CSI Security Policy
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Greetings.
Kevin asked me to take a look at the CSI Security Policy (I believe it was recently
tweaked). I have a few questions that I'd like to ask in
+hopes that I will learn and maybe we'll add some more good information to the
policy.
First, in section 2.2 the policy discusses host general security. All of this information
relates specifically to IPv4 settings. Now I don't
+have a good enough understanding of all the possibilities in sysctl but I know that
ip6tables can be similarly configured for IPv6 networks.
+Now it should be said that if you don't have IPv6 deployed that all IPv6 paths should
be shut down and tools turned off to avoid utilizing
+anything that may open up a path, unexpectantly, into the system. But if you are
utilizing IPv6 we shouldn't forget about these paths and
+should harden our systems against their misuse. Perhaps someone could help me with the
sysctl stuff?
Next, in the incident response I see there are great plans for safeguarding the evidence
after an incident has occurred. I would like to
+caution that one person's way of obtaining the information is not the next
person's way of doing so. I'd like to see specific commands to be
+run, that the drive is mounted as read-only while obtaining the images, and what
safeguarding needs to occur with these images and what the
+procedure is, for the hard drive, once an image has been obtained.
Also, should we talk about remote authentication methods that should be used (ssh keys
(RSA or DSA)(bit strength), encryption standards to be
+used while transmitting data, what data should be stored encrypted and how should that be
done, etc. I know how we (Fedora) does it now but
+others that might look at this guide for... guidance... would probably want to know this
information. My thought is that we should document
+stuff that we are doing now even if it seems common sense.
This is really some good stuff in that guide and I'd like to see even more technical
information and technical explaination so we can continue
+to be leaders in how things should be done in FLOSS community.
- --Eric
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBAgAGBQJOinnVAAoJEIB2q94CS7PRquAQANaqQaCnU5RymhqauCq0p5nF
xfrJR1WQbh0AigxBhBCh0HxmPToOLoBINvv57Emg23D7bkh/gMWzpPVzuIzPCrrh
tIbEMHnXyNuhsSWYpBJakRHXEsAtwZZlZeSaxwtV/RM6egygphnO5lcYu/ckiUbx
HYuVL9lPhxiytiH3vs+a3cG79TuB/XocIM+4xv743sTxY0CrbKcwXZwX7xWcLGvo
PZrKkcf+4uOAUdZWXq2z5AE1acaTrXjHzaTrQPpordDC58ynDR07GvEoD0QQfk8B
hz6TQR/BFyhuWPwkY9/lO3JiIlH5QuzAxYQeSz6IJZwgmPAC94Hbg+QbG7BoxkIV
9YZ4AXo3IMw20zATZElGxNcUQ9TrocRgyauLkYRPv6V1FygU+NI6hW02Ta8QtdX+
06Vq+wCT6OV8m+1H18Adx2mPxHzw1jLiJKYZd5Yyh1WOjBMOLM7yJxq8i5TzRvqV
IdJL0HLmS5QeNQC4+nbzQkhfW7f5LMx6/sn8W05TH8zsd0HzOGVn3bpeQPhgSTZK
SCRxPBHb9BNTpDtOg70nMW/gQgftdvDlsiOyfkpIxDadzigpRMoYeuT4ML2zmCia
TDLWJe6ESSbAnJ7JsPnVPHR6fyytYHMaMEZLrF2Va1vHc6ZbGjd2qCtdwzgGKv96
MI6TOM9DzXiqZTKrs1/k
=JBZT
-----END PGP SIGNATURE-----