From cac52d9c3b21357433bec5856b7542a3d9416175 Mon Sep 17 00:00:00 2001
From: Ian Grigg
Status: work-in-progress
@@ -105,7 +105,7 @@ Important principles of this Security Policy are:
+Primary systems administration tasks shall be conducted under four eyes principle. +These shall include +backup performance verification, +log inspection, +software patch identification and application, +account creation and deletion, +and hardware maintenance. +
+ ++System administrators must pass a background check and comply with all applicable policies in force. +
+ ++Access to Accounts (root and user via SSH or console) must be strictly controlled. +Passwords and passphrases entered into the systems will be kept private +to CAcert sysadmins in all cases. +
+ ++Only system administrators designated on the Access List +shall be authorized to access accounts. +
+ +Assumes above that there is no reason to have access +to a Unix-level account on the critical machines unless on the Access List.
+ ++All remote communications for systems administration purposes is encrypted, +logged and monitored. +
+ ++Passwords must be kept secure. +The procedure for changing passwords should be documented. +
+ ++Response times should be documented. +
+ ++All changes made to system configuration must be recorded. +
+ ++Logs shall be maintained for: +
+ ++Access to logs must be restricted. +The security of the logs should be documented. +The records retention should be documented. +
+ ++Logging should be automated, +and use should be made of appropriate system-provided automated tools. +Automated logs should be reviewed periodically; +suspicious events should be flagged and investigated in a timely fashion. +
+ ++Configuration changes, no matter how small, must be logged. +Access to this log shall be restricted. +
+ ++All physical visits will be logged and a report provided by the accessor. +
+ ++The procedure for all backups must be documented, +according to the following sub-headings. +
+ ++Backups must be taken for operational +and for disaster recovery purposes ("offline"). +Disaster recovery backups must be offline and remote. +Operational backups may be online and local. +
+ +Document.
+ ++Backups must be protected to the same level as the critical systems themselves. +Offline backups should be distributed. +
+ +Document.
+ ++Backups must be encrypted and must only be transmitted via secured channels. +Off-site backups must be dual-encrypted using divergent methods. +
+ ++Two CAcert system administrators must be +present for verification of a backup. +Four eyes principle must be maintained when the key and backup are together. +For any other purpose than verification of the success of the backup, see next. +
+ ++The encryption keys must be stored securely by the +CAcert systems administrators. +Paper documentation must be stored with manual backups. +
+ ++Conditions and procedures for examining the backups for purposes +other than for verification must be documented +and must be under Arbitrator control. +
+ ++Termination of user data is under direction of the Arbitrator. +See CCA. +
+ +Document.
+ ++The systems administration team leader is to maintain incident reports securely. +Access to incident reports is restricted. +
+ +Document.
+ + +This is the end of the Security Policy.