Incident Response Plan for the Open Science Grid

1. Incident Response Plan for the Open Science Grid 2nd EGEE Conference Den Haag, Netherlands 25 Nov 2004 Bob Cowles – bob.cowles@slac.stanford.edu

2. Principles • OSG is a with little central control or resources – almost everything has to be done by the sites or the VOs • Sites security personnel will need to feel comfortable with grid use of resources • limited additional risks • local control over decisions • Coordinate with EGEE/LCG efforts • KISS or “Simplify and add lightness” OSG Incident Response

3. Centrally Provided • List of site security points of contact • Email communications • Filter standard email addresses • security@opensciencegrid.org • abuse@opensciencegrid.org • Coordinate with other Grid Operation Centers (GOC) OSG Incident Response

4. Site Responsibilities – 1 • Report grid-related incidents (hi-priority list) • Remove compromised servers • Release only summary information • Have a site incident response plan in place (logs, evidence) OSG Incident Response

5. Site Responsibilities – 2 • Provide security contact information • Follow-up to email discussion list • Take appropriate care with sensitive material collected • Provide appropriate law enforcement with materials for coordination, investigation and prosecution OSG Incident Response

6. Incident Classification • Potential to compromise grid infrastructure • Potential to compromise grid service or VO • Potential to compromise grid user OSG Incident Response

7. Response Teams • Self-organized body of volunteers • Mailing list maintained by GOC • Team organized for severe or complex incidents • Team leader to coordinate efforts OSG Incident Response

8. Incident Handling – 1 • Discovery and reporting • local procedures & GOC list notified • Initial analysis and classification • verify incident and perform classification • Containment • remove resources, services, users • Notification and escalation • notify grid management for more severe OSG Incident Response

9. Incident Handling – 2 • Analysis and Response • Resource tracking (response costs) • Evidence collection • Removal and recovery – regular communication on the discussion list • Post-incident analysis • Close-out report following incident OSG Incident Response

10. Timeline • Jun 04 – Security TG formed • Jul 04 – IR Activity formed • Sep 04 – First draft of plan reviewed • Oct 04 – Coordinate with EGEE/LCG • Nov 04 – Presentation – 2nd EGEE Conf • Dec 04 – Implementation • Jan 05 – Implementation & testing • Feb 05 – OSG; EGEE Review OSG Incident Response

11. The Plan http://computing.fnal.gov/docdb/osg_documents//Static/Lists//FullList.html www.opensciencegrid.org click on “Documents” click on “Search the database and read documents” click on “OSG Security Incident Handling and Response” OSG Incident Response