1. EGEE is a project funded by the European Union under contract IST-2003-508833 Global Security Architecture Olle Mulmo Chief Security Architect Cork, 6/26/2016 www.eu-egee.org

2. Cork, 2004-04-15 - 2 What’s a security architecture? A proposed set of features/services that tackles a set of requirements and can handle a set of use cases … and a roadmap on how to achieve it  A 6-month view  A 2-year view A living document and continuous discussion & evolvement  Snapshots as deliverables Sept 04, July 05  Assessment deliverable Mar 06

3. Cork, 2004-04-15 - 3 How do we do this? Security and “Architecture” Groups play a vital role Don’t plan for any major development Operational issues are important Bootstrap with a workshop  A suitable date should be picked at the JRA1/JRA3/SA1 session  Get priorities straightened out

4. Cork, 2004-04-15 - 4 Open issues Who to prioritize  Operations vs. users vs. applications  When is a requirement really a requirement? What to prioritize  What’s protected to what cost?  Performance penalty vs.System integrity Accounting  Do we have a mandate w.r.t. “quota enforcement” issues?

5. Cork, 2004-04-15 - 5 We don’t start from square one (OGSA-Sec)

6. Cork, 2004-04-15 - 6 We don’t start from square one (EDG and LCG Sec)

7. Cork, 2004-04-15 - 7 The Grand Picture

8. Cork, 2004-04-15 - 8 Fact: We can’t do anything fancy Requirements on functionality Authentication Access control Credential mgmt Delegation Audit … Existing capabilities EUGridPMA X.509 Proxy Certs MyProxy VOMS GSI Paradigm Shift (SOA) Other work already underway (LCG, OGSA,…)

9. Cork, 2004-04-15 - 9 Architecture Roadmap – 6-month view Fact: Those 6 months are actually 2 at the most! No choice: “duct-tape” solutions  … as current technology, standards and licensing issues fail us  Interoperability problems  Migration path problems Example: Delegation  G-HTTPS? HTTPG? GSI-SecureConversation?  Quick hack?

10. Cork, 2004-04-15 - 10 Architecture Roadmap – 2-year wish list Unified configuration and logging formats Input from work on threat models and security reviews  Flooding attacks, disillusioned users, …  Ban use of ~/.globus/userkey.pem PKI hierarchies, online revocation information services  EUGridPMA going global Move towards OGSA-Sec / WS-Sec compliance  Whatever is there and stable, we should use  Collaboration with other projects, GGF etc.