From a66e571ab4264fba182f4dedb04842664ce9ffa5 Mon Sep 17 00:00:00 2001 From: Ian Grigg Date: Wed, 23 Sep 2009 22:29:58 +0000 Subject: [PATCH] changes to add the Application Engineer git-svn-id: http://svn.cacert.org/CAcert/Policies@1698 14b1bab8-4ef6-0310-b690-991c95c89dfd --- SecurityPolicy.html | 163 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 152 insertions(+), 11 deletions(-) diff --git a/SecurityPolicy.html b/SecurityPolicy.html index 49842cf..1a78fa9 100644 --- a/SecurityPolicy.html +++ b/SecurityPolicy.html @@ -4,6 +4,42 @@ Security Policy + + + @@ -11,7 +47,14 @@

CAcert Security Policy Status == wip
Creation date: 20090216
-Status: DRAFT 20090327 +Status: DRAFT 20090327

+ +Changes: WIP 20090915
+work-in-progress additions are in BLUE + (unvoted / nonbinding)
+work-in-progress deletions are struck-out in black +but still DRAFT/binding
+some random comments in GREEN added

1. INTRODUCTION

@@ -49,6 +92,8 @@ These roles are directly covered: Support Engineers
  • Software Assessors +
  • + Application Engineers

    • 1.1.2. Out of Scope

    @@ -102,6 +147,14 @@ deriving from the above principles. See §1.1. +
    Application Engineer
    +
    + A Member who manages the critical application, + including installing them on the critical system, + final testing, emergency patching, and ad hoc scripting. + See §x.x. +
    +
    Software Assessor
    A Member who reviews patches for security and workability, @@ -440,25 +493,42 @@ independent of filed disputes.

    3.3. Application

    +

    +Systems administration is to provide a limited environment +to Applications Engineers in order to install and maintain +the application. +

    + + +

    + Software assessment takes place on various test systems (not a critical system). See §7. Once offered by Software Assessment (team), system administration team leader has to approve the installation of each release or patch. +

    + Any changes made to source code must be referred back to software assessment team and installation needs to be deferred until approved by the Software Assessment Team. +

    + Requests to systems administration for ad hoc queries over the database for business or similar purposes must be approved by the Arbitrator. +

    3.4. Access control

    @@ -518,8 +588,8 @@ authorisations on the below access control lists systems administration team leader Repository Access List - Software Assessors - change the source code repository + Application EngineersSoftware Assessors + change the source code repository and install patches to application exclusive with Access Engineers and systems administrators software assessment team leader @@ -568,12 +638,16 @@ Access to Accounts must be strictly controlled. Passphrases and SSH private keys used for entering into the systems will be kept private -to CAcert sysadmins in all cases. +to CAcert sysadmins +and Application Engineers +in all cases.

    4.1.1.1. Authorized users

    -Only System Administrators designated on the Access Lists +Only System Administrators +and Application Engineers +designated on the Access Lists in §3.4.2 are authorized to access accounts, unless specifically directed by the Arbitrator.

    @@ -825,7 +899,7 @@ infrastructure is not available.

    Software assessment team is responsible -for the security of the code. +for the security and maintenance of the code.

    7.1. Authority

    @@ -838,7 +912,7 @@ See §3.4.2.

    7.2. Tasks

    -The primary tasks are: +The primary tasks for Software Assessors are:

    1. Keep the code secure in its operation, @@ -847,7 +921,7 @@ The primary tasks are:
    2. Audit, Verify and sign-off proposed patches,
    3. - Guide Systems Administration team in inserting patches, + Guide Systems Administration team in inserting patches,
    4. Provide guidance for architecture,
    @@ -857,6 +931,27 @@ Software assessment is not primarily tasked to write the code. In principle, anyone can submit code changes for approval.

    +

    +The primary tasks for Application Engineers are: +

    +
    1. + Installing signed-off patches, +
    2. + Verifying correct running, +
    3. + Correcting immediate errors and copying fixes back to + upstream repositories, +
    4. + Running ad-hoc database scripts and other programs, +
    5. + Repairing data errors, +
    6. + Backing up at the database level, +
    7. + Watching application-level logs. +
    + +

    7.3. Repository

    @@ -866,6 +961,26 @@ in a central repository that is run by the software assessment team.

    + +
      +
    • is this something that can be and is being run by systems administration team?
      • +
    • Or are their two, the test one and the critical one?
      • +
    • Like this:
      • +
    + +

    +The development code and testing patches are maintained +in a central development repository that is run by the +software assessment team. +

    + +

    +The production code is maintained in a secure production repository +within the critical systems that is run by the +systems administation team. +Access is made available to the Application Engineers. +

    +

    7.4. Review

    @@ -895,10 +1010,30 @@ Bug submission access should be provided to any Member that requests it.

    -

    7.6. Handover

    +

    7.6. Handover Production

    + +

    +Application Engineers are roles within Software Assessment +team that are approved to install into production the +patches that are signed off. +Once signed off, the Application Engineer +commits the patch from the development repository +to the production repository, +and installs the patch from the production repository +into the running code. +The Application Engineer is responsible for basic +testing of functionality and emergency fixes, +which then must be back-installed into the repositories. +

    + +

    +Requests to Application Engineers for ad hoc queries over the database for business or similar purposes must be approved by the Arbitrator. +

    -Once signed off, software assessment (team leader) + +Once signed off, +software assessment (team leader) coordinates with systems administration (team leader) to offer the upgrade. Upgrade format is to be negotiated, @@ -906,21 +1041,26 @@ but systems administration naturally has the last word. Software Assessors are not to have access to the critical systems, providing a dual control at the teams level. +

    + If compilation and/or other processing of the application source code in the version control system is necessary to deploy the application, detailed installation instructions should also be maintained in the version control system and offered to the System Administrators. +

    + Systems administrators copy the patches securely from the software assessment repository onto the critical machine. + See §3.3.

    @@ -1013,6 +1153,7 @@ or Case Managers.
  • Access Engineer: responsible for controlling access to hardware, and maintaining hardware.
  • System administrator: responsible for maintaining core services and integrity.
  • Software Assessor: maintain the code base and confirm security ("sign-off") of patches and releases.
    • +
  • Application Engineer: install application updates and confirm basic working.
  • Support Engineer: human interface with users.
  • Team leaders: coordinate with teams, report to Board.
  • All: respond to Arbitrator's rulings on changes. Respond to critical security issues. Observe.
    • @@ -1080,7 +1221,7 @@ The background check should be done on all of:
    • Systems Administrator
    • Access Engineers
      • -
    • Software Assessor
      • +
    • Software Assessor (including Application Engineer)
    • Support Engineer
    • Board