site Authz Resource Authz Certificate GRID Usage Rules Submit job ? CA Certificates

8. DTI Mission – 29 June 2004 - 8 User Registration (? 2004 - ) Some Issues Static user mappings will not scale up Multiple VO membership Complex authorization & policy handling VO manager needs to validate user data How ? Solutions VO Management Service - Attribute proxy certificates Groups and Roles - not just static user mapping Attributes bound to proxy cert., signed by VO Service Credential mapping and authorization Flexible policy intersection and mapping tools Integrate with Organizational databases, but … What about exceptions ? (the 2-week summer student) What about other VO models: lighweight, deployment, testing XYZ VO Manager ? Certificate Roles

9. DTI Mission – 29 June 2004 - 9 Audit & Incident Response Audit Requirements Mandates retention of logs by sites Incident Response Security contact data gathered when site registers Establish communication channels maillists maintained by Deployment Team List of CSIRT lists –Channel for reporting Security contacts at site –Channel for discussion & resolution Escalation path 2004 Security Service Challenges Check the data is there, complete and communications are open

10. DTI Mission – 29 June 2004 - 10 Security Collaboration Projects sharing resources & have close links Need for inter-grid global security collaboration ? Common accepted Usage Rules ? Common authentication and authorization requirements ? Common incident response channels LCG – EGEE – OSG - ? LCG Security Group is now Joint Security Group JSG for LCG & EGEE Provide requirements for middleware development Some members from OSG already in JSG

11. DTI Mission – 29 June 2004 - 11 LCG Security Thank you.