Grid Security Policy David Kelsey (RAL) 1 July 2009 UK HEP SYSMAN Security workshop david.kelsey at stfc.ac.uk

Grid Security Policy

David Kelsey (RAL)1 July 2009

UK HEP SYSMAN Security workshopdavid.kelsey at stfc.ac.uk

21 Jul 2009 Kelsey, Security Policy

Overview• Why do we need security policies?• Joint Security Policy Group

– The mandate– Interoperability is important!

• Overview of JSPG policies– Some example policies

• Future plans


Why do we need security policies?

• Management of IT security– All about management of risks and

balancing with availability of services• Having performed a risk analysis

– Need a Security Plan• to mitigate and manage those risks

• Security Plan includes various “Controls”– Technical– Operational– Management

• Security Policy is part of Management Controls (written documents)

4

Trust is important• Trust is a relationship of reliance. A trusted

party is presumed to seek to fulfill policies, ethical codes, law and their previous promises. (wikipedia)

• Trust is a prediction of reliance on an action, based on what a party knows about the other party. Trust is a statement about what is otherwise unknown -- for example, because it is far away, cannot be verified, or is in the future.


http://en.wikipedia.org/wiki/Policy

http://en.wikipedia.org/wiki/Ethics

http://en.wikipedia.org/wiki/Law


Joint Security Policy Group• This started as a WLCG activity in 2003

– LHC Grid (CERN)– To advise GDB and Deployment Manager

• On all matters related to security

• In 2004, EGEE started– JSPG remit expanded to cover both projects– Strong participation by OSG, NDGF, …

• Revised mandate (2008)– http://www.jspg.org/– prepares and maintains security policies for its primary

stakeholders (EGEE and WLCG)– also able to provide policy advice on any security matter

• Policies approved and adopted by Grid management

http://www.jspg.org/


Policy Interoperability• Wherever possible, JSPG aims to

– prepare simple and general policies– applicable to the primary stakeholders, but– also of use to other Grid infrastructures (NGI's etc)

• The adoption of common policies by multiple Grids eases the problems of interoperability (and scaling)

• Users, VOs and Sites all accept the same policies during their (single) registration (with Grid or VO)

• Other participants then know that their actions are already bound by the policies– No need for additional negotiation, registration or

agreement

7

Interoperability (2)• User registers (once) with his/her VO

– Must accept Grid AUP

• Sites willing to delegate registration to VO knowing that VO procedures must follow same VO policy– And that User will have accepted AUP

• The use of common policies– Allow VOs to easily use resources in multiple Grids

• as move to EGI in Europe, for example

• Other Grids are welcome to use our policies– With appropriate acknowledgements!


8

Overview of JSPG Policies



Grid Security Policy

• The main policy document• https://edms.cern.ch/document/428008/

• To fulfil its mission, it is necessary for the Grid to protect its resources. This document presents the policy regulating those activities of Grid participants related to the security of Grid services and Grid resources.

https://edms.cern.ch/document/428008/


Grid Security Policy (2)

• Objectives– This policy gives authority for actions which may be carried

out by certain individuals and bodies and places responsibilities on all participants.

• Scope– This policy applies to all participants. Every site

participating in the Grid autonomously owns and follows their own local security policies with respect to the system administration and networking of all the resources they own, including resources which are part of the Grid. This policy augments local policies by setting out additional Grid-specific requirements.


Grid Security Policy (3)

• Additional Policy documents– Appendix 1 defines additional policy documents which

must exist for a proper implementation of this policy. These documents are referred to in section 2.

• Roles and Responsibilities: Participants– Grid Management– Grid Security Officer & Grid Security Operations– Virtual Organisation Management– Users– Site Management– Resource Administrators


Grid Security Policy (4)• Limits to Compliance

– Wherever possible, Grid policies and procedures are designed so that they may be applied uniformly across all sites and VOs. If this is not possible, for example due to legal or contractual obligations, exceptions may be made. Such exceptions must be justified in a document submitted to the Grid Security Officer for authorisation and, if required, approval at the appropriate level of management.

