View source for SPG:Drafts:Security Policy

[[Category:Security Policy_Group (SPG)]]
{{TOC_right}}
= The *new draft* e-Infrastructure Security Policy =

This is a DRAFT document being revised by EGI SPG. It is not final and has not been approved or adopted.
The currently adopted top-level security policy document is available at [https://documents.egi.eu/document/86 https://documents.egi.eu/document/86].

This policy is one of a set of documents that together define the Security Policy [RefXX]. This individual document must be considered in conjunction with all the policy documents in the set. 

= Introduction and Definitions =
To fulfil its mission, it is necessary for the ''e-Infrastructure'' to protect its assets. This document presents the policy regulating those activities of ''participants'' related to the security of the ''e-Infrastructure''.

== Definitions ==

Note:  Replace by reference to Glossary and only add additional terms or meanings.


The phrase ''e-Infrastructure'' when italicised in this document, means all of the people and organisations, hardware, software, networks, facilities, etc. that are required to develop, test, deliver, monitor, control or support IT Services. 

The other italicised words used in this document are defined as follows:
 
*''Policy'' is interpreted to include rules, responsibilities and procedures specified in this document together with all those in other documents which are required to exist by stipulations in this document. 
*A ''participant ''is any entity providing, using, managing, operating, supporting or coordinating one or more IT ''service(s)''. 
*A ''service ''is any computing or software system, which provides access to, information about or controls ''resources''.
*A ''resource'' is the ''equipment'' and ''software'' required to run a ''service ''on the ''e-Infrastructure'', and any ''data'' held on the ''service''. 
*Included in the definition of ''equipment'' are processors and associated disks, tapes and other peripherals, storage systems and storage media, networking components and interconnecting media. 
*Included in the definition of ''software'' are operating systems, utilities, compilers and other general purpose applications, any software required to operate any ''equipment'', software and middleware released and/or distributed by the ''e-Infrastructure'' and any software required to support any application associated with ''User Communities'' or other authorised ''users''. 
*Included in the definition of ''data'' are data required to operate any equipment defined as a ''resource'', data required to operate any ''service'', data intended to be processed or produced by any software defined as a ''resource'', and any application data. 
*''The Management'' is the collection of the various boards, committees, groups and individuals mandated to oversee and control the ''e-Infrastructure''. 
*A ''user'' is an individual who has been given authority to access and use e-Infrastructure ''resources''.
*A ''User Community'' is a grouping of ''users ''and optionally ''resources'', usually not bound to a single institution, who, by reason of their common membership and in sharing a common goal, are given authority to use a set of ''resources''.
*Included in the definition of a ''User Community'' are cases where ''resources'' are offered to individual ''users'' who are not members of an explicitly organised ''User Community''.
*''The User Community management'' is the collection of various individuals and groups mandated to oversee and control a ''User Community''.	
*A ''Resource Centre'' is an entity having administrative control of ''resources'' provided to the ''e-Infrastructure''. This may be at one physical location or spread across multiple physical locations.
*''Resource Centre management'' is the collection of various individuals and groups mandated to oversee and control a ''Resource Centre''.
*A ''resource administrator'' is the person responsible for installing, operating, maintaining and supporting one or more ''resource(s)'' at a ''resource centre''.

== Objectives ==
This ''policy'' gives authority for actions which may be carried out by certain people and organisations and places responsibilities on all ''participants''.

== Scope ==
This ''policy'' applies to all ''participants''.
Every ''Resource Centre'' participating in the ''e-Infrastructure'' autonomously follows their local policies with respect to the ''services'' and ''resources'' they own, including those which are part of the ''e-Infrastructure''. This ''policy'' augments local policies by setting out additional ''e-Infrastructure''-specific requirements.

== Additional Policy Documents ==
Additional policy documents required for a proper implementation of this ''policy'' may be found at a location specific to the ''e-Infrastructure'' (Ref).

== Approval and Maintenance ==
This ''policy'' is prepared and maintained by the Security Policy Group, approved by ''management'' and thereby endorsed and adopted by the ''e-Infrastructure'' as a whole. This ''policy'' will be revised by the Security Policy Group as required and resubmitted for formal approval and adoption whenever significant changes are needed. 
The most recently approved version of this document is available at (Ref).

= Roles and Responsibilities =
This section defines the roles and responsibilities of ''participants''.

