eduGAIN Participants Security Contact

As the very first move forward with security arrangement we need to establish proper communication channels with the eduGAIN participants. As agreed by the eduGAIN SC, we will require that federation provide their security contacts and make them available for security matters in eduGAIN. We'll continue further with policies and procedures, however we only aim at very light and flexible arrangement to prove the essential security baseline. We will re-use SIRFTI requirement as much as possible.

eduGAIN Participants shall define a security contact for the federation that will act a 

The security contact shall respect the following base requirements:

• It is strongly recommended to use a dedicated email address for the security contact. 
• Where possible, use the contact of the NREN's security function (local CERT/CSIRT). We will also accept specific security capability for the federation service, if the organization has a proper procedure to deal with the communication.
• Refer to the eduGAIN CSIRT <abuse@edugain.org>, which is the established security contact for the eduGAIN Service, for federated security incident notification and coordination.

• Respond to requests for assistance with a security incident from the eduGAIN CSIRT or other eduGAIN Participants in a timely manner. The recommended response time is half business day.

• Respect the Traffic Light Protocol [TLP] information disclosure policy and use it during incident response communications (ref. https://www.first.org/tlp)

• the contact needs to expect that the eduGAIN CSIRT runs periodic communication checks which needs to be handled as any other IR communication