– In exceptional circumstances it may be necessary for participants to take emergency action in response to some unforeseen situation which may violate some aspect of this policy for the greater good of pursuing or preserving legitimate Grid objectives. If such a policy violation is necessary, the exception should be minimised, documented, time-limited and authorised at the highest level of the management commensurate with taking the emergency action promptly, and the details notified to the Grid Security Officer at the earliest opportunity.


Grid Security Policy (5)• Sanctions, Liability, Disputes and

Intellectual Property Rights– Sites or resource administrators who fail to comply with

this policy in respect of a service they are operating may lose the right to have that service instance recognised by the Grid until compliance has been satisfactorily demonstrated again.

– Users who fail to comply with this policy may lose their right of access to and/or collaboration with the Grid, and may have their activities reported to their home institute or, if those activities are thought to be illegal, to appropriate law enforcement agencies.

– VOs which fail to comply with this policy, together with all the users whose rights with respect to the Grid derives from that VO, may lose their right of access to and/or collaboration with the Grid.

– The issues of liability, dispute resolution and intellectual property rights, all of which may be Grid-specific, should be addressed in the additional policy documents.


Security Policy

Site & VOPolicies

Certification Authorities

Traceability and Logging

SecurityIncident Response

Accounting DataPrivacy

Pilot Jobs and VO Portals

Grid & VOAUPs

JSPG Security Policies


Sites Operations Policy

• Accepted and signed by authorized person during registration of Site with the Grid

• https://edms.cern.ch/document/819783


VO Operations Policy

• Accepted and signed by authorized person during registration of VO with the Grid



Grid AUP

• Acceptable Use Policy• Accepted by User

• during registration with VO


https://edms.cern.ch/document/428036


Current JSPG workTwo revised policies awaiting formal approval and adoption• Virtual Organisation Registration Security Policyhttps://edms.cern.ch/document/573348/8http://www.jspg.org/wiki/VO_Registration_Policy

• Virtual Organisation Membership Management Policyhttps://edms.cern.ch/document/428034/3http://www.jspg.org/wiki/VO_Membership_Management_Policy

Three new policies are in “final call”• Grid Policy on the Handling of User-Level Job Accounting

Data• VO Portal Policy• Security Incident Response Policy

https://edms.cern.ch/document/573348/8

http://www.jspg.org/wiki/VO_Registration_Policy

https://edms.cern.ch/document/428034/3

http://www.jspg.org/wiki/VO_Membership_Management_Policy


Future JSPG plans• Revise the Grid User AUP

– Some Grids use it but have modified our text– Explore why and standardise where possible

• DEISA, TeraGrid, EU infrastructures, national Grids, …

• Revise policy framework during next 6 months– More simple, general and consistent– More applicable to EGI world– Broaden the membership – include more NGIs and other

Grids

• Other Grids, volunteers and interested parties welcome


JSPG Meetings, Web etc• Meetings - Agenda, presentations, minutes etchttp://indico.cern.ch/categoryDisplay.py?categId=68• JSPG Web siteshttp://www.jspg.org andhttp://proj-lcg-security.web.cern.ch/• Membership of the JSPG mail list is closed, BUT

– Volunteers to work with us are always welcome!

• Policy documents at http://www.jspg.org andhttp://proj-lcg-security.web.cern.ch/proj-lcg-

security/documents.html


Where are JSPG security policies?

• http://www.jspg.org/wiki/JSPG_Docs• http://proj-lcg-security.web.cern.ch/proj-

lcg-security/documents.html• https://edms.cern.ch/nav/CERN-

0000022711


Security Policies adopted by EGEE and GridPP?

• http://osct.web.cern.ch/osct/policies.html

• http://www.gridpp.ac.uk/deployment/security/policies/index.html


Discussion

Documents

Grid Security Policy David Kelsey (RAL) 1 July 2009 UK HEP SYSMAN Security workshop david.kelsey at stfc.ac.uk