- caops-wg - lists.ogf.org

CAOPS/IGTF Sessions at OGF25
by Christos Kanellopoulos 02 Mar '09

02 Mar '09

Dear all, please find the agenda for today's and tomorrow's sessions at: https://forge.ogf.org/sf/wiki/do/viewPage/projects.caops-wg/wiki/AgendaOGF25 See you in a couple of hours -- Grid Operations Center, Aristotle University of Thessaloniki University Campus, GR 541 24, School of Sciences, Building 22A Tel. +302310998988, Fax. +302310994309, http://www.grid.auth.gr

1 0

WG Last Call: "Guidelines for auditing Grid CAs"
by Christos Kanellopoulos 02 Oct '08

02 Oct '08

Dear all, this is a last call for comments for the document "Guidelines for auditing GridCAs" [1]. If there are no further comments until next Wednesday (8 Oct 2008), we will push the document to the public comment period. Regards, Christos [1]: https://forge.gridforum.org/sf/go/doc4858 -- Grid Operations Center, Aristotle University of Thessaloniki University Campus, GR 541 24, Building 22D, Office 4'6B Tel. +302310998988 Fax. +302310994309 http://www.grid.auth.gr

2 1

Auditing Guidelines Doc. (1.0-b7)
by Yoshio Tanaka 01 Oct '08

01 Oct '08

Hi Christos and all, Attached is the latest version (1.0b7) of Auditing Guidelines Document which was revised based on the discussions at OGF24 and the follow-up discussion via email. This document is also available on GridForge. I believe this document is ready to be submitted to public comment. What should be the next step? Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

2 1

Comment for Auditing Guidelines Doc.
by Yoshio Tanaka 18 Sep '08

18 Sep '08

Hi Scott, As you might see in the meeting minutes which was sent by Dave, we got a comment about Auditor Qualification. ---------------------------------------------------------------------- Auditor Qualification The audit/assessment/evaluation team and the individuals on that team, should be qualified to assess the policies and practices of a PKI. Auditors should be competent to evaluate the CA management processes and operational procedures, its related IT security components and its PKI-unique elements. A PKI audit team shall consist of individuals who together have the necessary skills and experience to assess the policies, procedures and practices of the PKI. Auditors should be individually and organizationally independent of the PKI that is being audited. The following list comprises a set requirements for considering the expertise and qualifications of members of the assessment team carrying out a PKI audit: - Professional Certifications such as CISSP and CISA or equivalent; - Successful completion of training courses in assessment of IT security controls; - ... ---------------------------------------------------------------------- We got a comment that the list of requirements is very heavy, particularly the professional certification. Do you intend that auditors must satisfy all the requirements? Would you clarify your intention? Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

3 6

Auditing Guidelines Doc.
by Yoshio Tanaka 17 Sep '08

17 Sep '08

Hi David(G), I missed to discuss one issue which was commented by Scott. The introduction section of the auditing guidelines document describes "It should be noted that it was determined that the OGF mission would not include responsibility (and thereby liability) to either vet certificate policies (CPs) or audit CAs." Scott gave us a comment that we should at least say who made this determination and perhaps when. How should I describe who and when? Any suggestions? Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

My notes from today's CAOPS and IGTF meeting
by Kelsey, DP (David) 16 Sep '08

16 Sep '08

Dear all, Here are my notes from today's meeting(s). Corrections welcome! Cheers ------------------------------------------------ Dr David Kelsey Particle Physics Department Rutherford Appleton Laboratory Chilton, DIDCOT, OX11 0QX, UK e-mail: D.P.Kelsey(a)rl.ac.uk Tel: [+44](0)1235 445746 (direct) Fax: [+44](0)1235 446733 ------------------------------------------------

1 0

Auditing Guidelines Doc. 1.0b6
by Yoshio Tanaka 13 Sep '08

13 Sep '08

Dear all, Thanks to Scott, Auditing Guidelines Document has been revised and it is available on GridForge as version 1.0b6. The major revision is to add author clarification. We will discuss this document in next Tuesday so that the document will proceed to public comments. Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

