Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

Difference between revisions of "SPG:Drafts:Operations Policy"

From EGIWiki
Jump to navigation Jump to search
(Addressed comments from public review)
Line 17: Line 17:
'''Service Operations Security Policy'''
'''Service Operations Security Policy'''


By running a Service on the Infrastructure, by providing a service that is part of the Infrastructure, or retaining state that is related to the Infrastructure, either provided as an independent service or hosted in a Resource Centre, You agree to the conditions laid down in this document and other referenced documents, which may be revised from time to time.
By running a Service on the IT Infrastructure, by providing a service that is part of the IT Infrastructure, or retaining state that is related to the IT Infrastructure, either provided as an independent service or hosted in a Resource Centre, You agree to the conditions laid down in this document and other referenced documents, which may be revised from time to time.


# You shall provide and maintain accurate contact information to the Infrastructure and any Resource Centres involved, including but not limited to at least one Security Contact who shall respond to enquiries in a timely fashion.
# You shall provide and maintain accurate contact information to the Infrastructure Organisation and any Resource Centres involved, including but not limited to at least one Security Contact who shall respond to enquiries in a timely fashion.
# You shall comply with all security policies and procedures of the Infrastructure and any Resources Centres involved in operating Your service.  
# You shall comply with all security policies and procedures of the Infrastructure Organisation and of any Resources Centres involved in operating Your service.  
# You are held responsible by the Infrastructure and by any Resource Centres involved for the safe and secure operation of the Service. You shall not mislead Users regarding the suitability of a Service for their needs, nor mislead the Infrastructure or any Resource Centres involved about your Service. The Service shall not be detrimental to the Infrastructure and any Resource Centres involved.
# You are held responsible by the Infrastructure Organisation and by any Resource Centres involved for the safe and secure operation of the Service. You shall not mislead Users regarding the suitability of a Service for their needs, nor mislead the IT Infrastructure, Infrastructure Organisation, or any Resource Centres involved about your Service. The Service shall not be detrimental to the IT Infrastructure and any Resource Centres involved.
# You should follow IT security best practices that include pro-actively applying software patches, updates or configuration changes related to security. When notified by the Infrastructure or any Resource Centres involved of software patches, updates or configuration changes required for security, You shall apply these to your services within the specified time period.
# You should follow IT security best practices that include pro-actively applying software patches, updates or configuration changes related to security. When notified by the Infrastructure Organisation or any Resource Centres involved of software patches, updates or configuration changes required for security, You shall apply these to your services within the specified time period.
# You shall collect and retain sufficient auditing information as defined in the Tracability and Logging Policy and procedures, and must assist the Infrastructure and any Resource Centres involved in security incident response.
# You shall collect and retain sufficient auditing information as defined in the Tracability and Logging Policy and procedures, and must assist the Infrastructure Organisation and any Resource Centres involved in security incident response.
# You shall use logged information, including information provided to you by Users, other Resource Centres, Service operations or by the Infrastructure, only for administrative, operational, accounting, monitoring and security purposes. You shall apply due diligence in maintaining the confidentiality of logged information.
# You shall use logged information, including information provided to you by Users, other Resource Centres, Service operations or by the Infrastructure Organisation, only for administrative, operational, accounting, monitoring and security purposes. You shall apply due diligence in maintaining the confidentiality of logged information.
# Your provisioning of Services shall not in itself create any intellectual property rights in software, information and data provided to your Service or in data generated by your Service.
# Your provisioning of Services shall not in itself create any intellectual property rights in software, information and data provided to your Service or in data generated by your Service.
# Provisioning of Services is at your own risk. Any software provided by the Infrastructure is provided on an as-is basis only, and subject to its own license conditions. There is no guarantee that any procedure applied by the Infrastructure is correct or sufficient for any particular purpose. The Infrastructure and other Resource Centres are not liable for any loss or damage in connection with your participation in the Infrastructure.
# Provisioning of Services is at your own risk. Any software provided by the Infrastructure Organisation is provided on an as-is basis only, and subject to its own license conditions. There is no guarantee that any procedure applied by the Infrastructure Organisation is correct or sufficient for any particular purpose. The Infrastructure Organisation and other Resource Centres acting as service hosting providers are not liable for any loss or damage in connection with your participation in the IT Infrastructure.
# You may control access to Your Service for administrative, operational and security purposes and shall inform the affected users if you limit or suspend their access. You shall comply with all relevant incident response procedures regarding the notification of security incidents.
# You may control access to Your Service for administrative, operational and security purposes and shall inform the affected users if you limit or suspend their access. You shall comply with all relevant incident response procedures regarding the notification of security incidents.
# The Infrastructure and any Resources Centres involved may control your access to the Infrastructure or Resource Centres for administrative, operational and security purposes if you fail to comply with these conditions.
# The Infrastructure Organisation and any Resources Centres involved may control your access to the IT Infrastructure or Resource Centres for administrative, operational and security purposes if you fail to comply with these conditions.
# Disputes resulting from your participation in the Infrastructure will be resolved according to the Infrastructure escalation procedures.
# Disputes resulting from your participation in the IT Infrastructure will be resolved according to the Infrastructure Organisation escalation procedures.

