diff --git a/SecurityPolicy.html b/SecurityPolicy.html index 04f77e4..7897f91 100644 --- a/SecurityPolicy.html +++ b/SecurityPolicy.html @@ -191,8 +191,8 @@ deriving from the above principles.

1.4.1. The Security Policy Document

-This Security Policy is part of the configuration-control specification -for audit purposes (DRC). +This Security Policy is part of the Configuration-Control Specification +for audit purposes (DRC-A.1). It is under the control of Policy on Policy for version purposes.

@@ -210,7 +210,11 @@ This Policy explicitly defers detailed security practices to the The SM says how things are done. As practices are things that vary from time to time, including between each event of practice, -the SM is under the direct control of the Systems Administration team. +the SM is under the direct control of the + +Systems Administration team +applicable team leaders. + It is located and version-controlled on the CAcert wiki.

@@ -354,7 +358,11 @@ one systems administrator present.

There is no inherent authorisation to access the data. -Systems Administrators are authorised to access +Systems Administrators + +and Application Engineers + +are authorised to access the raw data under the control of this policy. All others must not access the raw data. All are responsible for protecting the data @@ -486,7 +494,10 @@ of software has become known an emergent local exploit may also be deemed to be an emergency). Application of patches in this case may occur as soon as possible, bypassing the normal configuration-change process. -The systems administration team leader must either approve the patch, +The systems administration team leader must either approve the patch + +or + instruct remedial action, and refer the case to dispute resolution.

@@ -502,44 +513,12 @@ independent of filed disputes.

3.3. Application

-

+

Systems administration is to provide a limited environment to Applications Engineers in order to install and maintain the application.

- - -

- -Software assessment takes place on various test systems -(not a critical system). See §7. -Once offered by Software Assessment (team), -system administration team leader has to -approve the installation of each release or patch. - -

- -

- -Any changes made to source code must be referred -back to software assessment team -and installation needs to be deferred -until approved by the Software Assessment Team. - -

- -

- -Requests to systems administration for ad hoc queries -over the database for business or similar purposes -must be approved by the Arbitrator. - -

-

3.4. Access control

@@ -576,31 +555,31 @@ authorisations on the below access control lists Access Engineers control of access by personnel to hardware exclusive of all other roles - Board of CAcert (or designee) + Access team leader Board of CAcert (or designee) Physical Access List Systems Administrators hardware-level for installation and recovery exclusive with Access Engineers and Software Assessors - Board of CAcert (or designee) + systems administration team leader Board of CAcert (or designee) SSH Access List - Systems Administrators + Systems Administrators and Application Engineers Unix / account / shell level includes by default all on Physical Access List systems administration team leader - - Support Access List - Support Engineer - support features in the web application - includes by default all systems administrators - systems administration team leader Repository Access List - Application EngineersSoftware Assessors - change the source code repository and install patches to application + Application Engineers + change the source code repository and install patches to application exclusive with Access Engineers and systems administrators software assessment team leader + + Support Access List + Support Engineer + support features in the web application + includes by default all Application Engineers systems administrators + systems administration support team leader @@ -648,14 +627,14 @@ must be strictly controlled. Passphrases and SSH private keys used for entering into the systems will be kept private to CAcert sysadmins -and Application Engineers +and Application Engineers in all cases.

4.1.1.1. Authorized users

Only System Administrators -and Application Engineers +and Application Engineers designated on the Access Lists in §3.4.2 are authorized to access accounts, unless specifically directed by the Arbitrator. @@ -908,7 +887,7 @@ infrastructure is not available.

Software assessment team is responsible -for the security and maintenance of the code. +for the security and maintenance of the code.

7.1. Authority

@@ -921,7 +900,7 @@ See §3.4.2.

7.2. Tasks

-The primary tasks for Software Assessors are: +The primary tasks for Software Assessors are:

  1. Keep the code secure in its operation, @@ -929,8 +908,6 @@ The primary tasks for Software Assessors are: Fix security bugs, including incidents,
  2. Audit, Verify and sign-off proposed patches, -
  3. - Guide Systems Administration team in inserting patches,
  4. Provide guidance for architecture,
@@ -940,10 +917,10 @@ Software assessment is not primarily tasked to write the code. In principle, anyone can submit code changes for approval.

-

+

The primary tasks for Application Engineers are:

-
  1. +
    1. Installing signed-off patches,
    2. Verifying correct running, @@ -1022,9 +999,10 @@ any Member that requests it.

      7.6. Handover Production

      -Application Engineers are roles within Software Assessment -team that are approved to install into production the +The Application Engineer is a role within Software Assessment +team that is approved to install into production the patches that are signed off. + Once signed off, the Application Engineer commits the patch from the development repository to the production repository, @@ -1033,6 +1011,7 @@ into the running code. The Application Engineer is responsible for basic testing of functionality and emergency fixes, which then must be back-installed into the repositories. +

      @@ -1040,36 +1019,6 @@ Requests to Application Engineers for ad hoc queries over the database for busin

      - -Once signed off, -software assessment (team leader) -coordinates with systems administration (team leader) -to offer the upgrade. -Upgrade format is to be negotiated, -but systems administration naturally has the last word. -Software Assessors are not to have access -to the critical systems, providing a dual control -at the teams level. - -

      - -

      - -If compilation and/or other processing of the -application source code in the version control system -is necessary to deploy the application, -detailed installation instructions should also be -maintained in the version control system and offered to the -System Administrators. - -

      - -

      - -Systems administrators copy the patches securely -from the software assessment repository -onto the critical machine. - See §3.3.

      @@ -1380,7 +1329,7 @@ All external inquiries of security import are filed as disputes and placed befor Only the Arbitrator has the authority to deal with external requests and/or create a procedure. Access Engineers, systems administrators, -support engineers, +support engineers, Board members and other key roles do not have the authority to answer legal inquiry. The Arbitrator's ruling may instruct individuals, @@ -1409,7 +1358,6 @@ All arrangements must be: Assured Organisations, in which all involved personnel are Assurers,
      3. -
    4. with Members that have the requisite knowledge and in good contact with the team leader(s),