From 418fd6f8f32277c3eba87fce39e7c1b3279306f3 Mon Sep 17 00:00:00 2001 From: Ian Grigg Date: Sat, 28 Mar 2009 01:04:26 +0000 Subject: [PATCH] to DRAFT, 11 Ayes counted git-svn-id: http://svn.cacert.org/CAcert/Policies@1240 14b1bab8-4ef6-0310-b690-991c95c89dfd --- SecurityPolicy.html | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/SecurityPolicy.html b/SecurityPolicy.html index 2a0c1bd..49842cf 100644 --- a/SecurityPolicy.html +++ b/SecurityPolicy.html @@ -8,10 +8,10 @@

Security Policy for CAcert Systems

-

CAcert Security Policy Status == wip +

CAcert Security Policy Status == wip
Creation date: 20090216
-Status: work-in-progress, to DRAFT 20090327 +Status: DRAFT 20090327

1. INTRODUCTION

@@ -456,11 +456,9 @@ until approved by the Software Assessment Team.

- Requests to systems administration for ad hoc queries over the database for business or similar purposes must be approved by the Arbitrator. -

3.4. Access control

@@ -528,10 +526,7 @@ authorisations on the below access control lists

-All changes - -of personnel - +All changes of personnel to the above lists are approved by the Board of CAcert.

@@ -612,8 +607,7 @@ and reported in regular summaries to the Board of CAcert.

4.2.1. Coverage

-All sensitive events should be logged - reliably . +All sensitive events should be logged reliably. Logs should be deleted after an appropriate amount of time as documented in the Security Manual.

@@ -1187,7 +1181,6 @@ especially of new team members.

9.2.1. Root Key generation

-

Root keys are generated only on instruction from the Board. They must be generated to a fully documented and reviewed procedure. @@ -1203,7 +1196,6 @@ The procedure must include:

  • Documentation of each step as it happens against the procedure.
  • Confirmation by each participant over the process and the results.
    • -

    9.2.2. Backup and escrow

    @@ -1303,20 +1295,16 @@ of open disclosure wherever possible. See Principles. This is not a statement of politics but a statement of security; - if a security issue can only be sustained - under some confidentiality or secrecy, then find another way.

    In concrete terms, - confidentiality or secrecy may be maintained only under a defined method in policy, or under the oversight of the Arbitrator (which itself is under DRP). - The exception itself must not be secret or confidential. All secrets and confidentials are reviewable under Arbitration, and may be reversed.