14 th EUGridPMA Meeting Update from TAGPMA Jim Basney Lisbon, Portugual October 6-8, 2008 The Americas Grid Policy Management Authority

2 14th EUGridPMA Meeting, Oct 2008 TAGPMA Membership CANARIE – Canada DOEGrids (ESNet) – USA EELA – International Fermi National Accelerator Laboratory - USA HEBCA/USHER/Dartmouth College – USA IBDS (ANSP) - Brazil LCG – International NCSA – USA NERSC – USA Open Science Grid – International Purdue University – USA REUNA – Chile San Diego Supercomputer Center – USA TACC – USA TeraGrid – USA Texas High Energy Grid – USA University of Virginia – USA UFF – Brazil ULA – Venezuela UNAM – Mexico UNLP – Argentina IGTF Accredited CA Operators CA Accreditation in progress Interested in accreditation Relying Party

3 14th EUGridPMA Meeting, Oct 2008 TAGPMA Members 21 Members –7(+2) IGTF CAs 5 Classic, 1 SLCS, 1 MICS –5 CAs pending 2 Classic, 2 SLCS, 1MICS –Plus 3 more in the works –6 Relying Parties Peru and Colombia expected to join soon

4 14th EUGridPMA Meeting, Oct 2008 TAGPMA Officers (re-)Election held in July of 2008 – 1 year term Chair –Vinod Rebello (UFF – Brazil) Vice-Chair –Jim Marstellar (PSC – USA) Secretary –Margaret Murray (UT-Austin – USA) Trusted Introducer (nominated) –Mike Helm (ESNet/LBL – USA)

5 14th EUGridPMA Meeting, Oct 2008 Administrative Changes CANARIE was no longer willing to host TAGPMA Infrastructure ESnet offered to stand in But ESnet undergoing large services overhaul Disruption to TAGPMA services in terms of availability and quality – Apologies Moving/moved TAGPMA domain name, mailing lists and website to ESnet, as and when feasible. TAGPMA twiki http(s)://tagpma.es.net/wikihttp(s)://tagpma.es.net/wiki –To host TAGPMA information, tutorials etc.

6 14th EUGridPMA Meeting, Oct 2008 Incident Response None of the Accredited CAs were affected by the Debian OpenSSL vulnerability (CVE ) However, there was significant fallout… –Patchy communications and delayed responses due in part to CA manager inexperience/turnover Poorly organized communication infrastructure Cleaned up existing mailing lists Setup alternative dedicated mailing list with out- of-band secure communication Private directory of membership with alternative contact information

7 14th EUGridPMA Meeting, Oct 2008 TAGPMA Charter Version 2.4 of the Charter has been approved Better reflects how the TAGPMA operates 2 year Membership: Letter of introduction/renewal –Ties the representative (POC) to the soliciting Institution –Affirmed commitment by Institution to TAGPMA participation (F2F meetings, document development and reviewing) –Extended inactivity will imply resignation

8 14th EUGridPMA Meeting, Oct 2008 SLCS Profile Status SLCS Profile (Original Version 1.1, 15/11/2005) A two pronged revision process (Version 2.0 series) –Language update Brought up to date and in line with alterations made to the other profile documents –Policy update Lowered HSM operating mode to Level 2 Two recent security incidents posed the question of whether or not CRLs SHOULD be made a requirement/option

9 14th EUGridPMA Meeting, Oct 2008 SLCS Profile Status Current version is 2.1, 18/08/2008 CRLs are required –With exception for very short-lived certificates How short is short? Current consensus is 1 day. Although approved by both EU and AP GridPMAs, awaiting acceptance from existing SLCS CA operators –NCSA ok –SWITCH ??

10 14th EUGridPMA Meeting, Oct 2008 TAGPMA Issues Charter (v 2.5 approval pending) –Inactive Membership – impacts quorum –Two year term of office for elected posts CA accreditations Auditing: Discussions on going, should consider –NIST –Webtrust –Others, ISO/IEC 27001:2005; ISO/IEC 17799:2005 Cobit CA CP/CPS template : Minimum requirements and best practices

11 14th EUGridPMA Meeting, Oct 2008 TAGPMA F2F Meetings 7th TAGPMA F2F in Oakland, USA TAGPMA F2F in Merida, Venezuela –Was postponed due to expected lack of attendance 8th TAGPMA F2F in La Plata City, Argentina –November 6-8, 2008 – Fortnightly Video Conference Call on Tuesdays. –Next one is today, 11am CDT –Video arrangements: Video ESNet or GDS or phone #