Choose timezone
Your profile timezone:
Joint Security Policy Group meeting (29 and 30 May 2008)
→
Europe/Zurich
Various (CERN)
Various
CERN
Description
Meeting of the joint WLCG/EGEE security policy group.
Phone conference - please call +41 22 767 6000
end enter the code sent by e-mail.
I have also arranged an EVO video conference for Friday.
Name of event "WLCG EGEE Joint Security Policy Group (JSPG)"
EVO password sent by e-mail.
Please note that we will meet in various rooms.
Thu May 29 2008
Introductions.
Discussion of JSPG mandate.
Updated based on comments from David Jackson.
Update to clarify that not all of OSG, NDGF, etc., participate in WLCG.
Restrict to policy only or also advise on other security matters?
Change "provide advice on any security matter" to "provide policy
advice on any security matter".
Discussion of membership agreement / invitation.
Discussion of policy development workflow and use of policies.
We'd like to know who is using the policies and learn about
modifications that we might incorporate back into the policies.
Perhaps we could use a creative commons license to express this.
Discussion of CA Approval document v2.7.
Address comments received on v2.6, including the possible use of local
additional CAs. Changes have been made to be consistent with the style
of the top-level security policy.
The abstract of the MICS profile is unclear.
The introduction section is clearer.
David & Jim will ask the TAGPMA to fix it.
Discussion of Traceability and Logging.
Discussion of length of log retention.
What is a "safe repository"?
Clarify reference to EGEE MW-security-logging-guidelines document.
MUST or SHOULD collect logs centrally? MUST.
Discussion of VO Operations policy.
This is a "final draft" but not yet approved.
Just updates to terminology.
The document refers to "Grid escalation procedures" and this is
intended to be something developed by each Grid, but we don't have an
example of this.
Discussion of Multi-User Pilot Jobs policy (v0.5).
Inform sites or obtain explicit approval?
Are Pilot jobs submmitte to specific sites or to any site in the VO?
Atlas and CMS use a list. Could use the workload management system to
identify which sites accept pilot jobs. Sites could publish a "pilot
job" tag to opt-in.
Do you really want to use a personal certificate to submit pilot jobs?
Can you use a "robot certificate" or service certificate instead?
CMS Pilot Factory is a service that runs all the time with a service
certificate.
Should Pilot Jobs be owned by "one member of a VO" or by the VO itself?
Updated document to support pilot jobs submitted by a service.
Discussion of VO Registration Policy document v2.0.
Renamed from VO Security Policy.
Updated from Aug 2006 version.
Is the new title of this document clear? Not really...
Do all VOs need to register?
How do we handle cross-grid VO peering?
Does the VO need to register with each grid separately?
--------------------------------------------------
Fri May 30 2008
Discussion of VO Membership Management Policy v3.0.
Previously called Requirements for LCG User Registration.
Fits with VO Registration Policy and VO Operations Policy document.
Sets best practice / minimum requirements for VO procedures.
IGTF is working on requirements for running a VO service (VOMS).
We focus on VO procedures.
Institute Representative is LHC-specific. How do we generalize?
Discussion of target and goals of this document.
Should we start each document with a template that defines the target
and goals of the policy?
Title: "VO Management Policy: Membership"?
And: "VO Management Policy: Operations"?
Think about title changes when we restructure for EGEE-III.
More discussion of Traceability and Logging.
Discuss reference to EGEE / CEDPS guidelines on logging.
SHOULD follow security guidelines defined by the Grid.
David will send documents for final comments on the mailing list.
Back to VO Membership Management Policy v3.0.
High-level discussion of what we want to include.
Do we address registration of non-people (hosts, services)?
Non-people is complicated. Let's focus on people first.
Should membership info be disclosed to sites? What mechanism?
VO should be the interface to the users.
If the VO is unresponsive, sites can block the VO.
OSG is concerned about how members are removed when someone leaves
their organization (for example, end of employment).
How long to keep records? 2 years? Why? To capture renewal.
VOs don't track nationality. Can sites contact users to determine
nationality (i.e., to address requirements about banned countries)?
No time to discuss User-level Job Accounting Policy.
No time to discuss Grid Portal Policy.
Proposed next meetings:
Thursday July 3 4-6pm CEST phone conference.
Face to face meeting Oct 9-10 at CERN after EUGridPMA in Lisbon.
Discussion of plans for JSPG during EGEE-III.
We already discussed this in relation to the mandate yesterday.
We should work to increase participation.
EGI design study is working on blueprint for what comes after EGEE-III.
See http://web.eu-egi.eu/partners/ngi/.
We should talk to other large national grid infrastructures.
David will confirm current mailing list membership.
We should get more operational security input.
We've revised many policies over the past 2 years.
Incident response policy has not been updated recently, however.
We should revisit this topic.
Try to finish current document set by EGEE '08.
Then we start again? Fix duplication, inconsistencies. Simplify.
Make more general to apply to more grids.
Who should own these documents? EGEE/WLCG? JSPG? OGF? IGTF?
Continue to discuss at OGF next week.
Discussion of web site and process.
Currently editing documents in Word.
Using CERN's EDMS system as a document repository.
Haven't defined JSPG workflow. How does it relate to EDMS workflow?
Not all document versions get put in to EDMS.
Current released version versus version under discussion.
What does it mean for a JSPG document to be marked released/approved?
Individual grids approve/accept the documents.
Need to update status both in EDMS and inside the Word document.
Each grid should maintain a status page linking to their policy
documents with reference to related JSPG documents.
JSPG web site should have a table of "final" documents and links to
who is using each document.
Alternative to emailing Word documents around? Use a wiki? Gridforge?
What should the URL be? jspg.org?
Andrew will set it up.
Meeting end.
There are minutes attached to this event.
Show them.