From cac52d9c3b21357433bec5856b7542a3d9416175 Mon Sep 17 00:00:00 2001
From: Ian Grigg <iang@cacert.org>
Date: Mon, 23 Feb 2009 23:34:26 +0000
Subject: [PATCH] sucked in section 4

git-svn-id: http://svn.cacert.org/CAcert/Policies@1186 14b1bab8-4ef6-0310-b690-991c95c89dfd
---
 SecurityPolicy.html | 186 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 182 insertions(+), 4 deletions(-)

diff --git a/SecurityPolicy.html b/SecurityPolicy.html
index 32683ba..fc04e05 100644
--- a/SecurityPolicy.html
+++ b/SecurityPolicy.html
@@ -46,7 +46,7 @@ Creation date: 2009-02-16<br>
 Status: <i>work-in-progress</i>
 </p>
 
-<h2><a name="1">1.</a> Introduction</h2>
+<h2><a name="1">1.</a> INTRODUCTION</h2>
 
 <h3><a name="1.1">1.1.</a> Motivation and Scope </h3>
 <p>
@@ -105,7 +105,7 @@ Important principles of this Security Policy are:
 <ul><li>
       <i>dual control</i> -- at least two individuals must control a task
     </li><li>
-      <i>4 eyes</i> -- at least two individuals must be present during a task,
+      <i>four eyes</i> -- at least two individuals must be present during a task,
       one to execute and one to observe.
     </li><li>
       <i>redundancy</i> -- no single individual is the only one authorized
@@ -177,7 +177,7 @@ SystemAdministration/Procedures</a>.
 Each procedure must be referenced explicitly in the Security Manual.
 </p>
 
-<h2><a target="2">2.</a> Physical Security</h2>
+<h2><a name="2">2.</a> PHYSICAL SECURITY</h2>
 
 
 
@@ -344,7 +344,7 @@ codes and devices (keys) are to be authorised and documented.
 
 
 
-<h2><a name="3">3.</a> Logical Security</h2>
+<h2><a name="3">3.</a> LOGICAL SECURITY</h2>
 
 <h3><a name="3.1">3.1.</a> Network </h3>
 <h4><a name="3.1.1">3.1.1.</a> Infrastructure </h4>
@@ -513,6 +513,184 @@ Upon resignation from systems administration team, or determination by two membe
 
 
 
