2. Physical Security
+2. PHYSICAL SECURITY
@@ -344,7 +344,7 @@ codes and devices (keys) are to be authorised and documented. -3. Logical Security
+3. LOGICAL SECURITY
3.1. Network
3.1.1. Infrastructure
@@ -513,6 +513,184 @@ Upon resignation from systems administration team, or determination by two membe +4. OPERATIONAL SECURITY
+ +4.1. System administration
+ ++Primary systems administration tasks shall be conducted under four eyes principle. +These shall include +backup performance verification, +log inspection, +software patch identification and application, +account creation and deletion, +and hardware maintenance. +
+ ++System administrators must pass a background check and comply with all applicable policies in force. +
+ +4.1.1. Privileged accounts and passwords
++Access to Accounts (root and user via SSH or console) must be strictly controlled. +Passwords and passphrases entered into the systems will be kept private +to CAcert sysadmins in all cases. +
+ +4.1.1.1. Authorized users
++Only system administrators designated on the Access List +shall be authorized to access accounts. +
+ +Assumes above that there is no reason to have access +to a Unix-level account on the critical machines unless on the Access List.
+ +4.1.1.2. Access to
++All remote communications for systems administration purposes is encrypted, +logged and monitored. +
+ +4.1.1.3. Changing
+ ++Passwords must be kept secure. +The procedure for changing passwords should be documented. +
+ +4.1.2. Required staff response time
++Response times should be documented. +
+ +4.1.3. Change management procedures
++All changes made to system configuration must be recorded. +
+ +4.2. Logging
+ +4.2.1. Coverage
+ ++Logs shall be maintained for: +
+ +-
+
- anomalous network traffic, +
- system activities and events, +
- application (certificate, web, mail, and database) events, +
- "Comms Module" requests for certificate signing on both the cryptographic module (signing server) and the main online server, +
- login and root access, +
- configuration changes. +
4.2.2. Access and Security
+ ++Access to logs must be restricted. +The security of the logs should be documented. +The records retention should be documented. +
+ +4.2.3. Automated logs
++Logging should be automated, +and use should be made of appropriate system-provided automated tools. +Automated logs should be reviewed periodically; +suspicious events should be flagged and investigated in a timely fashion. +
+ +4.2.4. Operational (manual) logs
++Configuration changes, no matter how small, must be logged. +Access to this log shall be restricted. +
+ ++All physical visits will be logged and a report provided by the accessor. +
+ +4.3. Backup
+ ++The procedure for all backups must be documented, +according to the following sub-headings. +
+ +4.3.1. Type
++Backups must be taken for operational +and for disaster recovery purposes ("offline"). +Disaster recovery backups must be offline and remote. +Operational backups may be online and local. +
+ +4.3.2. Frequency
+Document.
+ +4.3.3. Storage
++Backups must be protected to the same level as the critical systems themselves. +Offline backups should be distributed. +
+ +4.3.4. Retention period and Re-use
+Document.
+ +4.3.5. Encryption
++Backups must be encrypted and must only be transmitted via secured channels. +Off-site backups must be dual-encrypted using divergent methods. +
+ +4.3.6. Verifying Backups
++Two CAcert system administrators must be +present for verification of a backup. +Four eyes principle must be maintained when the key and backup are together. +For any other purpose than verification of the success of the backup, see next. +
+ +4.3.7. Key Management
++The encryption keys must be stored securely by the +CAcert systems administrators. +Paper documentation must be stored with manual backups. +
+ +4.3.8. Reading Backups
++Conditions and procedures for examining the backups for purposes +other than for verification must be documented +and must be under Arbitrator control. +
+ +4.4. Data retention
+ +4.4.1. User data
+ ++Termination of user data is under direction of the Arbitrator. +See CCA. +
+ +4.4.2. System logs
+Document.
+ +4.4.3. Incident reports
++The systems administration team leader is to maintain incident reports securely. +Access to incident reports is restricted. +
+ +4.5. Cycling
+Document.
+ + +
This is the end of the Security Policy.