Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

Difference between revisions of "VO Policies"

From EGIWiki
Jump to navigation Jump to search
Line 142: Line 142:


The VO AUP must:
The VO AUP must:
bind VO members to abide by the [https://documents.egi.eu/document/74 Grid Acceptable Use Policy].
   
   
*state who gives authority to the Policy
*bind VO members to abide by the [https://documents.egi.eu/document/74 Grid Acceptable Use Policy].
*state who gives authority to the Policy


= [https://documents.egi.eu/public/RetrieveFile?docid=78&version=6&filename=EGI-SPG-VORegistration-V1_0.pdf GRID ACCEPTABLE USE POLICY]=
= [https://documents.egi.eu/public/RetrieveFile?docid=78&version=6&filename=EGI-SPG-VORegistration-V1_0.pdf GRID ACCEPTABLE USE POLICY]=

Revision as of 12:19, 24 May 2011

VO Policies

GRID SECURITY POLICY

Every site participating in the Grid autonomously owns and follows their own local security policies with respect to the system administration and networking of all the resources they own, including resources which are part of the Grid. This policy augments local policies by setting out additional Grid-specific requirements.


2.3 Virtual Organisation Management The responsibilities of the VO management include:

2.3.1 VO Security Policies VOs are required to abide by the Virtual Organisation Operations Policy [9] and the Virtual Organisation Registration Security Policy [2]. They must have a VO Acceptable Use Policy (AUP) and ensure that only individuals who have agreed to abide by the Grid AUP [1] and the VO AUP are registered as members of the VO.

2.3.2 User Registration and VO Membership Service The user registration procedure of the VO is required to be consistent with the Virtual Organisation Membership Management Policy [8]. Approval to join the VO must be restricted to individuals who are recognised as having legitimate rights to membership and who agree to be bound by the AUPs. A VO membership service must be provided with appropriate interfaces to generate authentication, authorization and other identity mapping data for the services running on the sites. VOs are required to maintain the accuracy of the information held and published about their members, and to promptly remove individuals who lose their right to such membership.

2.3.3 VO‐specific Resources VOs are responsible for ensuring that their software does not pose security threats, that access to their databases is secure and is sufficiently monitored, that their stored data are compliant with legal requirements, and that VO-specific services are properly monitored and do not compromise sites or resources. 2.3.4 Applying Sanctions to Users VOs are responsible for promptly investigating reports of users failing to comply with the AUPs and for taking appropriate action to ensure compliance in the future, as defined in section 6.

2.4 Users All users must be members of one of the registered VOs or application communities. The responsibilities of users include:

2.4.1 Acceptable Use Users must accept and agree to abide by the Grid Acceptable Use Policy [1] and the VO AUP when they register or renew their registration with a VO. Users must be aware that their work may utilise shared resources and may therefore affect the work of others. They must show responsibility, consideration and respect towards other users in the demands they place on the Grid. Users must have a suitable authentication credential issued as approved by the Grid. They must ensure that others cannot use their credentials to masquerade as them or usurp their access rights. Users may be held responsible for all actions taken using their credentials, whether carried out personally or not. No intentional sharing of credentials for Grid purposes is permitted. Users must be aware that their jobs will often use resources owned by others. They must observe any restrictions on access to resources that they encounter and must not attempt to circumvent such restrictions. Application software written or selected by users for execution on resources must be directed exclusively to the legitimate purposes of their VO. Such software must respect the autonomy and privacy of the host sites on whose resources it may run.


Other policies related to site management and resource administration are also addressed in the Grid Security Policy Document

VIRTUAL ORGANISATION OPERATIONS POLICY

1. You shall provide and maintain, in a central repository provided by the Grid, accurate contact information as specified in the VO Registration Policy. These contacts satisfy the communication requirements for management decisions, security actions and operational issues relating to VO membership and Grid usage, as well as your software and services. The contacts shall respond to enquiries in a timely fashion as defined in the Grid operational procedures giving priority to security problems.

