Download presentation
Presentation is loading. Please wait.
Published byPhebe Barker Modified over 8 years ago
1
1 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 ISS e G Integrated Site Security for Grids EU-FP6 Project 026745 Experience with Integrated Site Security Alan Silverman, CERN on behalf of the ISSeG project HEPiX 07, St Louis, 9 November 2007
2
2 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 The ISSeG project EU co-funded project 3 partners CERN FZK, Forschungszentrum Karlsruhe GmbH STFC, Science and Technology Facilities Council, UK (formally CCLRC, RAL) Started in February 2006 Ends March 2008
3
3 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 What is ISS? Integrated Site Security - ISS ISS is the concept of integrating the technical, administrative and educational aspects of information security at your site so that they work together to improve your overall site security. While this is not specific to Grid environments, it is extremely relevant to all Grid sites as we all work together.
4
4 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 ISS - Integrated Site Security Know who is using your network Close accounts when people leave Establish a computer Security Incident Response Team Require computer users to be officially registered Explain technical changes to users before, during and after implementation Create and maintain training and awareness campaigns for security polices and best practice. Raise awareness for security policies Use security mechanisms and tools, e.g. anti-virus, firewall management, central patch management, intrusion detection
5
5 I ntegrated S ite S ecurity for G rids www.isseg.eu What is ISSeG producing? www.isseg.eu
6
6 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Risk assessments Risk assessments – What are they and why bother? Organizations are often required to establish a process to manage risks as part of a corporate governance strategy. Risk assessment includes the following steps: Identify the assets and risks Analyse the existing security controls Implement any identified and resourced improvement plan Monitor the existing controls to see that they are effective
7
7 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 ISSeG questionnaire The ISSeG risk assessment questionnaire can help you start the risk assessment process and identify what assets you have and some of the risks. Based on ISO/IEC 17799:2005 standard (a long list of technical controls*) Adapted as a result of practical experience at a number of Grid sites (CERN, FZK, STFC (ex CCLRC)) * A control is a means of managing risk. It can include policies, procedures, guidelines, practices or organizational structures, which may be of an administrative, technical, managerial or legal nature. The term control is also used as a synonym for a safeguard, mitigation, countermeasure.
8
8 I ntegrated S ite S ecurity for G rids www.isseg.eu ISSeG questionnaire Security is not a “thing” you do, it is a continuous process. You need some way of working out where to start and measure progress. The questionnaire helps you identify and prioritise what security controls need to be implemented first. It has been developed as a Microsoft Excel® spreadsheet that requires the use of macros. (We hope you trust us!) If not, just reading the questionnaire is a very useful exercise! © Members of the ISSeG Collaboration, EU-FP6 Project 026745
9
9 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 ISSeG questionnaire http://cern.ch/ISSeG- training/RiskAssessment/RiskAssessment.htm
10
10 I ntegrated S ite S ecurity for G rids www.isseg.eu Recommendations, training material Recommendations Around 60 in total Varying level of detail Short, as PRACTICAL as possible Training material Targeted populations System administrator Developer General user Manager © Members of the ISSeG Collaboration, EU-FP6 Project 026745
11
11 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Example Recommendations Broaden the use of centralised management R1: Centrally manage accounts R2: Centrally manage patches and system configurations R3: Centrally manage Internet Services Integrate identity and resource management R4: Provide integrated identity management R5: Ensure resources link to the people in charge of them R6: Define responsibilities using roles and groups Manage your network connectivity R7: Restrict Intranet access to authorised devices R8: Restrict Internet access to authorised connections R9: Segregate networks dedicated to sensitive devices R10: Expand the use of application gateways
12
12 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Example Recommendations Use security mechanisms and tools R11: Strengthen authentication and authorisation R12: Increase the use of vulnerability assessment tools R13: Adapt incident detection to meet evolving trends R14: Strengthen and promote network monitoring tools R15: Enhance span filter tools and mailing security R16: Extend policy enforcement Strengthen administrative procedures and training R17: Adapt training to requirements of users, developers and system administrators R18:Integrate security training and best practice into organisational structures R19:Maintain administrative procedures in step with evolving security needs R20: Extend policy regulations R21: Regulate the use and coexistence of legacy Operating Systems
13
13 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 And more recommendations R51: Create an information security policy R52: Review your information security policy R53: Allocate information security responsibilities R54: Establish confidentiality agreements R55: Maintain contacts with special interest groups R56: Maintain an inventory of assets R57: Establish ownership of assets R58: Define acceptable use for assets R59: Establish information classification guidelines R60: Develop information labeling and handling procedures R61: Define terms and conditions of employment R62: Encourage information security awareness, education and training R63: Ensure access rights are up to date R64: Establish a physical security perimeter R65: Implement physical entry controls R66: Provide physical protection and guidelines for working in secure areas R67: Protect equipment from disruptions in supporting facilities R68: Assure secure disposal or reuse of equipment R69: Document your operating procedures R70: Manage changes to information processing facilities and systems R71: Separate you development, test, and operational facilities R72: Implement capacity management R73: Install and regularly update malicious code detection and repair software R74: Manage the execution of mobile code R75: Establish backup and restoration procedures R76: Implement intrusion detection and prevention mechanisms R77: Control access to your network R78: Use cryptographic techniques for information confidentiality and integrity R79: Establish agreements for exchange of information and software with external parties R80: Enhance the security of your e-mail communications R81: Protect the integrity of publicly available information R82: Enable audit logging of user activities, exceptions and security events R83: Establish procedures for monitoring system use and reviewing results R84: Ensure protection of log information R85: Establish an access control policy based on security requirements R86: Establish a formal procedure to control the allocation of access rights R87: Restrict and control the allocation of privileges R88: Implement a formal management process for password allocation R89: Enforce good practices in the selection and use of passwords R90: Ensure that unattended equipment is appropriately protected R91: Prevent unauthorized access to network services R92: Implement strong authentication for external connections R93: Adopt appropriate security measures for mobile computing R94: Implement appropriate policy, procedures, and guidelines for teleworking R95: Establish training and guidelines for secure programming R96: Establish a formal application integration/qualification process R97: Implement an automated patch managementS5: Strengthen administrative procedures and training (cont.)
