pogpp/frostfs-crypto
1
0
Fork 0
forked from TrueCloudLab/frostfs-crypto
Code Pull requests Activity

Add SECURITY.md

Browse source 
Signed-off-by: Alex Vanin <a.vanin@yadro.com>
Signed-off-by: Pavel Pogodaev <p.pogodaev@yadro.com>
This commit is contained in:
Pavel Pogodaev 2024-08-28 13:54:02 +03:00
parent 0630205f67
commit f55052bb82
1 changed files with 52 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
SECURITY.md Normal file
View file

@ -0,0 +1,52 @@
# Security Policy
## Purpose
This document outlines the security policy for TrueCloudLab. It defines the principles, standards, and procedures to protect our information assets, systems, and data from unauthorized access, use, disclosure, modification, or destruction.
## Scope
This policy applies to all employees, contractors, vendors, and partners who have access to our systems and data. It covers physical, logical, and personnel security measures.
## Principles
**Confidentiality**: We protect sensitive information from unauthorized disclosure.
**Integrity**: We ensure the accuracy and completeness of our data.
**Availability**: We maintain the availability of our systems and services.
**Authentication**: We verify the identity of users before granting access.
**Authorization**: We control access based on user roles and permissions.
**Non-repudiation**: We provide evidence of actions taken by users.
**Auditability**: We log events for security monitoring and forensics.
**Compliance**: We comply with relevant laws, regulations, and standards.
**Incident Response**: We have a plan for responding to security incidents.
## Standards
**Encryption**: Sensitive data is encrypted at rest and in transit.
**Access Controls**: User accounts are protected with strong passwords.
**Network Security**: Firewalls, intrusion detection/prevention systems are used.
**Physical Security**: Data centers are secured with access controls.
**Vulnerability Management**: Regular scans and patching are performed.
**Backup and Recovery**: Data is backed up regularly and tested for recovery.
**Disaster Recovery**: A plan is in place for restoring operations after a disaster.
## Procedures
**Password Management**: Users must change passwords regularly.
**Security Awareness Training**: Employees receive training on security best practices.
**Incident Reporting**: Suspicious activity is reported to the security team.
**Risk Assessment**: Risks are identified and mitigated.
**Third-Party Security**: Vendors are screened for security risks.