1 GENI Operational Security GEC4 Stephen Schwab Miami, Florida

2 Operational Security GENI Control Frameworks – Are deploying now, or commencing operations within the next 6 months – In many cases already operate testbed component managers/aggregate managers – Will need guidance about how and when to align with GENI operational security concerns What does it mean for something to be part of GENI?

3 Security Architecture “Major Points” Explicit Trust Least Privilege Revocation Auditability and Accountability – All of the above address central security properties of GENI Infrastructure

4 Security Architecture Draft Spiral 1 Action Items list – Roots of Trust: GENI Control Frameworks with root or CA certificates – adopt posture to protect private keys Generate true self-signed super-root certificates, use to sign operational root certificates, backup and limit exposure of super-root private keys. May not be supported yet. Alternative is to have a way replace root or CA certificates – pre-plan for this change-over. – POCs and operational information Who are the system admins/super users? Register contact information for primary and alternate POCs with GPO. (Plan for registering/updating contact information when system admins change.) Super-users should have non-super-user identities and certificates for exercising GENI or doing regular work – Physical and Configuration Audits Identify list of and physical location of security relevant machines.

5 Security Architecture Draft Spiral 1 Action Items list – Source Code reviews Have someone other than the developers review the security relevant code in new control frameworks (should SPARTA staff be tasked to help, within available limits?) Not a formal process – slides and a talk on what the security source code does would be adequate – Emergency Shutdown procedures Not expected to be used, but if GENI substrate can support a shutdown or kill-switch mechanism, is there someone designated by GPO to grant this privilege to? For each cluster: identify if the cluster control framework or each individual GENI project has “emergency shutdown authority”, and who that individual will b – Draft Security Architecture for Review and Comments: groups.geni.net/geni/attachments/wiki/GENISecurity/ GENI-SEC-ARCH- 0.4.{doc,pdf}

6 User and Site Management Research User Management – Document how identities/credentials assigned for new users – Maintain list of users, GENI identities, real world contact information, privileges/slices/access rights Site testbed component monitoring – Plan/tools to monitor local activities – Coordination with Campus NOC

7 GENI Resource Usage Policy Are we setting the right usage policy out-of-the- gate? How should the usage policy be managed to evolve over time? – Can we gauge the risk of experiment activities each quarter and adjust as GENI grows or adds capabilities? What sanity checks do we need to see if we are over- or under- estimating the risks? – To each site/campus – To the Internet – To the GENI project’s reputation