Sergiu April 2006June 2006 Overview of TeraGrid Security Working Group Activities James Marsteller CISSP, Working Group Chair for Information Security Pittsburgh Supercomputing Center

Sergiu April 2006June 2006 Agenda TG Security WG Background Policy Development Incident Coordination and Response Current Projects

Sergiu TeraGrid Security WorkGroup Formed in January 2004 Eight Resource Providers + More Security WG Charter: –Development of Policies and procedures and guidelines –Provide security related advice/direction on TG projects –Coordinate Teragrid Incident Response team –Lead Risk Assessments

Sergiu TeraGrid Security WorkGroup Security WG Policies: –Security M.O.U. –CA Acceptance –Baseline Security Guidelines –Public Info Disclosure (Draft) User/Host/Job Names –Two Factor Auth (Draft) –Reporting Procedures (Draft) Procedures –Incident Response Playbook/Flowchart –Compromised Account Questionnaire –Security ‘Newbie’ guide

Sergiu April 2006June 2006 Teragrid Security Coordination Rapid, Secure, Coordinated Response and Information Sharing is Critical!

Sergiu TG Incident Response Weekly “Response” Calls 24 Hour Security “hotline” Incident Mailing List Encrypted Communications Coordinated Evidence Gathering Future Tasks: IR Tracking –TG NOC Ticket System, RT IR

Sergiu TG Incident Response Weekly IR Calls –*One of the Most Valuable Tools* –5 to 45 minutes in length –‘Closed’ Participant List –Share Latest Attack Vectors Vuls, worms, scans, other:p2p –Honeypots, Non-TG News –Update On Investigations

Sergiu TG Incident Response TG Security “hotline” –24/7 Reservation less Conference # –Any Site Can Initiate –Only Known To Response Personnel –800 Number & International Access

Sergiu TG Incident Response Response Playbook –Who/How To Contact Methodology Initial Responders Secondary Responders Help Desk Staff –How to Respond to Event –Reporting Guidelines: Press, Privacy, Funding sources (in progress)

Sergiu TG Incident Response Compromised Account Questionnaire –Do you use the password of the account at other TG sites or other general accounts (Hotmail, Amazon, Paypal, Ebay)? –What was the time of your last known login? Where was it from? –From what locations do you usually login (hostnames/IP)? –Which sites/machines have you used? –Which do you expect to use? –What locations (hosts) can we expect to you to login from?

Sergiu TG Incident Response Site Incident Response Report –How much time (in person-hours) did staff at your site spend dealing with the incident? –How were you notified? –What steps did you take to investigate at your site to determine if there was a compromised account or system? –What did you determine? –If there was a compromise: –What damage was done? –What steps did you take to respond/recover?

Sergiu Security WG Communications Mailing lists –Main TG Security WG List –IR Alert: Triggers Help Desk/Pagers/Cell Phones –Response: Announce weekly IR Calls/Notes TG Security Contact List –IR, General Security, NOC, Phone, and pagers

Sergiu Encrypted Communications PGP Key Signing Shared Password for Communications (Changes Frequently) Encrypted Website To Archive Critical Information Encrypted Communications Are VERY IMPORTANT!

Sergiu April 2006June 2006 Current Projects IGTF Efforts TAGPMA Participation –IGTF CAs: INFN (Italy) CA, Dutch Grid and NIKHEF CA, AIST (Japan) CA –CA Auditing Teragrid Risk Assessment Working with Law Enforcement IR Tracking Support for Science Gateways/Community Accounts

Sergiu TG Security Site: TG User Agreement: y.html y.html Passwords: htmlhttp:// 002.html My Useful Links