14
14 I ntegrated S ite S ecurity for G rids www.isseg.eu Recommendations Initial versions exist for all of them and the first batch of basic ones should be on the web site before the end of the year Work will continue, adding the rest and improving them, until the project ends in March 2008 The web site will also be adapted to make it easier and quicker to access the most useful material © Members of the ISSeG Collaboration, EU-FP6 Project 026745
15
15 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Recommendation structure Common structure: What Why How Links
16
16 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Technical recommendations Restrict Internet access to authorized connections Closing firewall access impacts used applications Update mechanism is required Segregate networks dedicated to sensitive devices Requires careful analysis of requirements and impact Expand the use of application gateways Reduces spread of incidents Useful for untrusted devices Restrict Intranet access to authorized devices 802.1x functionality A mapping to the device owner is recommended Finance network Controls networks Campus network
17
17 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Administrative recommendations Extend policy regulations Policy writing requires both technical and administration knowledge clarity is important for both users and administrators Maintain administrative procedures in step with evolving security needs Regular reviews need to be planned ISS methodology is a useful tool Examples: Strengthened policies for controls networks Strengthened firewall policies Strengthened account policies Use of application gateways Use and coexistence of legacy operating systems Define rights and duties for administrators
18
18 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Training recommendation General users Computer users just want to get on and use the systems. Security needs to invisible. They need to know why security is relevant to them. this is not good security…
19
19 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 General users General advice & material for users http://cern.ch/ISSeG-training/DownLoad/Computer- Advice-General-Users.pdf http://cern.ch/ISSeG-training/DownLoad/Computer- Advice-General-Users.pdf
20
20 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Developers Application developers Check lists can be useful aids to secure software.
21
21 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Checklist for Developers Checklist addresses the various stages of the development process 1. Architecture 2. Design 3. Cryptography 4. Implementation 5. Coding 6. After Implementation
22
22 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Developers General advice & material for developers http://cern.ch/ISSeG- training/Training/DeveloperCheckList.htm http://cern.ch/ISSeG- training/Training/DeveloperCheckList.htm
23
23 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 System Administrators System Administrators Check lists can be useful aids
24
24 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Checklist for System Administrators 1. Harden the OS and Applications 2. Keep the OS and Applications up-to-date 3. Use a local firewall 4. Take advantage of the logs 5. Ensure that all passwords are secure 6. Take extra precautions for privileged accesses 7. Use security products when relevant 8. Take into account physical security 9. Keep your security knowledge up-to-date.
25
25 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 System Administrators General advice & material for Sys. Admins. http://cern.ch/ISSeG- training/Training/SysAdminCheckList.htm http://cern.ch/ISSeG- training/Training/SysAdminCheckList.htm
26
26 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Managers http://cern.ch/ISSeG-training/myRole/myRole_Manager.htm http://cern.ch/ISSeG-training/myRole/myRole_Manager.htm
27
27 I ntegrated S ite S ecurity for G rids www.isseg.eu © Members of the ISSeG Collaboration, EU-FP6 Project 026745 Managers How to sell security – working with managers We want resources (staff time and money) We need support Managers want reassurance Managers see security as a necessary evil Guidance notes are being developed http://cern.ch/ISSeG- training/Recommendations/myRole_manager.htm http://cern.ch/ISSeG- training/Recommendations/myRole_manager.htm
28
28 I ntegrated S ite S ecurity for G rids www.isseg.eu Summary All the ISSeG material is on the web site at http://www.isseg.eu Risk assessment questionnaire http://cern.ch/ISSeG-training/RiskAssessment/RiskAssessment.htm http://cern.ch/ISSeG-training/RiskAssessment/RiskAssessment.htm Checklist for system administrators http://cern.ch/ISSeG-training/Training/SysAdminCheckList.htm http://cern.ch/ISSeG-training/Training/SysAdminCheckList.htm Checklist for developers http://cern.ch/ISSeG-training/Training/DeveloperCheckList.htm http://cern.ch/ISSeG-training/Training/DeveloperCheckList.htm Training/advice for general users http://cern.ch/ISSeG-training/DownLoad/Computer-Advice-General-Users.pdf http://cern.ch/ISSeG-training/DownLoad/Computer-Advice-General-Users.pdf Advice and material for managers http://cern.ch/ISSeG-training/Recommendations/myRole_manager.htm http://cern.ch/ISSeG-training/Recommendations/myRole_manager.htm Recommendations – will be added soon! © Members of the ISSeG Collaboration, EU-FP6 Project 026745
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.