Technical Division Policies - Minimum Security Standards¶

§1. Definition of Terms¶

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in the IETF’s RFC 2119, excluding the changes made in RFC 8174 (both UPPERCASE and lowercase usage of the key words have the defined special meanings).

Epoch Bylaws - Title 2, Chapter 1

This document is intended to outline the minimum security policies that should be implemented with Epoch sensitive data and systems.

Any of the minimum security standard policies may be waived jointly by the Epoch Technical Division, provided that:

There is a supermajority vote among the leaders of the Epoch Technical Division to waive the policy.
There is a legitimate operational need to waive the policy.
There is a legitimate operational reason that the policy must be waived (there is no workaround that will fulfill operational needs).
The reasons for, the voting record, and the scope of the waiver is documented.
The Epoch Staff Advisor and Epoch Technical Advisors are consulted before any waivers are issued, and are notified of the waiver’s issuance.

The following minimum security standards must be followed on Epoch systems.

Patch all high severity vulnerabilities published in the Common Vulnerabilities and Exposures (CVE) database within seven days of publication in the database.
Patch all other vulnerabilities published in the CVE database within ninety days of publication in the database.
Enable host firewall in default deny mode, and only permit the neccessary minimum services.
Review host access and sudoer policies periodically (with a period to be determined jointly by the leaders of the Epoch Technical Division).
Run malware and virus scans periodically (with a period to be determined jointly by the leaders of the Epoch Technical Division).
Password-protect and secure iLO, IPMI, and other server management technologies.
Enforce password complexity and password expiry requirements

All of the above policies, plus:

Require two-factor authentication for administrator logins
Enforce HTTPS and other encrypted channels for information transfer.
- No information may be sent or recieved to or from a medium-risk system via an unencrypted channel, unless approved in writing by a leader of the Epoch Technical Division, or their designee.
Secure physical hardware via locks, gates, cameras, etc.

All of the above policies, plus:

Access systems only through a bastion host.
Confer with leaders of the Epoch Technical Division before any changes are made to the systems, or before any high-risk systems are deployed.

The following minimum security standards must be followed on Epoch applications.

Patch all high severity vulnerabilities published in the Common Vulnerabilities and Exposures (CVE) database within seven days of publication in the database.
Patch all other vulnerabilities published in the CVE database within ninety days of publication in the database.
Enable host firewall in default deny mode, and only permit the neccessary minimum services.
Review host access and sudoer policies periodically (with a period to be determined jointly by the leaders of the Epoch Technical Division).
Run malware and virus scans periodically (with a period to be determined jointly by the leaders of the Epoch Technical Division
Enforce password complexity and password expiry requirements
Conduct security audits and review logs periodically (with a period to be determined jointly by the leaders of the Epoch Technical Division).

All of the above policies, plus:

Require two-factor authentication for administrator logins
Enforce HTTPS and other encrypted channels for information transfer.
- No information may be sent or recieved to or from a medium-risk system via an unencrypted channel, unless approved in writing by a leader of the Epoch Technical Division, or their designee.
Include security as a design requirement on all code. Conduct security audits on all code and correct identified issues prior to deployment.
Back up application data periodically (with a period to be determined jointly by the leaders of the Epoch Technical Division). Encrypt data in-transit and at rest.[1]

All of the above policies, plus:

Access applications only through a bastion host.
Confer with leaders of the Epoch Technical Division before any changes are made to the applications, or before any high-risk systems are deployed.