Page History

Develop the SIRTFI Trust Framework specification, which defines basic security incident response capabilities to which member organizations can self-assert compliance.

This initial draft is intended to be a simplified framework that lays the groundwork for how such an approach should be defined.  Significant effort will be needed to understand how this might be deployed in the existing R&E FIM environment.

• Draft SIRTFI document for consultation.
• Consultation to support development of public v1.0.
• Decide whether IdP notification of compromised account belongs in v1.0 or will be slated for v2.0 in alignment with Phase 3 work.
• Propose / finalise entity metadata schema for security contacts.
• Propose / finalise entity attribute profile to signify adherence with Sirtfi public v1.0.

Establish the means by which member organisations in all R&E federations can indicate their compliance with the SIRTFI Trust Framework, how they can be contacted to participate in a coordinated response to a federated security incident.

Define the roles and responsibilities of the various parties in managing federated security incidents, information sharing guidelines, tools, procedures, and templates.

• Produce educational and communication materials for REFEDS to promulgate to member R&E federations.
• Promulgate educational and communication materials to help R&E federations to promote and support Sirtfi public v1.0 adoption.
• Test incident response process and use of security contact metadata in simulated activity.
• Implement processes by which to maintain and broadcast security contact information and Sirtfi trust framework adherence, outside standard federation metadata publication mechanisms.
• Establish communication channels for security information exchange and incident report sharing.
• Define incident response procedures for federations, including communication templates, and support the community in their adoption.
• Implement metadata extension for security contact information.
• Implement metadata profile to signify Sirtfi public v1.0 adherence.

Establish the means for proactive notification of an account compromise when it can be expected to produce a substantial impact to an at-risk SP organisation.

• Analyse suitability of existing identity event notification solutions to R&E federations, and potentially define and set up means for IdP organizations to issue events related to account compromises to SPs registered as at-risk .
• Develop tools to help IdPs identify accounts that have been used to access specified SPs.
• Define Sirtfi version 2 to include the requirement to notify affected participating organisations of security incidents

Material

Audience

Format

Link

Benefits of Sirtfi

All

PDF 

https://refeds.org/wp-content/uploads/2016/02/Why_Sirtfi.pdf

Technical changes

Fed Ops

Wiki

Guide for Federation Operators

Outreach Package

Fed Ops

Wiki

Guide for Federation Operators#SampleOutreachLetterforFederationParticipants

Steps to follow

Entities

Web Page

Guide for Federation Participants

FAQs

Entities

Web Page

General: https://refeds.org/sirtfi/sirtfi-faqs
Technical: FAQs

Logo (to act as a trust mark on compliant sites)

Entities

Image

Sirtfi Framework Doc

All

PDF on Web Page

https://refeds.org/wp-content/uploads/2016/01/Sirtfi-1.0.pdf

Summary poster

All

Poster

SIRTFI44958284