# Security Policy

## Password Management

**Mandatory rules — no exceptions:**

1. Password manager: **gopass ONLY** (no third-party tools, no built-in browser managers).
2. Protected by: **Yubikey hardware security token**.
3. NEVER write passwords in plain text (no spreadsheets, notes, physical diaries, digital files).
4. NEVER reuse passwords across different systems or services.
5. NEVER share passwords — even with supervisors, team members, or IT staff.
6. Team-shared secrets: dedicated team-shared gopass repository folder.
7. Passwords: use random characters, sufficiently long and unpredictable.
8. Suspected compromise: change immediately + notify EP (Executive President).
9. Admin/root passwords: change if team membership changes or risk increases.
10. ELB can request compliance audit at any time; non-compliance → disciplinary action.

---

## Yubikey Hardware Tokens

- **Required for**: everyone with access to systems containing sensitive/confidential information.
- **Setup**: registered and enabled with company's approved authentication/encryption systems.
- **Labeling**: each Yubikey clearly labeled or serial-numbered to identify owner.
- **New/replacement devices**: recorded in company-managed registry (gopass).
- **Physical possession**: mandatory during working hours and remote system access.
- NEVER lend or share your Yubikey (sharing = prohibited).
- **Lost/damaged/compromised**: immediately notify EP + designated IT representative + security lead for deactivation and replacement.
- **Testing**: periodically test functionality; malfunctioning device replaced without delay.
- **PINs for Yubikey**: follow all password management rules, kept secret.

---

## Encryption

- All data classified **Confidential / Restricted / Secret / Trade Secret**:
  - Must be encrypted when stored on portable devices.
  - Must be encrypted when transmitted outside internal networks.
- Encryption algorithms: only EP-approved algorithms permitted.
- Private key sharing: prohibited except under explicit emergency procedures.
- Key rotation: periodic rotation and revocation required.
- Digital signatures on high-level documents: approved tools only meeting legal validity standards.
- **Hardware token**: all code commits requiring authentication must use recognized digital signature tied to hardware security token.
- **Quarterly testing**: all hardware security tokens tested for firmware updates and compatibility with approved encryption tools; results logged in security ticket queue.

---

## Code Security

- NEVER hardcode credentials, tokens, API keys in code or configuration.
- Use environment variables or secrets management systems.
- Violations = security breach; report immediately.
- Security scanning must run on every PR via the task runner (e.g. `nox -s security_scan`).
- All PRs must pass the security scan before approval.

---

## Reporting Security Incidents

1. Suspected compromise → immediately change credentials + notify EP.
2. Unusual login attempts / hardware token tampering → notify EP + security team.
3. Any breach → report to supervisor or security liaison immediately.
4. Non-compliance with security rules → corrective measures or disciplinary action.
