- Created by Baptiste Grenier on 2022 Apr 15
As an HTC Provider, the following Policies and Procedures are relevant to you.
Policies
| Title | Approval status | Owner | Statement |
|---|---|---|---|
| Grid Policy on the Handling of User-Level Job Accounting | APPROVED | This document presents the minimum requirements and policy framework for the handling of user-level accounting data created, stored, transmitted, processed and analysed as a result of the execution of jobs on the Grid. | |
| Security Policy Glossary of Terms | APPROVED | This document provides a common reference for the meaning of various terms used in the context of the EGI Security Policy Group documents. As well as defining terms, this glossary also limits the scope of meaning of terms used in the security policy documents. | |
| Policy on e-infrastructure Multi-User Pilot Jobs | APPROVED | Security policy for operation of multi-user pilot jobs. | |
| Policy on the Processing of Personal Data | APPROVED | David Kelsey | This policy ensures that data collected as a result of the use of the Infrastructure is processed fairly and lawfully by Infrastructure participants. |
| Security Incident Response Policy | APPROVED | Policy on handling security incidents. | |
| Policy on Acceptable Authentication Assurance | APPROVED | This policy defines the approved authentication assurance sources. | |
| Security Traceability and Logging Policy | APPROVED | Security policy requirements for traceability and logging. | |
| Service Operations Security Policy | APPROVED | This security policy presents the conditions that apply to anyone running a Service on the Infrastructure, or to anyone providing a Service that is part of the Infrastructure. | |
| e-infrastructure Security Policy | APPROVED | David Kelsey | Policy regulating those activities of e-Infrastructure participants related to the security of e-Infrastructure services and resources. |
Procedures
| Title | Approval status | Owner | Statement |
|---|---|---|---|
| PROC09 Resource Centre Registration and Certification | APPROVED | Alessandro Paolini | A procedure describing the steps for registering and certifying new Resource Centres (sites) in the EGI infrastructure. The certification steps can also be used to re-certify suspended Resource Centres (sites). |
| SEC01 EGI CSIRT Security Incident Handling Procedure | APPROVED | Computing Security Incident Response Team (CSIRT) | This procedure is aimed at minimising the impact of security incidents by encouraging post-mortem analysis and promoting cooperation between Resource Centres. |
| PROC19 Integration of new cloud management framework or middleware stack in the EGI Infrastructure | APPROVED | Alessandro Paolini | A procedure for integrating new cloud management framework (Cloud platform) or middleware (Compute, Storage, etc.) in the EGI Production Infrastructure. |
| SEC02 Software Vulnerability Issue Handling | APPROVED | The purpose of the EGI Software Vulnerability group is "To minimize the risk of security incidents due to software vulnerabilities" This document describes how Software vulnerabilities reported are handled. | |
| PROC21 Resource Centre suspension | APPROVED | Alessandro Paolini | The document describes the process for suspending a Resource Centre in the EGI infrastructure |
| SEC05 Security Resource Centre Certification Procedure | APPROVED | Computing Security Incident Response Team (CSIRT) | Security Resource Centre Certification Procedure applies to Resource Centres under certification process and re-certification of suspended Resource Centres (sites). This step of the security certification procedure checks that the resources under certification do not contain known CRITICAL software vulnerabilities. |
| WI07 Security Vulnerability handling | APPROVED | Computing Security Incident Response Team (CSIRT) | Work instruction to follow Security Vulnerability handling RT tickets |
| SEC03 EGI-CSIRT Critical Vulnerability Handling | APPROVED | EGI-CSIRT | The scope of this procedure is to maintain a properly patched infrastructure and make sure that CRITICAL Vulnerabilities are handled adequately by all involved entities. |
| SEC04 EGI CSIRT Operational Procedure for Compromised Certificates and Central Security Emergency suspension | APPROVAL REQUIRED | Computing Security Incident Response Team (CSIRT) | This procedure describes what should be done by the EGI CSIRT in the event of a compromised identity certificate, including long lived certificates and proxies. This applies to robot certificates and service certificates as well as user certificates. This also includes what is done when certificates are linked to security incidents. This procedure also addresses usage of Central Security Emergency suspension. The implications of a CA compromise are also briefly described. |
| PROC15 Resource Center renaming | APPROVED | Alessandro Paolini | A procedure for changing name of a Resource Centre. |
| PROC11 Resource Centre Decommissioning | APPROVED | Matthew Viljoen | A procedure describing the steps to decommission Resource Centres in the EGI infrastructure. |
| PROC12 Production Service Decommissioning | APPROVED | Matthew Viljoen | A procedure describing the steps to decommission a Service operated by a Resource Centre in the EGI infrastructure |
| PROC16 Decommissioning of unsupported software | APPROVED | Alessandro Paolini | A procedure for removal of unsupported software from production infrastructure |
| PROC10 Recomputation of SAM results or availability reliability statistics | APPROVED | Alessandro Paolini | This procedure documents the steps for requesting a correction in the SAM test results and in the related availability/reliability statistics. |
- No labels