This policy, the IRIS Infrastructure Security Policy, is effective from 5th November 2020.
Introduction
To fulfil its mission, it is necessary for the IRIS Infrastructure to be protected from damage, disruption and unauthorised use. This document presents the policy regulating those activities of IRIS Participants related to the security of the IRIS Infrastructure.
Definitions
In this document the key words ‘must’, ‘must not’, ‘required’, ‘shall’, ‘shall not’, ‘should’, ‘should not’, ‘recommended’, ‘may’ and ‘optional’ are to be interpreted as described in RFC 2119.
IRIS Infrastructure
All of the IT hardware, software, networks, data, facilities, processes and any other elements that together are required to develop, test, deliver, monitor, control or support IRIS Services.
IRIS Management
The IRIS Delivery Board.
IRIS Participant
An entity providing, using, managing, operating, supporting or coordinating one or more IRIS services.
IRIS Service
An infrastructure component fulfilling a need of one or more IRIS Communities, such as computing, storage, networking or software systems.
IRIS Service Provider
An entity responsible for the management, deployment, operation and security of an IRIS Service.
IRIS Community
A group of individuals, referred to as members, organised with a common purpose and jointly granted access to the IRIS Infrastructure. An IRIS Community may act as the interface between individual members and the IRIS Infrastructure.
IRIS User
A member of an IRIS Community authorised to access and use IRIS Services.
IRIS Security Officer
An individual appointed by IRIS Management who is responsible for the operational security of the IRIS Infrastructure.
Objectives
To reduce the likelihood and impact of security incidents on the IRIS Infrastructure, its Participants and the wider research community, this policy gives authority for actions to be taken by designated individuals and organisations and places responsibilities on IRIS Participants.
Scope
This policy applies to all IRIS Participants.
This policy augments the local security policies of IRIS Service Providers by setting out additional requirements specific to the IRIS Infrastructure.
Approval and maintenance
This policy is approved by IRIS Management and thereby endorsed and adopted by the IRIS Infrastructure as a whole.
IRIS Management may delegate responsibility for the maintenance and revision of this document as required. Substantive revisions must be submitted to IRIS Management before adoption.
The most recently approved version of this document is available on the /security/IRIS security pages.
Responsibilities
Responsibilities of IRIS Management
IRIS Management provides, through the adoption of this policy and through its representation on the various management bodies of the IRIS Infrastructure, the overall authority for the decisions and actions resulting from this policy, including procedures for the resolution of disputes.
IRIS Management maintains the set of policies approved for use within the IRIS Infrastructure and ensures that IRIS Participants are aware of their roles and responsibilities.
IRIS Management must appoint the IRIS Security Officer.
Responsibilities of the IRIS Security Officer
The IRIS Security Officer coordinates the operational security capabilities of the IRIS Infrastructure, including enabling compliance with the Sirtfi framework.
The IRIS Security Officer may, in consultation with IRIS Management and other appropriate persons, require IRIS Participants to take actions deemed necessary to protect the IRIS Infrastructure from IT security incidents or to contain their spread.
The IRIS Security Officer handles requests for exceptions to this policy as described below.
The IRIS Security Officer is responsible for establishing and periodically testing a communications flow for use during security incidents.
The IRIS Security Officer may delegate responsibilities to designated individuals or groups as necessary to provide operational coverage.
Responsibilities of IRIS Service Providers
IRIS Service Providers must deploy security controls to protect the confidentiality, integrity and availability of their services.
Each IRIS Service Provider must designate a security contact to collaborate with the IRIS Security Officer and affected IRIS Participants in the handling of security incidents.
The security contact for an IRIS Service Provider shall promptly inform the IRIS Security Officer of any suspected or confirmed security incident that could affect IRIS.
Responsibilities of IRIS Users
IRIS Users must abide by the terms of the /security/IRIS Infrastructure Acceptable Use Policy and must collaborate in the timely reporting and resolution of security incidents affecting the IRIS Infrastructure.
Responsibilities of IRIS Communities
IRIS Communities must collaborate with the IRIS Security Officer to proactively limit the risk posed to IRIS through their use of the Infrastructure. This includes the reporting and resolution of suspected or confirmed security incidents and issues arising from Community members’ use of the Infrastructure.
IRIS Communities must manage the lifecycle of their members, including registration, renewal and removal, to ensure that membership is restricted to bona fide individuals.
IRIS Communities must ensure that all members are made aware of their responsibilities as stated in the IRIS Infrastructure Acceptable Use Policy.
Physical and network security
The requirements for the physical and network security of IRIS Services are expected to be adequately covered by each IRIS Service Provider’s local security policies and practices and by those of their underlying network providers.
To support specific IRIS Community workflows, it may be necessary to permit inbound or outbound network traffic. It is the responsibility of the relevant IRIS Service to accept or mitigate the risks associated with such traffic.
Exceptions to compliance
Wherever possible, IRIS Infrastructure policies and procedures are designed to apply uniformly to all IRIS Participants.
If this is not possible, for example because of legal or contractual obligations, exceptions may be made. Such exceptions should be time-limited and must be documented and submitted to the IRIS Infrastructure Security Officer for approval at the appropriate level of management.
In exceptional circumstances, it may be necessary for IRIS Participants to take emergency action in response to an unforeseen situation that may violate some aspect of this policy.
If such action is necessary, the exception should be minimised, documented, time-limited and authorised at the highest level of local management commensurate with taking the emergency action promptly.
Details of the action taken must be notified to the IRIS Security Officer at the earliest opportunity.
Sanctions
IRIS Service Providers that fail to comply with this policy in respect of a service they are operating may lose the right to have their services recognised by the IRIS Infrastructure until compliance has once more been satisfactorily demonstrated.
IRIS Communities that fail to comply with this policy may lose their members’ right of access to and collaboration with the IRIS Infrastructure. They may also lose the right to have their services recognised by the IRIS Infrastructure until compliance has once more been satisfactorily demonstrated.
IRIS Users who fail to comply with this policy may lose their right of access to the IRIS Infrastructure and may have their activities reported to their IRIS Community or home organisation.
Any activities thought to be illegal may be reported to the appropriate law enforcement agencies.
Further information and guidance
The current version of this policy and additional documents, together with guidance for implementing IRIS security policy, may be found on the /security/IRIS security pages.
References
- IRIS structure and Delivery Board
- RFC 2119: Key words for use in RFCs to indicate requirement levels
- /security/IRIS security policies and guidance
- Security Incident Response Trust Framework for Federated Identity
Licence and acknowledgements
This work, “IRIS Infrastructure Security Policy”, is a derivative of “Top Level Infrastructure Policy” from the AARC Policy Development Kit, owned by the authors and used under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International licence.
“IRIS Infrastructure Security Policy” is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International licence by the IRIS Policy Team on behalf of UKRI-STFC.
Other sources and acknowledgements include “EGI Top Level Security Policy”, used under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International licence.
The research leading to these results received funding from the European Community’s Horizon 2020 Programme under Grant Agreement No. 730941 (AARC2).
