Deploying Grids on Campus
Networks
Andrew Cormack
Chief Security Adviser, UKERNA
A.Cormack@ukerna.ac.uk
Campus Grid workshop, NESC
©The JNT Association, 2005
World Pictures
Grid World
Research
oriented
Everyone friendly
Same rules everywhere
Common trust level
Peaceful
Campus Grid workshop, NESC
Campus Network World
Service
oriented
Good guys & bad guys
Rules vary
Internal trust frontiers
Hostile background noise
©The JNT Association, 2005
How to bring these worlds together?
Campus Grid workshop, NESC
©The JNT Association, 2005
Issues for Network Managers
How to design networks?



That provide service
That limit spread of problems
That protect systems that can’t protect themselves
Tools available



Physical design – capacity planning
Logical design – group systems with similar requirements
Control points – routers & firewalls protect and contain
Campus Grid workshop, NESC
©The JNT Association, 2005
Issues for Grid Managers
Putting research systems in a hostile environment


Must secure all software (o/s, services & apps)
Grids are designed to spread problems!
Grids need firewalls



To reduce network congestion
To reduce intensity of system/software management
To contain the spread of problems
Design Grids to be firewall-friendly


Don’t expose yourself to threats
Don’t expose others to threats
Campus Grid workshop, NESC
©The JNT Association, 2005
Issues for Everyone
How to monitor/measure Grid performance?
Grids should be doing useful work
 Grids should not be doing bad things

How to detect and respond to incidents?
Grid incidents may not be network incidents
 Network “incidents” may be Grid successes!

Campus Grid workshop, NESC
©The JNT Association, 2005
Ideas to make Campus Grids easier
Clear agreed purpose -> policies -> implementation
Standard system image(s)

Automatic updates, patches etc reduce firefighting
Recognisable (private?) network addresses

Mostly for ease of configuration, not host security
Work with, not against, network level controls
Effective incident detection & response plan

Incidents will spread fast and far in a grid
Campus Grid workshop, NESC
©The JNT Association, 2005
Collecting Best Practice
UKERNA Grid Deployment Technical Guide
General Principles
 Tools, Techniques & Resources

Appendices: Specific Package Issues
 1st Edition:
Globus pre web services, Condor
Future versions maintained and developed by
practitioners?
Campus Grid workshop, NESC
©The JNT Association, 2005