Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Current »

TDL is governed by the UT System Information Resources Use and Security Policy https://www.utsystem.edu/sites/policy-library/policies/uts-165-information-resources-use-and-security-policy

Deployment in AWS

Texas Digital Library deploys its hosted Vireo ETD service in Amazon Web Services. Each repository is deployed on a single EC2 instance with attached EBS volume for storage.

AWS security compliance documentation

Backups

TDL uses AWS Snapshot service for backups and maintains two weeks of daily disk snapshots and 1 monthly disk snapshot, kept in Amazon’s S3 storage for at least one year.

Security-focused monitoring

  • Regular automated updates and patch deployment for the hosted operating system and system applications on TDL servers.

  • Continual monitoring for Vireo ETD service availability, with notifications sent to administrators in the event that the service is experiencing an outage. Outages, whether due to system or application failure or external attack are resolved as quickly as possible by TDL technical staff.

  • On-going review of known exploits which may affect Vireo ETD hosting followed, as needed, by manual patching and updates to limit exposure.

  • Monitoring for notifications from customers of service failures, outages, or issues via the ZenDesk support system. Helpdesk issue tickets are resolved by technical staff and Vireo ETD OSS developers.

  • Management and monitoring of the Vireo ETD technical community discussions for discovered security vulnerabilities. Discoveries of a security vulnerability are followed by integration of the fix into the deployed service.

Secure systems architecture

  • Virtual Private Cloud (VPC) with firewall, for provisioning resources in a logically isolated network.

  • VPC peering, providing a networking connection between VPCs that enables routing of traffic using the private network.

  • Use of jumpboxes for SSH access and secure access through SSL VPN.

  • Layered IP filtering using Access Control Lists and Security Groups.

Authentication

  • Primary authentication method is via member institution authentication systems using Shibboleth, and other systems by member request.

  • IP address / range authorization (e.g. for restricting access to specific collections to "on campus") is available.

  • Default Vireo ETD authentication is available. (where Vireo manages all accounts, passwords and permissions)

Encryption

  • All calls to hosted Vireo ETD are encrypted using Transport Layer Security protocols (HTTPS). TDL requires HTTPS for all sites, and does not allow site data to be sent via plain HTTP.

  • No labels