1. www.egi.eu EGI-InSPIRE RI-261323 EGI-InSPIRE www.egi.eu EGI-InSPIRE RI-261323 SCI-FI Security Challenge Infrastructure for Federated Incident-response First Ops Tools Long Term Sustainability F2F Sven Gabriel 1First Ops Tools long Term Sustainability F2F

2. www.egi.eu EGI-InSPIRE RI-261323 Contents I.Tool and PT Description II.DoW Checkpoint III.RT Checkpoint IV.Effort Evaluation V.Future Involvement VI.Future Evolution First Ops Tools long Term Sustainability F2F 2

3. www.egi.eu EGI-InSPIRE RI-261323 Tool and PT Description I.Quick tool overview (1 slide max) –Framework that provides an infrastructure to run security trainings in “Class-room” and “Distributed (Grid) Mode” –Class-room: Used at conferences like GridKa School, TF, CF. Participants have to solve realistic incidents on prepared systems, + Lectures – Distributed: SSCs, “infecting” RCs, trigger collaboration EGI/NGI/RC/VO/CA Security Teams for IR, assessment of the IR capabilities 3 First Ops Tools long Term Sustainability F2F

4. www.egi.eu EGI-InSPIRE RI-261323 –PT composition/Duties Development/Maintenance: –Nikhef / NSC-SNIC / RedIris Central instance: Nikhef Allocated effort: ? 4 First Ops Tools long Term Sustainability F2F

5. www.egi.eu EGI-InSPIRE RI-261323 Tool Components II.Tool components overview (2 slides max) –Web-application integrating: Job-Submission Interface, default gLite UI provided –Interface to any Job-Submission framework that provides ssh and a CLI for job-submission Real time Monitor of the “test-incident” (malware activity, user/access management at RCs, Communication (ticketstatus) Replay functionality for debriefing / Reporting Communication (RT-IR) 5 First Ops Tools long Term Sustainability F2F

6. www.egi.eu EGI-InSPIRE RI-261323 Tool Components Web-Application: Apache web-server, MySQL / Web framework: Django Python, bash, JSON ldap to interface with IS, based on a VO-Name and Site-list the service endpoints are set-up for the challenge. Job-Submission: any method with a CLI can be used, has to be provided by the “Tester”, done for CRAB, gLiteUI Communication: RT-IR, endpoints are fetched via REST from GOC-DB Reporting/Replay: All events stored in DB, can be replayed, results exported to CSV 6 First Ops Tools long Term Sustainability F2F

7. www.egi.eu EGI-InSPIRE RI-261323 DoW Checkpoint III.DoW Checkpoint (2 slides max) –Main DoW requirements met: Integration of job-submission frameworks –gLite, globus, PANDA, CRAB Used in SSCs: – global runs (ATLAS/PANDA, CMS/CRAB) – NGI Runs (Spain, NL/gLite) 7 First Ops Tools long Term Sustainability F2F

8. www.egi.eu EGI-InSPIRE RI-261323 –Main Dow requirements under development : Multi User (Test-Operators) functionality –Multiple NGIs runs in parallel Extension to general Security-Training framework –Prototype used for a 3 days security workshop held at GridKa-School 2012. –14 participants, very positive feedback received 8 First Ops Tools long Term Sustainability F2F

9. www.egi.eu EGI-InSPIRE RI-261323 Effort IV.Effort Evaluation and Splitting (2 slides max) –Development vs Maintenance effort Development of framework –Over past 2 years: 1200h –Protoyp used at GKS: 240h Contributions from 6 Persons –Effort to run the service: 0.5 FTE minimal maintenance/operations –No further development. 9 First Ops Tools long Term Sustainability F2F

10. www.egi.eu EGI-InSPIRE RI-261323 Future Involvement IV.Involvement after EGI-InSPIRE (1 slide max) –Is current PT interested in continuing developing/maintaining the tool after EGI-InSPIRE? Yes The complete tool –Estimation of the effort considered minimal to continue the development/maintenance: 0.5 FTE –If no funding after EGI, we run it at best effort, as long as it's useful for both us and others, but we can’t do anything major or implement new requirement 10 First Ops Tools long Term Sustainability F2F

11. www.egi.eu EGI-InSPIRE RI-261323 Future Evolution IV.Evolution after EGI-InSPIRE (2 slides max) –How would you like to evolve the tool? Framework for set-up / execution of advanced security trainings aiming at different skills/backgrounds of the participants Framework provides a mobile/flexible “Hands-On” lab useable at various events/conferences/schools, ranging from dedicated multiple days workshops (accompanied with lectures), to smaller hands-on trainings as a site-track during conferences, where the participants can train/check their skills in incident response. The framework at first addresses general topics in systems security, the particularities of providing operational security in distributed computing are building on top of it. Therefore different Grid and/or Cloud-Computing Infrastructures can be simulated here. Therefore it can be used in various IT projects. 11 First Ops Tools long Term Sustainability F2F