2. You shall comply with the Grid security policies, the VO AUP and any archival, accounting and logging requirements. You shall periodically assess, at least once per year, your compliance with these policies and inform the Grid Security Officer of any violations encountered in the assessment, and correct such violations forthwith.

3. You shall ensure that a VO membership service is provided in compliance with the VO Membership Management Policy. This shall include the appropriate interfaces and configuration details to allow the generation of authentication, authorization and other identity mapping data for the services running on the Sites. You shall take reasonable measures to ensure that the information recorded in the membership service is correct and up-to-date.

4. You are responsible for ensuring that your software does not pose security threats, that access to your databases is secure and is sufficiently monitored, that your stored data are compliant with legal requirements, and that your VO services, including pilot job frameworks, are operated according to the applicable policy documents.

5. You shall ensure that logged, archived and membership information is only used for administrative, operational, accounting, monitoring and security purposes. You shall ensure that due diligence is applied in maintaining the confidentiality of such information.

6. You recognize that the Grid and the Sites may control your access to their resources for administrative, operational and security purposes.

7. You shall ensure that any software used by you at a Site for its intended purposes, complies with applicable license conditions and you shall hold such Site free and harmless from any liability with respect thereto.

8. Any software provided by the Grid is provided on an as-is basis only, and subject to its own license conditions. There is no guarantee that any service operated by the Grid is correct or sufficient for any particular purpose. The Grid, the Sites and other VOs are not liable for any loss or damage in connection with your participation in the Grid.

9. You shall comply with the Grid incident response procedures and respond promptly to requests from Grid Security Operations. You shall inform users in cases where their access rights have changed.

10. Disputes resulting from your participation in the Grid shall be resolved according to the Grid escalation procedures.


VIRTUAL OR G A N I S A T I O N R E G I S T R A T I O N SECURITY P O L I C Y

2 VO REGISTRATION REQUIREMENTS To satisfy Grid security requirements a VO registration procedure must capture and maintain at least the following information: 1. VO name. For new VOs this name must conform to the standard described in Appendix A. Existing VOs are not required to change their registered VO name.

2. VO Acceptable Use Policy (see example provided in Appendix B).

3. A signed copy of the VO Operations Policy document.

4. Contact details and certificates for the VO Manager and at least one Alternate:

o Name
o Employing Institute
o VO Role (Manager or Alternate)
o Email address
o Telephone number
o X.509 certificate issued by a Certification Authority approved for use on the Grid

5. A single email address of the security contact point to be used for reports of suspected identity compromises, misuse of resources or other security events related to the VO. Messages to this address should be handled confidentially and promptly.

6. The name of the Site, Infrastructure or other body responsible for running the VO Membership service, together with the URL of one or more VO Membership Servers. If a VO wishes to leave the Grid or the Grid decides to remove the VO, the registration information must be kept by the Grid for a minimum period consistent with the Traceability and Logging Policy. Personal registration information must not be retained for longer than one year. Additional operational requirements may be documented in the Grid-specific document describing the implementation of the VO Registration Procedure.

3 VO ACCEPTABLE USE POLICY The VO Acceptable Use Policy (AUP) is a statement which, by clearly describing the goals of the VO, defines the expected and acceptable usage of the Grid by the members of the VO. By requiring that all members of the VO who participate in the Grid agree to act within the constraints of the VO AUP the VO Manager defines a community of responsible users with a common goal. This definition enables Site Managers to decide whether to allow VO members to use their resources.

The VO AUP must:

*bind VO members to abide by the Grid Acceptable Use Policy.
*state who gives authority to the Policy

GRID ACCEPTABLE USE POLICY

Provavelmente a retirar

1 GRID ACCEPTABLE USE POLICY By registering as a Grid user you shall be deemed to accept these conditions of use:

1. You shall only use the Grid to perform work, or transmit or store data consistent with the stated goals, policies and conditions of use as defined by the body or bodies granting you access.

