Security and Privacy in OSG Mine Altunay July

Security and Privacy in OSG Mine Altunay July 30, 2007

Who am I ? • • 07/30/2007 Recently joined OSG Security Team Ramping up to be full time OSG Security Working through the OSG Security Plan Helping develop any new items for the Security Plan in Year 2 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 2

Security Controls • Security Control: safeguards prescribed for an information system to protect integrity, confidentiality and availability of a system and its information – Management Controls (policies) – Operational Controls (things that people do) – Technical Controls (things that machines do) • OSG Security Plan defines, implements and executes these controls 07/30/2007 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 3

Security Plans • Two types of security plans – Core OSG: • assets under complete control of OSG (eg, middleware software cache). • OSG is responsible for security of these systems – Facilities, VOs and software providers that are “part” of OSG. • OSG can create examples and templates of security plans that can be incorporated into site and VO plans. • Sites and VOs are responsible for security of these 07/30/2007 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 4

What does this mean for a site admin? • You are responsible for the security of your own site • You should • understand the usage scenarios • analyze the risks • implement and execute security controls 07/30/2007 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 5

Site Resources Data Storage 1 Data Storage 2 Accessible to VO NOT Accessible to VO Cluster 1 A fictitious site access policy: • for each resource, only allow authorized users AND • deny any requests from black-listed users 07/30/2007 WN WN WN Site Database Site Web Services OSG Site Admins Technical Meeting, July 2007: Mine Altunay 6

• Site grants access to the VO. • VO delegates the access privilege to its trusted members • VO manages its members’ access rights – different access rights to different VO members – E. g. grouping of users based on tasks; or roles played in an experiment 07/30/2007 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 7

A simple usage scenario Site allows access by Researcher Data Storage 1 VO trusts Researcher Site trusts VO grid job Cluster 1 VO Infra. & Services Researcher A from University X, which is a member of the VO • VO Three separate security domains: – Univ. , VO and Site • 07/30/2007 Two trust relationships Site • WN WN WN VO-accessible Site Resources Researcher accesses Site’s resources due to the trust between the VO and the Site. OSG Site Admins Technical Meeting, July 2007: Mine Altunay 8

Group 1’s Data Group 1 : Uni. X Role: Researcher, Privileges: execute, read-write Researcher A from Uni. X Group 2’s Data Group 2 : Uni. Y Role: Researcher, Privileges: execute, read-write Site resources VO • Site enforces VO assigned permissions Researcher B from Uni. Y • VO determines member privileges over Site resources • 07/30/2007 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 9

VO Policy Enforced Policy Site’s Resources that are accessible to VO Cluster 1 Data Storage 1 07/30/2007 WN WN WN OSG Site Admins Technical Meeting, July 2007: Mine Altunay 10

Group 1’s Data Group 2’s Data Unauthorized access grid job 1 Researcher A from Group 1 VO Infra. & Services grid job 2 VO Researcher B from Group 2 07/30/2007 Site Enforced Policy outcome • Researcher A cannot modify Researcher B’s data (due to VO policy) OSG Site Admins Technical Meeting, July 2007: Mine Altunay 11

Group 1’s Data Group 2’s Data grid job 1 Researcher A from Group 1 VO Infra. & Services grid job 2 Unauthorized access VO Researcher B from Group 2 DN name is blacklisted 07/30/2007 Site Enforced Policy outcome • Researcher B denied access • due to Site policy OSG Site Admins Technical Meeting, July 2007: Mine Altunay 12

VO Services synchronize VOMS VOMRS Sitewide Services Grid Site synchronize Is authorized? GUMS SAZ DN, FQAN user name CE DN, FQAN Storage Auth Service g. Plazma DN, FQAN Job Manager SE VOMS Extended proxy Submit request with voms-proxy SRM Storage priv set VOMS Extended proxy user name DN, FQAN Gatekeeper Storage priv set get-voms-proxy Prima/SAML callouts (C) register yes/no certificate Prima/SAML Client (Java) Legend Privilege Project Module 07/30/2007 VO Management Services OSG Site Admins Technical Meeting, July 2007: Mine Altunay 13

• User job and Pilot job runs in the same user account modifications between jobs • Site does not auth/authz the user only auth/authz pilot job Gatekeeper Pilot DN Job Manager Prima/SAML callouts (C) ot Pil DN ID GUMS U ot Pilot UID Request User queue Pilot User DN Pilot UID User Job WN User job 07/30/2007 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 14

ID U ot Pilot UID Request User queue User DN User job 07/30/2007 User DN ID er U Us Us Job Manager GUMS N Gatekeeper DN er D Pilot DN Prima/SAML callouts (C) ot Pilot User DN User UID User Job OSG Site Admins Technical Meeting, July 2007: Mine Altunay WN 15

What if something goes wrong? Incident Response • Researcher A launches attack against the Site • Site discovers the attack • Site analyzes the attack, temporarily blacklists Researcher A (if it can trace it) • Site should • • 07/30/2007 Call GOC at 1 317 -278 -9699, or submit a trouble ticket, Email security@opensciencegrid. org Or email security-discuss-L@opensciencegrid. org OSG Site Admins Technical Meeting, July 2007: Mine Altunay 16

– Inform VO security contact – Site trusts the VO, not individual members – VO finds which member has the privilege • Logs and mapping repository (VOMRS) – Determines culpability and take measures over Researcher A’s privileges • OSG has only controls over core OSG assets and staff – VO is responsible for its users behavior – OSG may bar a VO • if VO violates OSG policies 07/30/2007 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 17

Sites are responsible for • Building and maintaining a trust relationship with VO • Determining which resources are accessible to VO members and in which capacity • Reaching an agreement with VO over the usage of the resources – privileges associated with roles (r/w privilege over a data location by a VO member) • Enforcing VO assigned privileges and site’s access policies • Keeping in synch with VO policy (e. g. VOMRS), maintaining service availability for access 07/30/2007 OSG Site Admins Technical Meeting, July 2007: Mine Altunay 18

– Keeping access logs of VO users and maintaining audits – Informing VO Security contact about security incidents – Complying with grid operational controls • • 07/30/2007 Keeping up to date with CA-certificates IGTF updates Certificate Revocation Lists Using latest configuration for grid distributed software OSG Site Admins Technical Meeting, July 2007: Mine Altunay 19