CAOPs-IGTF Agenda (Tuesday 16, Sep.)
by Yoshio Tanaka 12 Sep '08

12 Sep '08

Dear all, CAOPs-IGTF session will be held on 16th, Tuesaday, in the week of OGF24 in Singapore. Three IGTF sessions will be dedicated for the APGridPMA meeting. Here is a schedule and agenda of the four sessions. Thanks, ---------------------------------------------------------------------- Date: September 16 (Tuesday) Venue: Room Discovery, Biopolis, Singapore CAOPs Session 09:00 - 09:10 IPR issues and agenda bashing 09:10 - 09:30 Review charter (Christos) 09:30 - 09:50 Auditing Guidelines Document (Yoshio) 09:50 - 10:10 Authentication Service Profile (Christos) 10:10 - 10:30 Use Cases for Relying Party Enforced Namespace Constraints (David) 10:30 - 11:00 Coffee/Tea Break IGTF/APGridPMA (1) 11:00 - 11:15 Self Introduction of participants 11:15 - 11:30 Opening remarks and updates of the APGrid PMA (Yoshio Tanaka, Chair, APGridPMA) 11:30 - 11:45 Updates of the EUGrid PMA (David Groep, Chair, EUGridPMA) 11:45 - 12:00 Updates of the TAGPMA (Vinod Rebello, Chair, TAGPMA) 12:00 - 12:15 MICS Profile (Vinod Rebello) 12:15 - 12:30 New Charter of the APGridPMA (Yoshio Tanaka) 12:30 - 13:30 Lunch / Town Hall 13:30 - 14:15 Keynote - Accelerating Enterprise Grid Adoption (Lawrence Wong, National University of Singapore) IGTF/APGridPMA (2) 14:15 - 14:45 New CA (Indian Grid CA) 14:45 - 15:45 Brief status reports from member CAs * AIST (JP) * APAC (AU) * ASGCC (TW) * CNIC (CN) * IHEP (CN) * KEK (JP) * KISTI (KR) * NAREGI (JP) 15:45 - 16:00 Coffee/Tea Break IGTF/APGridpMA (3) 16:00 - 16:30 Brief status reports from member CAs (cont'd) * NCHC (TW) * NECTEC (TH) * PRAGMA-UCSD (US) * THAI (TH) * HKU (HK) 16:30 - 16:45 Heavy traffic for downloading CRLs 16:45 - 17:00 Frequency of issuing CRLs 17:00 - 17:10 Frequency of F2F meetings and plans in the next year 17:10 - 17:20 Lessons learned from IGTF-RAT test 17:20 - 17:30 Summary and the next meeting -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

Security and related activities at OGF24: an overview
by David Groep 29 Aug '08

29 Aug '08

OGF24: Bustling with Security Activities In a mere few weeks OGF24 will be held in Singapore. A compact meeting, it is packed with quite a few interesting security and related sessions. If you did not plan to come, maybe these still entice you to travel to Singapore: A jointly coordinated session with GIN will focus on how to restrict delegation. In the GIN grid deployments restricting what somebody (or a process can do) is gaining prominence, and how to design such restrictions when delegating credentials (both when using proxies and in a SAML context) is something the GIN group wants to know. One hand this of course includes the syntax and technical mechanisms, and based on current standards and developments this might be addressed in the short term. But how to interpret such restrictions in a common way? If a policy is defined to restrict access to a service or service method, will the implementations of such a service react in a similar way? This session should lead the way for a new working (or research?) group to address these topics. Also at OGF24, the OGSA-AuthZ WG will be discussing the feedback received on the "Functional Components of Grid Service Provider Authorisation Service Middleware" document, which has completed its public comment on August 28th, and the "Use of XACML Request Context to Obtain an Authorisation Decision" (completed PC on Aug 13), and review the ongoing comments of the remaining proposed recommendations: - Use of SAML to retrieve Authorization Credentials - WS-TRUST and SAML to Access a Credential Validation Service This suite of four documents provides a complete view on the internals of authorization, and your contributions are welcome to ensure that the documents reflect your needs. As a follow-up to the Firewall Issues RG, a new working group "Firewall Virtualization for Grid Applications" has been started to standardize a set of service definitions for a virtualized control interface into firewalls and other mid-boxes allowing the grid applications to securely and dynamically request application/workflow-specific services from those devices, for the duration of the service. The CA Operations WG, jointly with the IGTF, organises a full-day workshop focussing on a wide range of authentication and identity management issues. On the technical side these include the definition of signing namespace constraints by relying parties, guidelines for auditing CAs, authentication service profiles, and the profile defining trust in higher-level CAs. More on the policy side, issues such as risk assessment and incident response in the IGTF community, and the management of revocation will be discussed. The Levels of Authentication Assurance (LoA) RG merged with CAOPS in OGF23, with the document "A Gap Analysis of Current LoA Definitions vs. LoA Requirements in e-Science/Grid Context" available for discussion. For the operational security side: have a look at the BoF on Intrusion detection in Grid Computing for security issues in grid computing networks and proposed the possible solutions using Intrusion detection/prevention systems. Lastly, you have probably realised that the vacant spot left by Blair Dillaway as security AD (whose term ended in March) has still not been filled. To remedy this very unfortunate situation, please think hard about who you consider to be a suitable candidate (and that may be yourself!), and contact the OGF NOMCOM or the chair Neil Chue Hong directly. See http://www.ogf.org/nomcom/ for details about the NOMCOM process and for an application form. A healthy security area and the security activities in OGF merit a full complement of security ADs to ensure continuity past 2009! I hope to see many of you in Singapore. Best Regards, David Groep. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

OGF session?
by Alan Sill 04 Jun '08

04 Jun '08

Hi, Is there a CAOps session at this week's OGF, and if so, will there be any external phone or video connectivity? Alan Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

2 2