2. You shall not use the Grid for any unlawful purpose and not (attempt to) breach or circumvent any Grid administrative or security controls.

3. You shall respect intellectual property and confidentiality agreements.

4. You shall protect your access credentials (e.g. private keys or passwords).

5. You shall immediately report any known or suspected security breach or misuse of the Grid or access credentials to the incident reporting locations specified by the Grid and to the relevant credential issuing authorities.

6. You must notify the Registrar of any changes to your Registration Information.

7. Use of the Grid is at your own risk. There is no guarantee that the Grid will be available at any time or that it will suit any purpose.

8. Logged information, including information provided by you for registration purposes, is used for administrative, operational, accounting, monitoring and security purposes only. This information may be disclosed, via secured mechanisms, only for the same purposes and only as far as necessary to other organisations cooperating with the Grid. Although efforts are made to maintain confidentiality, no guarantees are given.

9. The access-granting bodies and Resource Providers are entitled to regulate, suspend or terminate your access, within their domain of authority, and you shall immediately comply with their instructions.

10. You are liable for the consequences of you violating any of these conditions of use.

VIRTUAL OR G A N I S A T I O N MEMBERSHIP MANAGEMENT P O L I C Y

3 DEFINITIONS Data supplied by the user:

*Personal user data:
*Family Name,
*Given Name,
*Institute name, i.e. the user’s employing institute (this is required if the user's membership eligibility derives from his/her institutional affiliation)
*Contact Phone number (this is optional, but the VO Manager may need to contact the user promptly during investigation of security incidents)

Registration Data: Authentication (AuthN) related information:

*Personal user data,
*Email address,
*DistinguishedName (DN) extracted from a valid personal digital certificate issued by his/her Certification Authority (CA). 

Other relevant terms: VO Database: Authorisation (AuthZ) related information, i.e. the user's role(s) in the VO, is stored in this database. His/her access rights to a resource and on data stored at it will depend on this information.

VO Manager: The responsible person recording in the VO Database, after appropriate checks, the status of a member of the VO, i.e. performing user entries, assignment of roles, information updates and user removals. The VO management function can be performed by a group of persons delegated by the VO Manager. The VO Manager does not necessarily have to be a member of the VO or to have signed and agreed to the VO AUP. This function may be performed by a member of a Grid or Site operations team as a service for the VO. All VO Managers must comply with the requirements of this policy.

Institute Representative (IR): If appointed, this person at the user’s employing institute is able to check the validity of is/her data and confirm the identity of the user and his/her right to become or remain a member of a VO.

VO Registration Information: Data stored by the Grid describing information about the VO.

4 MEMBERSHIP MANAGEMENT REQUIREMENTS The VO must appoint a VO manager and at least one deputy who are responsible for implementing procedures meeting the requirements of this policy. These are important roles which carry operational responsibilities; non-responsiveness of the VO manager or deputies may lead to the suspension of the VO from the Grid.

The VO membership management procedures must ensure that:

*only individuals who have agreed to abide by the VO AUP are registered as members of the VO,
*accurate Registration Data is maintained for all VO members.

Membership of a VO is not necessarily restricted to real persons. Hosts, Services and/or Robots (unattended automated processes acting on behalf of the VO) may also be registered in the VO. In the case of these non-personal registrations, the Registration Data must include the personal details of the real person requesting registration and assuming ongoing responsibility for the entity. The VO Manager must publish a description of the methods used to verify user data at registration time and periodically review users' affiliation with the VO according to the requirements in the following sub-sections.

