lfit/itpol
Itpol
itpol is a framework for cryptographic key management, digital signature policies, and security hardening. It provides an IT policy template library and infrastructure access frameworks to establish organizational security guidelines and governance.
The project focuses on cryptographic identity management through the use of PGP and SSH keys, alongside a security hardening guide for workstations. It defines standards for software supply chain security, specifically regarding the signing of code commits and software releases to ensure provenance.
The system covers a broad range of security capabilities, including the implementation of multi-factor authentication, disk encryption, and bootloader security. It also addresses secure communication workflows for encrypted messaging and email, as well as the management of hardware security modules and zero-knowledge backup strategies.
Features
- Cryptographic Key Management - Establishes a comprehensive system for generating and protecting PGP and SSH keys to manage digital identities.
- Workstation Hardening - Provides a detailed hardening guide for workstations encompassing OS configuration, bootloader protection, and hardware isolation.
- Infrastructure Governance Policies - Defines generalized IT policy templates and best practice checklists to unify infrastructure and security guidelines.
- Release Commit Signing - Creates detached signatures and signed tags for software releases to ensure code provenance and integrity.
- Commit Signing - Defines a policy for cryptographically signing Git commits and tags to verify code provenance.
- Cryptographic Identity Proofs - Provides mechanisms to link hardware tokens and digital keys to real-world identities for authenticated communications.
- Signature Policies - Defines digital signature policies for code commits and software releases to ensure provenance.
- Git Commit Signature Verification - Provides guidelines for verifying PGP signatures on Git commits and tags to prevent malicious alterations.
- Governance and Policy Frameworks - Provides organizational guidelines and compliance standards for establishing infrastructure and security policies.
- PGP-SSH Integrations - Integrates PGP keys with SSH agents to provide two-factor authentication for remote server sessions.
- Identity & Key Management - Provides a standardized framework for managing cryptographic identities using PGP, SSH, and hardware tokens.
- IT Policy Templates - Provides a library of standardized IT policy templates and checklists for organizational security governance.
- Workstation Security Hardening - Provides a detailed security hardening guide for workstations, including bootloader protection and full disk encryption.
- Hardware Key Isolation - Implements the isolation of private keys within hardware modules to prevent theft from the host operating system.
- PGP - Manages PGP certification keys and handles identity expiration and revocation to establish verifiable digital identities.
- Secure Communication Workflows - Sign and encrypt emails using cryptographic standards to ensure message authenticity and confidentiality between team members.
- Linux Security Hardening - Provides comprehensive hardening checklists and configuration guidelines specifically for securing Linux workstations.
- Access Control - Provides a framework for defining organizational access control rules, including multi-factor authentication and privilege management.
- Software Supply Chain Security - Defines standards for software supply chain security by requiring cryptographic signatures on all code commits and releases.
- Governance Template Libraries - Provides a comprehensive library of IT policy templates and security checklists for organizational governance.
- Encrypted Communications - Implements secure communication workflows using encrypted messaging and signed email protocols.
- Data Backup Solutions - Establishes requirements and standards for encrypted local backups and zero-knowledge off-site storage.
- Zero-Knowledge Storage - Implements encrypted storage strategies where the service provider cannot access the decryption keys.
- Real-time Messaging - Establishes security protocols for real-time messaging, including point-to-point encryption and identity verification.
- Reusable Policy Templates - Uses standardized templates and checklists to ensure consistency across organizational security and infrastructure guidelines.
- Access Provisioning - Provisions server and VPN access through the exchange of public keys via signed channels.
- Offline Storage Strategies - Implements strategies for backing up private keys to hardcopy and offline encrypted storage.
- Full Disk Encryption - Specifies requirements for encrypting full disks and swap partitions to protect data at rest.
- Hardware Security Module Integrations - Specifies the use of smartcards and hardware security modules to isolate private keys from the operating system.
- Bootloader Password Protection - Defines security standards for UEFI configuration and bootloader password protection.
- Multi-Factor Authentication - Secures accounts using hardware tokens and time-based one-time passwords to prevent credential theft.
- Password Management - Sets standards for the use of password managers and the generation of unique credentials.
- Privileged Access Management - Sets rules for user privilege management and password complexity to reduce the system attack surface.
- Public-Key Access Control - Establishes a framework for provisioning infrastructure access, such as VPNs and servers, via signed public key exchanges.
- Public Key Infrastructure - Facilitates the exchange and verification of signed cryptographic keys for secure server access and team communication.
- Web of Trust Verifications - Implements a Web of Trust model to validate team identities through mutual cryptographic signatures.
- Linux Security - Security policies and configurations for Linux workstations.
