From 4229f2f1a65831d171878496c1b3d7ca859c665c Mon Sep 17 00:00:00 2001 From: Ian Grigg Date: Mon, 16 Feb 2009 15:34:13 +0000 Subject: [PATCH] Copied directly from SM in wiki, 1st introductory chapter only, as a starter. git-svn-id: http://svn.cacert.org/CAcert/Policies@1172 14b1bab8-4ef6-0310-b690-991c95c89dfd --- SecurityPolicy.html | 156 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 156 insertions(+) create mode 100644 SecurityPolicy.html diff --git a/SecurityPolicy.html b/SecurityPolicy.html new file mode 100644 index 0000000..3a8b73f --- /dev/null +++ b/SecurityPolicy.html @@ -0,0 +1,156 @@ + + +Security Policy + + + +

Security Policy for CAcert Systems

+

CAcert Security Policy Status == wip +
+Creation date: 2009-02-16
+Status: work-in-progress +

+ +

1. Introduction

+ +

1.1. Motivation and Scope

+

+This Security Manual sets out required procedures for the secure operation of the CAcert critical computer systems. These systems include: +

  1. + Physical hardware mounting the logical services +
  2. + Webserver + database (core server(s)) +
  3. + Signing service (signing server) +
  4. + Support interface +
  5. + Source code (changes and patches) +
+

+ +

1.1.1. Effected Personnel

+ +These roles and teams are effected: + + +

+ +

1.1.2. Out of Scope

+ +

+Non-critical systems are not covered by this manual, +but may be guided by it, and impacted where they are +found within the security context. +Architecture is out of scope, see CPS#6.2. +

+ +

1.2. Principles

+

+Important principles of this Security Manual are: + +

+

+ +

+Each task or asset is covered by a variety of protections +deriving from the above principles. +

+ +

1.3. Definition of Terms

+
+
Systems Administrator
+
+ A Member who manages a critial system, and has access + to security-sensitive functions or data. +
+ +

1.4. Version control

+ +

1.4.1. The Security Policy Document

+

+This Security Policy is part of the configuration-control specification +for audit purposes (DRC). +It is under the control of Policy on Policy for version purposes. +

+ +

+This policy document says what is done, rather than how to do it. +

+ +

1.4.2. The Security Manual (Practices) Document

+ +

+This Policy explicitly defers detailed security practices to the +Security Manual +("SM"), +The SM says how things are done. +As practices are things that vary from time to time, +including between each event of practice, +the SM is under the direct control of the Systems Administration team. +It is located and version-controlled on the CAcert wiki. +

+ +

1.4.3. The Security Procedures

+ +

+The Systems Administration team may from time to time +explicitly defer single, cohesive components of the +security practices into separate procedures documents. +Each procedure should be managed in a wiki page under +their control, probably at + +SystemAdministrationProcedures. +Each procedure must be referenced explicitly in the Security Manual. +

+ + +

End

+

This is the end of the Security Policy.

+

Valid XHTML 1.1 +

+ +