4.1 Appointment of the VO Manager The VO should determine how it appoints and replaces its VO manager and deputies.

4.2 Membership Registration Membership Registration is the process by which people first join the VO. An important objective of this process is to collect the user’s Registration Data. Accurate Registration Data must be maintained for all VO members. VO Managers must check the validity of the user Registration Data and check the user's eligibility for special authorisation (Groups/Roles). Replication of Personal user data and multiple validation and authentication should be avoided so that Grid users register only once with each VO and their Registration Data are checked only in a single place. The procedures must unambiguously assign the individuals who take responsibility for the validity of the Registration Data provided, and those with the authority to exercise control over the rights of the user to use Grid resources. This may include an Institute Representative, as defined above, and/or Site Managers.

4.3 Acceptable Use Policy An important purpose of the registration process is to record the explicit acceptance by the user of the Grid AUP and the VO AUP as well as the acceptance, by the user, that part of his/her information including Personal user data may be made available to the Sites and Grid Operations.

4.4 Membership Renewal The membership renewal process must include:

*Confirmation, by the VO Manager, that continued membership of VO is still allowed,
*Confirmation or update of all data provided during registration and all special authorisations,
*Reaffirmed acceptance by the user of the Grid AUP and the VO AUP.

Membership of the VO must be renewed at least every 12 months. Additionally all members of the VO should renew following a major change to the Grid Acceptable Use Policy.

4.5 Membership Removal The following conditions should trigger a timely re-evaluation of the user’s right to remain a member of a given VO:

*User or IR request. Ideally, the user should be able to remove themselves from the VO without involvement of the VO Manager,
*Renewal failed to complete in allotted time,
*End of collaboration between the user’s institute and the VO, if applicable,
*End of collaboration between the user and the VO,
*End of collaboration between the user and his/her institute, if applicable.

Note that some VOs may not maintain relationships with institutes. The fact that the VO does not maintain relationships with institutes should be recorded on the VO Registration Information.

4.6 Membership Suspension The suspension of VO membership is the temporary removal of the user from the VO. The VO Manager must cooperate fully with Grid Security Operations in the investigation of Grid security incidents. A member should be suspended when the VO Manager is presented with reasonable evidence that the member’s grid identity has been used, with or without the user’s consent, in breach of relevant Grid and/or VO policies (security or otherwise). The request for suspension may be made by the Grid Security Officer and/or by Grid Operations. Requests from Sites should be routed through and confirmed by the Grid Security Officer and/or Grid Operations. In emergency situations this confirmation may be provided after the actual suspension if the VO Manager decides this is appropriate. All reasonable efforts must be made by the VO Manager to contact the member when he/she is suspended. Prior to reinstating a suspended user the VO Manager must notify those who requested suspension. There should be an agreed dispute resolution procedures which the VO and/or Grid can follow if the user wishes to challenge his/her suspension.

4.7 Audit Requirements The VO Membership Management system(s) must record and maintain an audit log of all VO membership transactions. This audit log must be kept for a minimum period consistent with the Traceability and Logging Policy (https://documents.egi.eu/document/81). Audit logs containing personal registration data must not be retained for longer than one year. The audit logs must include:

*every request for membership,
*every request for assignment of or change to VO authorisation attributes (groups, roles etc.),
*every membership renewal request,
*every membership suspension request,
*every membership removal.

Each of these requests should record the date and time of the request, the originator of the request, the details of the request and whether or not it was approved or successful. The identity of the person granting or refusing the request should be recorded including any verification steps involved and other people consulted, e.g. IR.

4.8 Data Privacy It is recommended that the VO should document its VO Membership data privacy policy. This should include statements on:

*which data, if any, is collected from a VO member in addition to the Registration Data and explain why this data is required,
*how and where the data is stored,
*for how long the data is kept and how expired data is deleted,
*explain who within the VO has access to the data and why,
*how the user can view their own data and request corrections,
*what happens to the VO membership data when the VO ceases to exist,
*describe any third parties to whom VO membership data is disclosed and why. The VO may decide, for example, to grant read access to the data by Grid and Security Operations. 

VO Portal Policy

Documentation