Page History

Develop the SIRTFI Trust Framework specification, which defines basic security incident response capabilities to which member organizations can self-assert compliance.

This initial draft is intended to be a simplified framework that lays the groundwork for how such an approach should be defined.  Significant effort will be needed to understand how this might be deployed in the existing R&E FIM environment.

• Draft SIRTFI document for consultation.
• Consultation to support development of public v1.0.
• Decide whether IdP notification of compromised account belongs in v1.0 or will be slated for v2.0 in alignment with Phase 3 work.
• Propose / finalise entity metadata schema for security contacts.
• Propose / finalise entity attribute profile to signify adherence with Sirtfi public v1.0.

Establish the means by which member organisations in all R&E federations can indicate their compliance with the SIRTFI Trust Framework, how they can be contacted to participate in a coordinated response to a federated security incident.

Define the roles and responsibilities of the various parties in managing federated security incidents, information sharing guidelines, tools, procedures, and templates.

• Produce educational and communication materials for REFEDS to promulgate to member R&E federations.
• Promulgate educational and communication materials to help R&E federations to promote and support Sirtfi public v1.0 adoption.
• Test incident response process and use of security contact metadata in simulated activity.
• Implement processes by which to maintain and broadcast security contact information and Sirtfi trust framework adherence, outside standard federation metadata publication mechanisms.
• Establish communication channels for security information exchange and incident report sharing.
• Define incident response procedures for federations, including communication templates, and support the community in their adoption.
• Implement metadata extension for security contact information.
• Implement metadata profile to signify Sirtfi public v1.0 adherence.