E-Science Projects and Security M. Angela Sasse & Mike Surridge

Practical Security Workshop Nov Who are we? M. Angela Sasse, Department of Computer Science, University College London (UCL) – Mike Surridge IT Innovation, University of Southampton – Members of the Security Task Force

Practical Security Workshop Nov Why are we here? Previous STF work with projects unveiled raft of issues – Awareness of security issues – Perception – Management – Implementation

Practical Security Workshop Nov Security not high on agenda ‘Still early stages … going from requirements to design’ ‘Get it to work first, then we’ll worry about security.’ – ‘There are no security issues: all our data are public.’ – ‘This is just a proof of concept – no commercial implications.’

Practical Security Workshop Nov Perceptions & Attitudes Not interested in security Interested in security, but … No security knowledge and skills “what threat? Doesn’t X do that?” “don’t know where to start” Some security knowledge and skills, but … “not my job/ not worth it” “impossible to get it right anyway”

Practical Security Workshop Nov Management issues Nobody in charge of security – Virtual organisations: no clear lines of communication or responsibility – Ad-hoc decision-making – Urban legends Implicit assumptions: security is taken care of by others – people (sysadmin, other developers networking, computer centre, …) – technologies (Globus, firewalls, certificates, …)

Practical Security Workshop Nov Difficulties implementing security Knowledge lacking or inaccurate – Threats – Countermeasures – Best practice Developers and administrators feel overloaded Conflicts with institutional regulations and mechanisms

Practical Security Workshop Nov Image problem Projects vs. security – “security is used to prevent change” – bureaucrats, detached, “preach”, not helpful – projects have many questions, but don’t pursue them in a coherent manner or involve security experts Security vs. projects – “users don’t care” – something that must be controlled

Practical Security Workshop Nov Policy Purpose To promote best practice in security – in UK e-Science projects – in the UK e-Science Programme To recognise and manage security risks from – distributed networked (grid) information systems – distributed, collaborative project management – newly discovered security problems in new grid or e-Science technology The policy is part of the Programme’s overall security approach

Practical Security Workshop Nov Stipulations Projects must adopt secure practices – commensurate with the risks they face Project must – document their security policy and practices – undertake a detailed threat and risk analysis – ensure adequate resources to address threats – provide staff training where appropriate – keep up to date with security developments Projects may be subject to audit – against their own security policy…

Practical Security Workshop Nov Project Security Policies Must be commensurate with risks faced – driven by a project threat and risk analysis – not based on any “pre-ordained” security level May need to address – policy and guidance from the Programme – legal obligations: health and safety, personal data protection – ethical frameworks: oversight committees, etc – specific security threats – actions to be taken if security is breached – community best-practice

Practical Security Workshop Nov Responsibility Responsibility for the programme policy – UK e-Science Core Programme Directorate – advised by STF and TAG Responsibility for project security – project Principal Investigator – aided by their project management team Principal Investigator must – identify and address security roles – establish operational security contact points – ensure project security policy is maintained

Practical Security Workshop Nov Security Risk Management Should drive project security policy Requires identification of threats and risks – to project staff and associated personnel – to computer systems – to information – to relationships – to reputation – to the UK Programme – etc Project security policy must address threats

Practical Security Workshop Nov Practical Security Workshop Support for project PI’s and their teams – practical risk identification and management – practical advice on specific policy issues – disseminating best practice Support for the UK Programme through STF – identifying security risks to the overall programme – identifying security risk management methods – identifying gaps in technology, processes and skills – disseminating best practice The Programme must observe its policy too!

Practical Security Workshop Nov Purpose of Workshop Help security projects to define their security needs Share experiences, learn from each other Introduce methods and tools (risk analysis and management) First steps towards developing good practice Identify training and support needs

Practical Security Workshop Nov Workshop Approach Presentations – on risk identification and management – on project experiences Breakout sessions – to identify project security risks – to identify appropriate security mechanisms Results – greater awareness of types of risks and defences – understanding of best practice for projects – gaps and needs of the Programme

Practical Security Workshop Nov Overview Day 1 - morning Registration and coffee Welcome (Alan Robiette, Chair, Security Task Force for the e- Science Programme) Workshop Introduction: e-Science projects and security (Mike Surridge, IT Innovation & Angela Sasse, UCL) Understanding and managing risks (Jonathan Moffett, York University) Lunch

Practical Security Workshop Nov Overview Day 1- afternoon myGrid security issues (Luc Moreau, Southampton University) Breakout sessions: Identifying risks in your projects (including tea at 15.30) Reports from workshop groups Security lessons from the EGSO Project (Clare Gryce, UCL) Close Dinner

Practical Security Workshop Nov Overview Day Coffee Managing security in the DAME Project (Howard Chivers, York University) Breakout sessions: Managing risks in your projects (including coffee at 11.00) Lunch Reports from workshop groups Establishing secure practices (Peter Ryan, Newcastle University) Closing remarks: Security in e-Science projects - First steps in the right direction (Mike Surridge, IT Innovation & Angela Sasse, UCL)