SAN DIEGO SUPERCOMPUTER CENTER Security and Grids Victor Hazlewood, CISSP Information Security Officer

SAN DIEGO SUPERCOMPUTER CENTER Overview Information Assurance What we are up against Security and Grids Example incident SDSC Security Strategy Teragrid Security Security resources to take away

SAN DIEGO SUPERCOMPUTER CENTER Information Assurance “Information assurance is ensuring that your information is where you want it, when you want it, in the condition that you need it, and available [only] to those that you want to have access to it” - Andrew Blyth and Gerald L. Kovacich, Information Assurance: Surviving in the Information Environment

SAN DIEGO SUPERCOMPUTER CENTER Information Assurance Information assurance, and more specifically data integrity assurance, requires the mitigation of the risk of loss of data from all possible sources including: natural disasters media corruption vendor software and hardware failures operational errors Unintentional/unauthorized user activity Unauthorized and/or malicious activity

SAN DIEGO SUPERCOMPUTER CENTER

Security and Grids Grids add another layer of risk to the security model for the security professionals… The open, collaborative nature of the research and academic environment [grids] now allow unintentional/ unauthorized user activity and unauthorized and/or malicious activity [potentially] to spread to the Grid

SAN DIEGO SUPERCOMPUTER CENTER Security and Grids

SAN DIEGO SUPERCOMPUTER CENTER Who… Us Worry? The open collaborative nature of the research and academic environment is an inviting target Let me illustrate in an example…

SAN DIEGO SUPERCOMPUTER CENTER Intrusion Example

SAN DIEGO SUPERCOMPUTER CENTER The Protection Gap*  Information system protection measures have not kept pace with rapidly advancing technologies  Information security programs have not kept pace with the aggressive deployment of information technologies within enterprises  Two-tiered approach to security (i.e., national security community vs. everyone else) has left significant parts of the critical infrastructure vulnerable  * source Ron Ross of NIST

SAN DIEGO SUPERCOMPUTER CENTER SDSC Security Strategy

SAN DIEGO SUPERCOMPUTER CENTER SDSC Security Strategy

SAN DIEGO SUPERCOMPUTER CENTER Teragrid Security MOU for Teragrid participation Teragrid Security Policy Teragrid Security Baseline Minimum Security Standards version 1 document written Biweekly Security WG calls Incident Response

SAN DIEGO SUPERCOMPUTER CENTER Teragrid Incident Response Incident Response (IR) team IR process playbook and IR flowchart secure communications setup Weekly Incident Response calls

SAN DIEGO SUPERCOMPUTER CENTER Teragrid Portal Projects -> Science Gateways Portals developed specifically for a community Communities requesting and using role-based accounts HPC resources back-end portal Security implications pushed to portal - authentication, auditing, etc.

SAN DIEGO SUPERCOMPUTER CENTER Resources   SDSC’s Defense-In-Depth strategy white paper  SDSC’s policies Note CIP Portal Policy/MSG   Security Training available  Lectures available

SAN DIEGO SUPERCOMPUTER CENTER Q&A