+<h2> <a name="4">4. OPERATIONAL SECURITY </h2>
+
+<h3> <a name="4.1">4.1. System administration </h3>
+
+<p>
+Primary systems administration tasks shall be conducted under four eyes principle.
+These shall include
+backup performance verification,
+log inspection,
+software patch identification and application,
+account creation and deletion,
+and hardware maintenance.
+</p>
+
+<p>
+System administrators must pass a background check and comply with all applicable policies in force.
+</p>
+
+<h4> <a name="4.1.1">4.1.1. Privileged accounts and passwords </h4>
+<p>
+Access to Accounts (root and user via SSH or console) must be strictly controlled.
+Passwords and passphrases entered into the systems will be kept private
+to CAcert sysadmins in all cases.
+</p>
+
+<h5> <a name="4.1.1.1">4.1.1.1. Authorized users </h5>
+<p>
+Only system administrators designated on the Access List
+shall be authorized to access accounts.
+</p>
+
+<p class="q">Assumes above that there is no reason to have access
+to a Unix-level account on the critical machines unless on the Access List.</p>
+
+<h5> <a name="4.1.1.2">4.1.1.2. Access to </h5>
+<p>
+All remote communications for systems administration purposes is encrypted,
+logged and monitored.
+</p>
+
+<h5> <a name="4.1.1.3">4.1.1.3. Changing </h5>
+
+<p>
+Passwords must be kept secure.
+The procedure for changing passwords should be documented.
+</p>
+
+<h4> <a name="4.1.2">4.1.2. Required staff response time </h4>
+<p>
+Response times should be documented.
+</p>
+
+<h4> <a name="4.1.3">4.1.3. Change management procedures </h4>
+<p>
+All changes made to system configuration must be recorded.
+</p>
+
+<h3> <a name="4.2">4.2. Logging </h3>
+
+<h4> <a name="4.2.1">4.2.1. Coverage </h4>
+
+<p>
+Logs shall be maintained for:
+</p>
+
+<ul>
+    <li> anomalous network traffic, </li>
+    <li> system activities and events, </li>
+    <li> application (certificate, web, mail, and database) events, </li>
+    <li> "Comms Module" requests for certificate signing on both the cryptographic module (signing server) and the main online server, </li>
+    <li> login and root access, </li>
+    <li> configuration changes.  </li>
+</ul>
+
+<h4> <a name="4.2.2">4.2.2. Access and Security </h4>
+
+<p>
+Access to logs must be restricted.
+The security of the logs should be documented.
+The records retention should be documented.
+</p>
+
+<h4> <a name="4.2.3">4.2.3. Automated logs </h4>
+<p>
+Logging should be automated,
+and use should be made of appropriate system-provided automated tools.
+Automated logs should be reviewed periodically;
+suspicious events should be flagged and investigated in a timely fashion.
+</p>
+
+<h4> <a name="4.2.4">4.2.4. Operational (manual) logs </h4>
+<p>
+Configuration changes, no matter how small, must be logged.
+Access to this log shall be restricted.
+</p>
+
+<p>
+All physical visits will be logged and a report provided by the accessor.
+</p>
+
+<h3> <a name="4.3">4.3. Backup </h3>
+
+<p>
+The procedure for all backups must be documented,
+according to the following sub-headings.
+</p>
+
+<h4> <a name="4.3.1">4.3.1. Type </h4>
+<p>
+Backups must be taken for operational
+and for disaster recovery purposes ("offline").
+Disaster recovery backups must be offline and remote.
+Operational backups may be online and local.
+</p>
+
+<h4> <a name="4.3.2">4.3.2. Frequency </h4>
+<p>Document.</p>
+
+<h4> <a name="4.3.3">4.3.3. Storage </h4>
+<p>
+Backups must be protected to the same level as the critical systems themselves.
+Offline backups should be distributed.
+</p>
+
+<h4> <a name="4.3.4">4.3.4. Retention period and Re-use </h4>
+<p>Document.</p>
+
+<h4> <a name="4.3.5">4.3.5. Encryption </h4>
+<p>
+Backups must be encrypted and must only be transmitted via secured channels.
+Off-site backups must be dual-encrypted using divergent methods.
+</p>
+
+<h4> <a name="4.3.6">4.3.6. Verifying Backups </h4>
+<p>
+Two CAcert system administrators must be
+present for verification of a backup.
+Four eyes principle must be maintained when the key and backup are together.
+For any other purpose than verification of the success of the backup, see next.
+</p>
+
+<h4> <a name="4.3.7">4.3.7. Key Management </h4>
+<p>
+The encryption keys must be stored securely by the
+CAcert systems administrators.
+Paper documentation must be stored with manual backups.
+</p>
+
+<h4> <a name="4.3.8">4.3.8. Reading Backups </h4>
+<p>
+Conditions and procedures for examining the backups for purposes
+other than for verification must be documented
+and must be under Arbitrator control.
+</p>
+
+<h3> <a name="4.4">4.4. Data retention </h3>
+
+<h4> <a name="4.4.1">4.4.1. User data </h4>
+
+<p>
+Termination of user data is under direction of the Arbitrator.
+See CCA.
+</p>
+
+<h4> <a name="4.4.2">4.4.2. System logs </h4>
+<p>Document.</p>
+
+<h4> <a name="4.4.3">4.4.3. Incident reports </h4>
+<p>
+The systems administration team leader is to maintain incident reports securely.
+Access to incident reports is restricted.
+</p>
+
+<h3> <a name="4.5">4.5. Cycling </h3>
+<p>Document.</p>
+
+
+
 <hr>
 <a href="http://validator.w3.org/check?uri=referer"><img src="Images/valid-html401-blue.png" id="graphics2" alt="Valid HTML 4.01" align="right" border="0" height="33" width="90"></a>
 <p>This is the end of the Security Policy.</p>