diff --git a/SecurityPolicy.html b/SecurityPolicy.html index 9772099..04c9c22 100644 --- a/SecurityPolicy.html +++ b/SecurityPolicy.html @@ -35,6 +35,7 @@ th { font-weight: bold; } .strike { + color : blue; text-decoration:line-through; } a:hover { @@ -49,19 +50,19 @@ a:hover {
-WIP Changes are all marked in BLUE or struck-out.
+WIP Changes are all marked in BLUE or struck-out.
Explanatory comments in GREEN are not part of text.
Start of Policy
-
This Security Policy sets out the policy
for the secure operation of the CAcert critical computer systems.
@@ -217,8 +218,10 @@ The SM says how things are done.
As practices are things that vary from time to time,
including between each event of practice,
the SM is under the direct control of the
+
+Systems Administration team
+
-Systems Administration team
applicable team leaders.
It is located and version-controlled on the CAcert wiki.
@@ -393,7 +396,7 @@ Arbitrator must be sought as soon as possible.
See DRP.
All personel who are in possession of physical security @@ -550,7 +553,7 @@ authorisations on the below access control lists (see §1.1.1):
-List Name | Who | Purpose of access | @@ -561,13 +564,13 @@ authorisations on the below access control listsAccess Engineers | control of access by personnel to hardware | exclusive of all other roles | -Access team leader |
+ Access team leader Board of CAcert (or designee) |
Physical Access List | Systems Administrators | hardware-level for installation and recovery | exclusive with Access Engineers and Software Assessors | -systems administration team leader |
+ systems administration team leader Board of CAcert (or designee) | ||
SSH Access List | Systems Administrators and Application Engineers | @@ -584,9 +587,9 @@ authorisations on the below access control listsSupport Access List | Support Engineer | support features in the web application | - includes by default all Application Engineers |
-
@@ -1002,13 +1005,13 @@ Bug submission access should be provided to any Member that requests it.
-
The Application Engineer is a role within Software Assessment
team that is approved to install into production the
patches that are signed off.
-
+
Once signed off, the Application Engineer
commits the patch from the development repository
to the production repository,
@@ -1017,7 +1020,7 @@ into the running code.
The Application Engineer is responsible for basic
testing of functionality and emergency fixes,
which then must be back-installed into the repositories.
-
+
@@ -1349,7 +1352,7 @@ Components may be outsourced. Team leaders may outsource non-critical components on notifying the Board. Critical components must be approved by the Board. -
+
Any outsourcing arrangements must be documented. @@ -1429,7 +1432,7 @@ Relevant and helpful Documents should be referenced for convenience. -
This is the end of the Security Policy.