diff --git a/SecurityPolicy.html b/SecurityPolicy.html index 04f77e4..7897f91 100644 --- a/SecurityPolicy.html +++ b/SecurityPolicy.html @@ -191,8 +191,8 @@ deriving from the above principles.
-This Security Policy is part of the configuration-control specification -for audit purposes (DRC). +This Security Policy is part of the Configuration-Control Specification +for audit purposes (DRC-A.1). It is under the control of Policy on Policy for version purposes.
@@ -210,7 +210,11 @@ This Policy explicitly defers detailed security practices to the The SM says how things are done. As practices are things that vary from time to time, including between each event of practice, -the SM is under the direct control of the Systems Administration team. +the SM is under the direct control of the + +There is no inherent authorisation to access the data. -Systems Administrators are authorised to access +Systems Administrators + +and Application Engineers + +are authorised to access the raw data under the control of this policy. All others must not access the raw data. All are responsible for protecting the data @@ -486,7 +494,10 @@ of software has become known an emergent local exploit may also be deemed to be an emergency). Application of patches in this case may occur as soon as possible, bypassing the normal configuration-change process. -The systems administration team leader must either approve the patch, +The systems administration team leader must either approve the patch + +or + instruct remedial action, and refer the case to dispute resolution.
@@ -502,44 +513,12 @@ independent of filed disputes.+
Systems administration is to provide a limited environment to Applications Engineers in order to install and maintain the application.
-
-
-Software assessment takes place on various test systems
-(not a critical system). See §7.
-Once offered by Software Assessment (team),
-system administration team leader has to
-approve the installation of each release or patch.
-
-
-
-Any changes made to source code must be referred
-back to software assessment team
-and installation needs to be deferred
-until approved by the Software Assessment Team.
-
-
-
-Requests to systems administration for ad hoc queries
-over the database for business or similar purposes
-must be approved by the Arbitrator.
-
-
@@ -576,31 +555,31 @@ authorisations on the below access control lists
Only System Administrators -and Application Engineers +and Application Engineers designated on the Access Lists in §3.4.2 are authorized to access accounts, unless specifically directed by the Arbitrator. @@ -908,7 +887,7 @@ infrastructure is not available.
Software assessment team is responsible -for the security and maintenance of the code. +for the security and maintenance of the code.
-The primary tasks for Software Assessors are: +The primary tasks for Software Assessors are:
+
The primary tasks for Application Engineers are:
-
-Application Engineers are roles within Software Assessment
-team that are approved to install into production the
+The Application Engineer is a role within Software Assessment
+team that is approved to install into production the
patches that are signed off.
+
Once signed off, the Application Engineer
commits the patch from the development repository
to the production repository,
@@ -1033,6 +1011,7 @@ into the running code.
The Application Engineer is responsible for basic
testing of functionality and emergency fixes,
which then must be back-installed into the repositories.
+
@@ -1040,36 +1019,6 @@ Requests to Application Engineers for ad hoc queries over the database for busin
-
-Once signed off,
-software assessment (team leader)
-coordinates with systems administration (team leader)
-to offer the upgrade.
-Upgrade format is to be negotiated,
-but systems administration naturally has the last word.
-Software Assessors are not to have access
-to the critical systems, providing a dual control
-at the teams level.
-
-
-
-If compilation and/or other processing of the
-application source code in the version control system
-is necessary to deploy the application,
-detailed installation instructions should also be
-maintained in the version control system and offered to the
-System Administrators.
-
-
-
-Systems administrators copy the patches securely
-from the software assessment repository
-onto the critical machine.
-
See §3.3.