incident response - aarc project · h"ps://aarc-project.eu • interest from internaonal...
TRANSCRIPT
h"ps://aarc-project.eu
Authen4ca4onandAuthorisa4onforResearchandCollabora4on
HannahShort
Sir=ipresent,futureandpilots
IncidentResponse
NA3.2TaskLeadCERN-IT
AARCMee4ng,Utrecht24thMay2016
h"ps://aarc-project.eu
Whathavewedonethisyear?• Training• Events
Whatwillwedonextyear?• Deployment• DNA3.2• Events
Someblueskythinking…
2
Agenda
h"ps://aarc-project.eu
2012 2013 2014 2015 2016 2017 2018 2019
FIM4RPaper
SecurityforCollabora4ngInfrastructures(SCI)
REFEDSWorkingGroup
AARC
Sir=iv1.0Published
FirstRoundDeployment
RFC
AARC2
SecondRoundDeployment
3
Sir>iA?meline
h"ps://aarc-project.eu 4
Whathavewedonethisyear?
Sir=iisreadytogo!
TrainingPack
4interna4onalpresenta4ons
2REFEDSConsulta4ons
• It’sbeenquiteabusyyear…
• AARCtookontheSir=iworkfromtheREFEDSWG
• BigmilestonewasSir=iv1.0,whichwaspublishedearly2016!
• Wehavebeenpresen4ngtheframework
• Wehavecreatedtrainingmaterial
• Nowwearereadytodeploy
h"ps://aarc-project.eu
PublicFacingSite• Sir=iBrochure• Theframework:Sir=iv1.0• GeneralFAQsTechnicalWiki• Federa4onPar4cipantsGuide
• Recipeforadop4on• Federa4onOperatorsGuide
• Whitelis4ngmetadataextensions• Metadataaggregates• Coordina4ngadop4on
• ChoosingaSir=iContact• TechnicalFAQS
Addi?onalBackgroundMaterial• Blogpost• ISGCProceedingspaper(TBC)–thankyousomuchforthefeedbackandinputIreceived!• Poster• Logo
5
Whathavewedonethisyear?TrainingMaterial
Ifyouno4cegapsorimprovements–please
speakup!
h"ps://aarc-project.eu 6
Whathavewedonethisyear?TrainingMaterial
h"ps://aarc-project.eu
• Interestfrominterna4onalaudiences
• RequestedtopresenttotheKantaraIden4tyAssuranceWorkingGroup
• DiscussionsmovingbeyondFIMworld,talkingwithSWITCHSecurityandTF-CSIRT
7
Whathavewedonethisyear?Events
Event Loca?on Date
EWTI(EuropeanWorkshoponTrustandIden4ty Vienna 01Dec2015
ISGC(Interna4onalSymposiumonGridsandClouds) Taiwan 15Mar2016
KantaraIAWG,Videoconference US 07Apr2016
TF-CSIRT Riga 12May2016
h"ps://aarc-project.eu
Ourpilotfedera4ons:• CSC• SURFconext–bulkadop4onbyIdPs!• SWITCH–“Byfall2016wewanttohaveallIdP/SPSIRTFIcompliant”• WAYFSir>iisalsobeingincorporatedintootherprojects,e.g.CERNCloud&CiLogonPilot
8
Whatwillwedonextyear?Deployment-Pilots
h"ps://aarc-project.eu
• GN4willtakeovertomoveSir=itoTRL“Late-stage-pilot”,level7• Federa4onOperatorsupportworkwillshiltotheGN4project• Federa4onPar4cipantsupportwillpar4allyremainanAARCtask• Concreteaims
1. Pushforwide-scaleadop4onatbothhub-and-spokeandfull-meshfedera4ons
2. Pushforadop4onatkeye/r-infrastructures3. Troubleshootpropaga4onproblems(i.e.
metadatafiltering)4. DefineandtestKPIs5. AddSir=itoHighlyRecommendededuGAIN
prac4ces
9
Whatwillwedonextyear?Deployment-Transi?ontoGN4
h"ps://aarc-project.eu
• Sir=iwillformthebasisforthe“GenericSecurityIncidentResponseProcedureforFedera4ons”
• DueinMonth20,i.e.January2017
• DralplannedforAutumn
• WillneedtoexpandonSir=itoinclude• Workflowsforincidentscenarios• Interac4onwithexis4ngpolicies• …
• Watchthisspaceforrequestsforinput!
10
Whatwillwedonextyear?DNA3.2IncidentResponseProcedure
h"ps://aarc-project.eu
• Movingawayfromtheoryandtowardsproof-of-conceptpresenta4ons
• ThesecurityworkshopatISGCprovedaninteres4ngexerciseanditwouldbeworthrepea4ngJ
• MuchofthisoutreachworkwillbemovedtoGN4
11
Whatwillwedonextyear?Events
Event Loca?on Date
TNC-16 Prague June2016
TechEx16 Miami September2016
TF-CSIRT Zurich October2016
GN4 ? December2016
EWTI ? December2016
h"ps://aarc-project.eu 12
h"ps://aarc-project.eu 13
Blueskythinking…
h"ps://aarc-project.eu
VarioustoolscouldhelpsupportSir>i
• Sir=i-filterededuGAINmetadata,handledbyFedera4onOperators
• AdashboardofSir=icontactsforquicklookupduringanincident
• Self-AssessmenttooltodistributeSir=iAssessmentsandmonitoradop4on
• Tes4ngframeworktomonitorresponse4meinmock-incidents(orreal!)
14
Blueskythinking…
h"ps://aarc-project.eu
VarioustoolscouldhelpsupportSir>i
• Sir=i-filterededuGAINmetadata,handledbyFedera4onOperators–NewAARCPilot
• AdashboardofSir=icontactsforquicklookupduringanincident–GN4
• Self-AssessmenttooltodistributeSir=iAssessmentsandmonitoradop4on-??
• Tes4ngframeworktomonitorresponse4meinmock-incidents(orreal!)–GN4
15
Blueskythinking…
h"ps://aarc-project.eu
ThankyouAnyQues4ons?
©GÉANTonbehalfoftheAARCproject.TheworkleadingtotheseresultshasreceivedfundingfromtheEuropeanUnion’sHorizon2020researchandinnova4onprogrammeunderGrantAgreementNo.653965(AARC).
h"ps://aarc-project.eu