== The Management ==
The ''Management'' provides, through the adoption of this ''policy'' and through its representations on the various management bodies of the ''e-Infrastructure'', the overall authority for the decisions and actions resulting from this ''policy'' including procedures for the resolution of disputes.

The ''Management'' provides the capabilities for meeting its responsibilities with respect to this policy. 

The ''Management'' is responsible for ensuring compliance of its participants and can represent them towards third parties with respect to this ''policy''.

== The e-Infrastructure Security Officer and the CSIRT ==
The ''Management'' must appoint a Security Officer who leads and coordinates the operational security capability (CSIRT).
The Security Officer may, in consultation with the CSIRT, ''Management'' and other appropriate persons, require actions by ''participants'' as are deemed necessary to protect the ''e-Infrastructure'' from or contain the spread of IT security incidents. The Security Officer also handles requests for exceptions to this ''policy'' as described in section (Ref).

== User Community Management ==
The ''User Community Management'' must designate a Security contact point (person or team) that is willing and able to collaborate with affected ''participants'' in the management of security incidents. 

The ''User Community management'' should abide by the "e-Infrastructure" policies in the areas of Acceptable Use, User Registration and Membership Management. Exceptions to this must be handled as an Exception to Compliance (Ref).

They must ensure that only individuals who have agreed to abide by the ''e-Infrastructure'' AUP [Ref] and the User Community AUP are registered as members of the ''User Community''.

''User Community Management'' and ''users'' that provide and/or operate resources or services must abide by the Service Operations Policy [Ref], the Traceability and Logging Policy [Ref] and all other applicable policies.

For services requiring authentication of entities the ''User Community Management'' must abide by the policy on Acceptable Authentication Assurance  [Ref]. 

''User Community Management'' is responsible for promptly investigating reports of ''users'' failing to comply with the policies and for taking appropriate action to limit the risk to the ''e-Infrastructure'' and ensure compliance in the future, as defined in section X.

== Users ==
''Users'' must accept and agree to abide by the ''e-Infrastructure'' Acceptable Use Policy [Ref] and the User Community AUP when they register or renew their registration with a ''User Community''. 

''Users'' must use services and resources only in pursuit of the legitimate purposes of their ''User Community''. They must respect the autonomy and privacy of the host ''resource centres'' on whose ''resources'' it may run. They must not attempt to circumvent any restrictions on access to ''resources'' and ''services''. ''Users'' must show responsibility, consideration and respect towards other ''participants'' in the demands they place on the ''e-Infrastructure''.

''Users'' that provide and/or operate ''resources'' or ''services'' must abide by the Service Operations Policy [Ref] and all other applicable policies.

For services requiring authentication of entities the ''Users'' must abide by the policy on Acceptable Authentication Assurance  [Ref]. 

''Users'' may be held responsible for all actions taken using their credentials, whether carried out personally or not. No intentional sharing of user credentials is permitted.

== Resource Centre Management ==

The ''Resource Centre Management'' must designate a Security contact point (person or team) that is willing and able to collaborate with affected ''participants'' in the management of security incidents and to take prompt action as necessary to safeguard ''services'' and ''resources'' during an incident.

''Resource Centres'' must abide by the Service Operations Policy [Ref], the Traceability and Logging Policy [Ref] and all other applicable policies.

''Resource Centres'' acknowledge that participating in the ''e-Infrastructure'' increases their IT security risk. ''Resource Centres'' are responsible for accepting or mitigating this risk.

''Resource Centres'' must deploy effective security controls to protect the confidentiality, integrity and availability of their ''services'' and "resources".

For services requiring authentication of entities the ''Resource Centre'' must abide by the policy on Acceptable Authentication Assurance  [Ref].

== Resource Centre Administrators ==
In addition to their local organisation policy, ''resource centre administrators'' must ensure their implementations of ''services'' comply with this ''policy''. The responsibilities of ''resource centre administrators'' also include:
=== Notifying Site Personnel ===
''Resource administrators'' are responsible for ensuring that all appropriate personnel concerned with security or system management at their site are notified of and accept the requirements of this ''policy'' before offering any ''services''.
=== Resource Administration ===
The ''resource administrators'' are responsible for the ongoing security and integrity of their ''services''.

