About the question, is it compulsory to make fosensic analysis in the EGEE? The answer at this moment is not, following the "Grid Security Incident Handling and Response Guide" from the "Operational Security Coordination Team" (OSCT), and the comment of David Kelsey and Ian Nelson.
The reason for avoid establish the analysis mandatory are that, perhaps, making it compulsory could even discourage small sites. However, from the OSCT, it should strongly encourage to people to perform analysis forensic.
In other hand, there is not a deontological code for the use of data received in this issue.
So, Elio Perez and me have written a draft of this code. We add this draft to the message.
Deontological Code for the use of image of compromised computers:
- Collected data will not be modified by the analysis team. Any work will be developed using copies.
- Collected data will be used only by the analysis team. Nobody else should access to this information.
- The analysis team will guarantee the confidentality of any information stored on disks.
- Collected data should be used only for research porpouses. Once the investigation has concluded, any information keeped by the analysis team should be destroyed.
- In case the analysis becomes useful for research or educational porpouses, only technical information should be used, avoiding any usage of user data.
We hear any suggestion about this draft.
* We close this ticket and we open new ones: legal implications of forensic analysis, the formal approval of the deontologic code and the steps to add Miguel Cardenas as SWE Security officer