Revision as of 10:44, 16 September 2011

Generalized Operations Policy

As a result of the January 2011 SPG meeting, there is an item to work on a re-write and generalization of the Site Operations Policy document (see https://www.egi.eu/indico/event/263):

Rewrite site operations policy as a general services security policy
a. Include service operation security policy (real and virtual)
b. Resource, providers, VM managers, etc
c. Exclude operations items to be considered by OMB

It is an evolution from the current version (https://documents.egi.eu/document/75).

This security policy is now being reviewed under EGI SPG "Phase 2 - External Review". The draft may be found at https://documents.egi.eu/document/669.

New Draft Text

Service Operations Security Policy

By running a Service on the IT Infrastructure, by providing a service that is part of the IT Infrastructure, or retaining state that is related to the IT Infrastructure, either provided as an independent service or hosted in a Resource Centre, You agree to the conditions laid down in this document and other referenced documents, which may be revised from time to time.

  1. You shall provide and maintain accurate contact information to the Infrastructure Organisation and any Resource Centres involved, including but not limited to at least one Security Contact who shall respond to enquiries in a timely fashion.
  2. You shall comply with all security policies and procedures of the Infrastructure Organisation and of any Resources Centres involved in operating Your service.
  3. You are held responsible by the Infrastructure Organisation and by any Resource Centres involved for the safe and secure operation of the Service. You shall not mislead Users regarding the suitability of a Service for their needs, nor mislead the IT Infrastructure, Infrastructure Organisation, or any Resource Centres involved about your Service. The Service shall not be detrimental to the IT Infrastructure and any Resource Centres involved.
  4. You should follow IT security best practices that include pro-actively applying software patches, updates or configuration changes related to security. When notified by the Infrastructure Organisation or any Resource Centres involved of software patches, updates or configuration changes required for security, You shall apply these to your services within the specified time period.
  5. You shall collect and retain sufficient auditing information as defined in the Tracability and Logging Policy and procedures, and must assist the Infrastructure Organisation and any Resource Centres involved in security incident response.
  6. You shall use logged information, including information provided to you by Users, other Resource Centres, Service operations or by the Infrastructure Organisation, only for administrative, operational, accounting, monitoring and security purposes. You shall apply due diligence in maintaining the confidentiality of logged information.
  7. Your provisioning of Services shall not in itself create any intellectual property rights in software, information and data provided to your Service or in data generated by your Service.
  8. Provisioning of Services is at your own risk. Any software provided by the Infrastructure Organisation is provided on an as-is basis only, and subject to its own license conditions. There is no guarantee that any procedure applied by the Infrastructure Organisation is correct or sufficient for any particular purpose. The Infrastructure Organisation and other Resource Centres acting as service hosting providers are not liable for any loss or damage in connection with your participation in the IT Infrastructure.
  9. You may control access to Your Service for administrative, operational and security purposes and shall inform the affected users if you limit or suspend their access. You shall comply with all relevant incident response procedures regarding the notification of security incidents.
  10. The Infrastructure Organisation and any Resources Centres involved may control your access to the IT Infrastructure or Resource Centres for administrative, operational and security purposes if you fail to comply with these conditions.
  11. Disputes resulting from your participation in the IT Infrastructure will be resolved according to the Infrastructure Organisation escalation procedures.