PRACE security Jules Wolfrat, SURFsara, The Netherlands April 25, 2013, EGI CSIRT meeting, Linköping, Sweden 10 May Montpellier

PRACE Security Forum Coordinates security activities 1.Define Policies and Procedures - to build “A trust model that allows smooth interoperation of the distributed PRACE services”; 2.Risk reviews - to define and maintain “An agreed list of software and protocols that are considered robust and secure enough to implement the minimal security requirements”; 3.Operational security 2

Policy and Procedures Building “A trust model that allows smooth interoperation of the distributed PRACE services” The development of a “Statement of minimal security requirements” through the definition of policy and procedure documents; AUP, user administration (AuthZ), incident response etc.; To define and implement an Audit procedure; Representation in EUGridPMA, OGF, EEF and collaboration with EGI SPG, SCI, etc. 3

Risk reviews Risk review procedure based on guidelines from the German BSI (Federal Office for Information Security), BSI-Standard : d_100-2_e_pdf.pdf?__blob=publicationFileHttps:// d_100-2_e_pdf.pdf?__blob=publicationFile. Using the IT-Grundschutz Catalogues for threats and safeguards: atalogues_node.html Specifically the “threats catalogue deliberate acts” Examples: Globus Online, UNICORE FTP, SHA-2 testing 4

5

Risk reviews (2) Collaboration with EGI, XSEDE, etc., would be beneficial if there is common interest for a (new) service e.g. Globus Online, where we exchanged information with XSEDE Together you can achieve more with the provider Efficient use of human resources Test results can be exchanged Exchange of review documents should be considered, even for services not used, because they may be used in collaborations of user communities. 6

Operational Security – PRACE CSIRT All sites must be represented in the CSIRT Site CSIRT information maintained on the wiki (names, phone numbers, addresses No well defined procedure if some incident happens Site with information about an incident (or thinks something is wrong) is responsible to take action, e.g. ask for a video/phone conference The EGI rules are adopted for the distribution of security related information (Amber, White, etc.). Also subscribers from EGI CSIRT on our list (Leif, Romain) 7

Operational Security High level of trust between sites that they behave well, e.g. patch policy, firewall set-up, local CSIRT, etc. Requirements must be better documented with increasing number of sites Implementation of audits? Security Challenges? 8

Collaboration Share information about policies and Procedures – SCI activity Risk reviews: work together if there is common interest Incident handling: further develop and test procedure 9