Skip to content
Home > Partners > Security > IRIS Community Secur…

IRIS Community Security Policy

This policy, the IRIS Community Security Policy, is effective from 11th May 2023.

Introduction

The IRIS Infrastructure Security Policy defines an IRIS Community as “a group of individuals (members), organised with a common purpose, and jointly granted access to the IRIS Infrastructure”.

Access to IRIS resources is commonly authorised and facilitated through an individual’s membership of such a Community. To help protect those resources from damage or misuse, a Community has responsibilities for the way it manages its membership and behaves towards the Infrastructure.

By defining the relationship between a Community and the supporting Infrastructure, this policy aims to establish a sufficient level of trust to enable reliable and secure Infrastructure operation.

Support structures and procedures necessary to implement this policy should be created through collaboration between the Community and the Infrastructure.

Implementation guidance is provided in the references and notes below. This guidance may be updated from time to time and does not form part of the effective policy.

Definitions

Entities identified by a leading capital letter in this document are defined in the /wp-content/uploads/2021/02/IRIS-Infrastructure-Security-Policy.pdfIRIS Infrastructure Security Policy, with the IRIS prefix omitted for brevity.

Scope

This policy applies to every Community that makes use of the Infrastructure and to those who, on behalf of a Community, operate or manage services that interact with the Infrastructure.

Policy requirements

Each Community must:

  1. Agree with the Infrastructure a name that will uniquely identify the Community within the Infrastructure.
  2. Collaborate with others in reporting and resolving security events or incidents arising from the Community’s participation in the Infrastructure, and incidents affecting the Infrastructure as a whole.
  3. Actively manage its membership to restrict it to qualifying individuals.
  4. Define a Community Acceptable Use Policy (“AUP”) which, as a minimum:
    1. defines the science purposes, goals or aims of the Community;
    2. binds members of the Community, when acting as such, to use Infrastructure resources exclusively for those purposes; and
    3. does not conflict with the IRIS Acceptable Use Policy and Conditions of Use.
  5. Control, through policy, technical means or both, each member’s access to and use of resources allocated to the Community by the Infrastructure, so that only work within the scope of the Community AUP is carried out. In addition:
    1. the ability to trace the member’s actions on the Infrastructure must be preserved; and
    2. where policy is used without technical controls, the member must agree to be bound by the terms of the Infrastructure AUP.
  6. Promptly suspend an individual’s authorisation to use Infrastructure resources at the request of the Infrastructure Security Officer.
  7. Ensure that services managed by, or on behalf of, the Community are operated in accordance with the requirements of the IRIS Service Operations Security Policy.
  8. Honour the confidentiality requirements applying to operational information gained through the Community’s use of the Infrastructure.
  9. Define a Privacy Notice, or use other appropriate means, to provide all legally required information to members whose personal data is processed as a result of the Community’s use of the Infrastructure.
  10. Not hold Service Providers or other Infrastructure Participants responsible for loss or damage resulting from their members’ use of or participation in the Infrastructure, except to the extent specified by law or any licence or service level agreement.
  11. Review its compliance with this policy at least once each year, promptly inform the Infrastructure Security Officer of any non-compliance, and endeavour to correct violations in a timely manner.

Consequences of non-compliance

Communities that fail to comply with this policy may have their access to the Infrastructure restricted or suspended until compliance has once again been satisfactorily demonstrated.

References and implementation notes

Security for Collaborating Infrastructures

Many of the requirements in this document derive from the WISE Community Security for Collaborating Infrastructures Trust Framework.

Further information is available from the https://wise-community.org/sci/WISE Community SCI Framework.

Security incident response

Those organising a Community, particularly where Community-specific services are delegated to a third-party service operator, should be aware of the recommendations in the REFEDS Security Incident Response Trust Framework for Federated Identity.

A number of the requirements and recommendations in this policy align with that framework.

Community names

Communities should register globally unique names. This may be either:

  • a URN prefix persistently assigned to the Community; or
  • a fully qualified domain name assigned to the Community by the relevant naming authority through the global domain name system.

Community contacts

To assist with the resolution of operational issues, including security incident investigations, the Infrastructure will register Community contacts.

These contacts should be authorised to make management, security and operational decisions relating to:

  • the Community’s use of the Infrastructure; and
  • services operated by or on behalf of the Community that interact with the Infrastructure.

It is recommended that at least two individuals are identified to provide resilience, including one person who will act as the primary security contact.

Membership management

Community membership should be managed in a way appropriate to:

  • the scale and organisation of the Community;
  • the resources to which its members have access; and
  • relevant Infrastructure requirements.

Consideration should be given to the adequacy of processes covering the full membership lifecycle, including:

  • initial registration;
  • periodic renewal, where appropriate;
  • timely removal when membership ends; and
  • maintenance of accurate contact information.

Suspension of a member’s access may be required as a precaution during an ongoing security investigation.

Community Acceptable Use Policy

Through explicit agreement to the terms and conditions of an AUP, Community members are made aware of their responsibilities and the expectations relating to appropriate behaviour.

