This policy, the IRIS Service Operations Security Policy, is effective from 20th May 2021. It defines the security expectations placed on organisations and individuals operating services within the IRIS Infrastructure. 【1-95ebc1】
Introduction
To fulfil its mission, it is necessary for the IRIS Infrastructure to be protected from damage, disruption and unauthorised use.
By defining expectations of the behaviour of those offering services to communities using the Infrastructure, and of the operators of supporting Infrastructure services, this policy aims to establish a sufficient level of trust between all participants to enable reliable and secure Infrastructure operation.
Support structures and procedures necessary for implementing this policy should be created through collaboration between service and Infrastructure management.
Additional information that may assist with implementation of this policy is provided in the references section below. 【1-95ebc1】
Definitions
Entities identified by a leading capital letter in this document are defined in the IRIS Infrastructure Security Policy, omitting the IRIS prefix for brevity. 【1-95ebc1】
Scope
This policy applies to all IRIS Service Providers, including those managing, deploying, operating and securing services on behalf of the Infrastructure as a whole. 【1-95ebc1】
Policy requirements
Each Service Provider must:
- Collaborate with others in the reporting and resolution of security events or incidents arising from their Service’s participation in the Infrastructure and those affecting the Infrastructure as a whole.
- Ensure that their Service operates in a manner which is not detrimental to the Infrastructure or any of its Participants.
- Follow, as a minimum, recognised IT security best practice, including proactively applying security updates, responding appropriately to vulnerability notifications, and participating in exercises that test Infrastructure-wide resilience.
- Respect the confidentiality of information gained as a result of their Service’s participation in the Infrastructure.
- Respect the legal rights of Infrastructure users and others with regard to personal data, and only use such data for administrative, operational, accounting, monitoring or security purposes.
- Not hold users or other Infrastructure participants responsible for loss or damage arising from the provision or use of their Service, except where specified by law, licence conditions or service level agreements.
- Promptly inform users and affected parties if action is taken to control access to a Service for administrative, operational or security reasons.
- Retain sufficient system-generated information, including logs, protected from unauthorised access or modification and, where possible, aggregated centrally, for a minimum period of 90 days to support investigation of security incidents.
- Continue to meet the obligations specified above for 90 days after a Service is retired, including retention of logs following the decommissioning of physical or virtual infrastructure.
- Promptly inform the Infrastructure Security Officer of any non-compliance with this policy.
【1-95ebc1】
Consequences of non-compliance
Service Providers that fail to comply with this policy may lose the right to have their services recognised by the Infrastructure until compliance has once again been satisfactorily demonstrated. 【1-95ebc1】
References and guidance
Security for Collaborating Infrastructures (SCI)
Many of the requirements in this document derive from the WISE Community Security for Collaborating Infrastructures Trust Framework.
IRIS Security Policies
Additional IRIS security policies and guidance are available at:
REFEDS SIRTFI
Service Providers should support the Security Incident Response Trust Framework for Federated Identity (SIRTFI), which includes maintaining contact information for security incident response.
Incident Response Procedures
Effective incident response relies on participants agreeing procedures in advance. Guidance is available from IRIS and EGI.
Security Best Practice Resources
TrustedCI provides a range of resources relevant to research computing environments.
TrustedCI Cloud Service Provider Security Best Practices
National Cyber Security Centre Guidance
The UK National Cyber Security Centre provides guidance on access control, configuration management, logging, vulnerabilities and other security topics.
Information Security Frameworks
The ISO 27000 series and the NIST Cyber Security Framework are recognised resources for implementing information security management systems.
Data Protection Guidance
Guidance on the rights of individuals and data protection obligations is available from the UK Information Commissioner’s Office.
AARC Policy Guidance
The AARC project provides guidance relating to the handling of personal data by infrastructure operators.
Logging Guidance
Recommendations on logging for security purposes are available from the UK National Cyber Security Centre.
Licence and acknowledgements
This work, “IRIS Service Operations Security Policy”, is a derivative of “Service Operations Security Policy” from the AARC Policy Development Kit, used under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 licence.
“IRIS Service Operations Security Policy” is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 licence by the IRIS Policy Team on behalf of UKRI-STFC.
Other sources and acknowledgements include “EGI Service Operations Security Policy”, used under the Creative Commons Attribution-NonCommercial-ShareAlike licence.
The research leading to these results received funding from the European Community’s Horizon 2020 Programme under Grant Agreement No. 730941 (AARC2). 【1-95ebc1】
