This is a website for an H2020 project which concluded in 2019 and established the core elements of EOSC. The project's results now live further in and

IT Security training for VM operators

Service Security Challenge 2019 - Forensics and debrief

Tuesday, May 7, 2019 - 09:00 to Wednesday, May 8, 2019 - 10:30

The Security Workshop at the EGI Conference 2019 will address aspects of the recent Service Security Challenge run against the EGI infrastructure, SSC-19.03. The intended audience for the workshop includes system administrators and security contacts, as well as FedCloud users operating services connected to the internet.

Security Workshop at ISGC2019

Sunday, March 31, 2019 - 09:00 to 17:30

EGI CSIRT provides operational security to distributed compute infrastructures coordinated by EGI. One of EGI CSIRTs activities is to assess the overall incident response capabilities, which is done through security exercises, so called Security Service Challenges (SSCs). Operational security in an agile environment with different job management systems, logging information at different locations and entities coordination of the involved security teams is key.

The used services need to provide sufficient traceability of user actions as well as interfaces to the systems that offer methods needed to contain an incident, i.e. suspending of credentials found in activities violating approved security policies.

In an assessment of the overall incident response capabilities one of the core aspects will be the junctions between the acting security teams, each having a different view on the situation and different tools available to contain the incident.

To be able to run Security Service Challenges (SSCs) targeting multiple Resource Centres (RCs) and Workload Management Systems (WMS) a framework, the SSC-Monitor, was developed, that allows for central management of the malicious activities as well as for recording and evaluating the expected actions of the participating CSIRTs. This SSC-Monitor was already used for earlier SSCs. While large parts of this framework remains constant several adoptions are needed to implement the Virtual Organisations WMS. Also to be able to measure the incident response of the participants various metrics have to be developed and made available to the SSC-Monitor, and in order to realistically hide the malicious activities, alternative methods for getting the payload to the compute nodes had to be researched and implemented into the SSC-Monitor. Details are presented in separate contribution to this conference.

In the SSC presented here we focused on the WMS Dirac developed and used by the LHCB VO. Incidents involving a VOs WMS require actions and information flow from/to the VOs security team, the RCs security teams and, eventually, additional entities providing authentication frameworks. The information flow and the orchestrated incident response activities are coordinated by EGI CSIRTs Incident Response Task Force (IRTF).

To assess the readiness of the above mentioned security teams, EGI CSIRT together with the VO LHCB created a realistic incident scenario, where valid user credentials are used to submit jobs to the infrastructure using LHCBs workload management system DIRAC as well as using generic services available for job submission directly to the sites.

In this presentation we will show the detailed incident scenario created by the SSC-Monitor, the expected actions described in the incident response procedures as well as the efficiency of the actions described in the developed metrics.

IT Security Management (ISM) in EOSC-hub: policies and global trust

Thursday, October 11, 2018 - 11:30 to 16:00

The aims of IT Security Management (ISM) include the management of security risk, the maintenance of confidentiality, integrity and availability of services and data, the handling of security incidents, the prevention of incidents by handling vulnerabilities, and the definition of best practice together with appropriate dissemination and delivery of training courses. In the world of Open Science and in view of the ever-changing landscape of security threats on the Internet, ISM is an ongoing global challenge. Experience has shown that security and trust is best tackled in a collaborative way, especially as the Infrastructure security teams have to trust each other, to allow for the proper handling of those security incidents which spread between Infrastructures.

Towards cross infrastructure Operational Security in EOSC-hub

Tuesday, March 20, 2018 - 14:40 to 15:00

The EOSC-hub proposes a new vision to data-driven science, where researchers from all disciplines have easy, integrated and open access to the advanced digital services, scientific instruments, data, knowledge and expertise they need to collaborate to achieve excellence in science, research and innovation.

The process towards the integration of the different security activities will be supported through the development of harmonized policies and procedures, to ensure consistent and coordinated security operations across the services provided in the catalogue.

Coordinating the Operational Security in such a broad environment is a challenge. At the same time it offers many possibilities of a closer collaboration of the already existing security teams active in the distributed infrastructures.

The expertise built, and tools developed in response to specific problems in the different infrastructures can be used in cross-infrastructure co-operations. In this presentation we will present examples for possible collaborations in: Incident Prevention Incident Handling/Coordination * Security Training and Exercises