Members must agree to abide by the Community AUP when they first register. This agreement must subsequently be renewed in accordance with the requirements of the Community and the Infrastructure.

A layered approach, in which the Community AUP refers to the Infrastructure AUP, is acceptable. A template Community AUP is provided below.

Where the Community AUP does not refer to the Infrastructure AUP, it is recommended that it is based on the https://wise-community.org/wise-baseline-aup/WISE Baseline Acceptable Use Policy.

Resource usage controls

Access to resources may be limited through technical controls, policy controls or a combination of both.

Implementation of these controls may be a shared responsibility between the Community, the Infrastructure and any third party providing services such as:

  • membership management;
  • authentication; or
  • other access-control facilities.

The division of responsibilities should be clearly understood and agreed before use of the service begins.

Technical controls

Technical controls limit the processing capabilities available to a user through the design of the system used to access a resource.

The system must be operated in a way that satisfies the security requirements of the Infrastructure, including requirements for retaining logs for use during a security incident.

Where a Community uses a service operated by the Infrastructure or another third party, responsibility for meeting these requirements may need to be shared with the service operator. This could include maintaining the traceability of user actions through a job submission service.

For example, a Community member may access resources through a Community-operated portal, workflow manager or job-submission interface. The member has a Community-managed account that enables them to construct workflows or jobs for submission to remote resources.

The user does not have an account on the target resources. The operations and datastores available to the user are restricted to those made available by the portal administrators.

The portal administrators must be able to trace all jobs submitted to the Infrastructure back to the identity of the originating users, using system logs or other appropriate records.

Policy controls

Under policy controls, a user agrees to be bound by the conditions of a usage agreement governing access to Infrastructure resources.

For example, a user may have an account on a resource that could technically enable arbitrary work to be performed, but the user agrees to use it only for work related to the Community’s objectives. Appropriate sanctions should be available if the agreement is broken.

Policy controls will typically apply to Community managers who implement technical controls for Community members, such as the administrators of a Community portal.

Confidential operational information

Information may be exchanged as part of normal operations or during a security incident investigation. This may include:

  • names and contact information;
  • email addresses and telephone numbers;
  • network addresses;
  • associated configuration information;
  • non-public security or CSIRT contact information; and
  • threat intelligence.

Any obligations restricting the sharing or publication of such information must be honoured.

Data protection and privacy

Community management must familiarise itself with applicable local data-protection legislation, including UK GDPR and the Data Protection Act 2018 where relevant.

These requirements may apply to the processing of personal data during registration and the ongoing management of the Community membership lifecycle.

Compliance measures may include:

  • providing members with a Privacy Notice; and
  • maintaining a policy covering the processing of personal data.

Where membership registration and lifecycle management are delegated to the Infrastructure or another service provider, that operator would be expected to fulfil relevant technical requirements, such as displaying privacy notices and protecting data.

However, the Community may remain responsible as the data controller.

Relevant sources of guidance include:

  • https://aarc-community.org/guidelines/aarc-g042/AARC-G042: Guidelines for Community Membership Management;
  • https://aarc-community.org/policies/policy-development-kit/AARC Policy Development Kit;
  • https://refeds.org/category/data-protection/REFEDS Data Protection Code of Conduct; and
  • https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/transparency-and-individual-rights/transparency/privacy-information-what-you-need-to-provide/Information Commissioner’s Office guidance on privacy information.

Appendix 1: Template Community Acceptable Use Policy

Clause 3 should be omitted if there are no additional Community-specific conditions.

<Insert Community name> Acceptable Use Policy and Conditions of Use

This policy, the <insert Community name> Acceptable Use Policy and Conditions of Use <insert version as v.0x>, is effective from <insert date>.

The currently effective version of this policy is available at <insert URL>.

This Acceptable Use Policy and Conditions of Use (“AUP”) defines the rules governing your access to and use, including the transmission, processing and storage of data, of the resources and services (“Services”) enabled by your membership of the <insert Community name>.

The Services are provided for the purpose of <insert objectives or purposes of the Community>.

  1. You shall only use the Services in a manner consistent with the purposes and limitations described above.
  2. You shall comply with the limitations and conditions of use set out in the IRIS Acceptable Use Policy and Conditions of Use, reproduced below and available in its current form on the IRIS security pages.
  3. <Insert additional Community-specific clauses.>

The administrative contact for this AUP is: <insert email address>

The security contact for this AUP is: <insert email address>

The privacy statements, including relevant Privacy Notices, are located at: <insert URL>

<Insert the text of the IRIS Acceptable Use Policy and Conditions of Use>

Licence and acknowledgements

This work, “IRIS Community Security Policy”, is a derivative of “Membership Management Policy” from the AARC Policy Development Kit, owned by the authors and used under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International licence.

“IRIS Community Security Policy” is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International licence by the IRIS Policy Team on behalf of UKRI-STFC.

Other sources and acknowledgements include “EGI Community Membership Management Policy” and “EGI Community Operations Security Policy”, used under the Creative Commons Attribution 4.0 International licence.

The research leading to these results received funding from the European Community’s Horizon 2020 Programme under Grant Agreement No. 730941 (AARC2).

Team member