= Physical Security =
All the requirements for the physical security of ''resources'' are expected to be adequately covered by each ''resource centre’s'' local security policies and practices. These should, as a minimum, reduce the risks from intruders, fire, flood, power failure, equipment failure and environmental hazards. Stronger physical security may be required for equipment used to provide certain critical ''services'' such as VO membership services or credential repositories. The technical details of such additional requirements are contained in the procedures for operating and approving such ''services''.

= Network Security =
All the requirements for the networking security of ''resources'' are expected to be adequately covered by each ''resource centre’s'' local security policies and practices. These should, as a minimum, reduce the risks from intruders and failures of hardware or software by implementing appropriate firewall protection, by the timely application of all critical security-related software patches and updates, and by maintaining and observing clearly defined incident response procedures. 
It is ''IT Infrastructure ''policy to minimise the security risk exposed by applications which need to communicate across the Internet; even so, the peripheral firewall on every participating ''resource centre ''may be required to permit the transit of inbound and outbound packets to/from certain port numbers between a number of external and internal hosts in order to run or reach ''services''.

= Exceptions to Compliance =

Wherever possible, ''e-Infrastructure'' policies and procedures are designed to apply uniformly to all ''participants''. If this is not possible, for example due to legal or contractual obligations, exceptions may be made. Such exceptions should be time-limited and must be documented and authorised by the Security Officer and, if required, approved at the appropriate level of management.

In exceptional circumstances it may be necessary for ''participants'' to take emergency action in response to some unforeseen situation which may violate some aspect of this ''policy'' for the greater good of pursuing or preserving legitimate ''e-Infrastructure'' objectives. If such a ''policy'' violation is necessary, the exception should be minimised, documented, time-limited and authorised at the highest level of the ''management'' commensurate with taking the emergency action promptly, and the details notified to the Security Officer at the earliest opportunity.

= Sanctions =
''Resource Infrastructure Providers - need a para''

''resource centres'' or ''resource administrators'' who fail to comply with this ''policy'' in respect of a ''service'' they are operating may lose the right to have that service instance recognised by the ''IT Infrastructure'' until compliance has been satisfactorily demonstrated again.
''Users'' who fail to comply with this ''policy'' may lose their right of access to and/or collaboration with the ''IT Infrastructure'', and may have their activities reported to their home institute or, if those activities are thought to be illegal, to appropriate law enforcement agencies.
''VOs'' which fail to comply with this ''policy''','''''together with all the ''users'' whose rights with respect to the ''IT Infrastructure'' derives from that ''VO'', may lose their right of access to and/or collaboration with the ''IT Infrastructure''.
The issues of liability, dispute resolution and intellectual property rights, all of which may be ''IT Infrastructure''-specific, should be addressed in the additional policy documents.(We propose to delete this sentence) 

= Appendix 1: Additional Policy Documents =

Delete this appendix

The current list of additional policy documents describing procedures, rules and other technical details required to implement this ''policy'' are presented here.
The current versions may always be found in the EGI document database at [https://documents.egi.eu/public/DocumentDatabe EGI Document Database]
An accompanying document for each ''IT Infrastructure'' adopting this ''policy'' must define the ''IT Infrastructure-''specific locations and version numbers of their approved and adopted additional policy documents

The additional policy documents with their web links are as follows:

[1] [https://documents.egi.eu/document/74 Grid Acceptable Use Policy]

[2] [https://documents.egi.eu/document/78 Virtual Organisation Registration Security Policy]

[3] [https://documents.egi.eu/document/75 Grid Site Operations Policy]

[4] [https://documents.egi.eu/document/83 Approval of Certification Authorities]

[5] [https://documents.egi.eu/document/81 Grid Security Traceability and Logging Policy]

[6] [https://documents.egi.eu/document/82 Security Incident Response Policy]

[7] [https://documents.egi.eu/document/76 Site Registration Security Policy]

[8] [https://documents.egi.eu/document/79 Virtual Organisation Membership Management Policy]

[9] [https://documents.egi.eu/document/77 Virtual Organisation Operations Policy]

[10] [https://documents.egi.eu/document/80 VO Portal Policy]

[11] [https://documents.egi.eu/document/84 Policy on Grid Multi User Pilot Jobs]

[12] [https://documents.egi.eu/document/85 Grid Policy on the Handling of User-Level Job Accounting Data]

[13] [https://documents.egi.eu/document/71 Security Policy Glossary of Terms]