DAIS - Digital Archive of the Serbian Academy of Sciences and Arts: Security

This public wiki is about the DAIS – Digital Archive of the Serbian Academy of Sciences and Arts

See also:

• Mission
• General information
• Organization scheme
• Workflows
• Metadata
• Item lifecycle
• Preservation plan
• Terms of Service
• Helpdesk

Technology

DAIS is hosted by the University of Belgrade Computer Centre (RCUB) on a virtual machine in a Proxmox environment under a CentOS operating system. The repository database is stored on a PostgreSQL 9.5 server inside the production-level virtual machine. Database export is enabled.

The software platform of DAIS is based on the open-source software DSpace 5.10. The core DSpace code and Java code have not been modified, to facilitate the implementation of DSpace patches, updates, and upgrades. Major modifications have been made to the configuration, localization files and the XMLUI configuration. The system has been enriched with additional applications (displaying citation counts from the Web of Science, Scopus, Dimensions and Altmetric Attention Scores; displaying recommended citation; full ORCID integration; displaying human-readable funding information in the selected interface language). The customized version of DSpace and a set of additional applications are part of the software and workflow package developed by RCUB for setting up institutional repositories. Thirty institutional repositories have been developed using this package. The implementation is guided by the Policy for Transparent Access to Research Infrastructures at the Computer Centre of the University of Belgrade: TRAP-RCUB IT solution and organizational model for the implementation of institutional or thematic repositories.

The source code of the customized version of DSpace and all additional applications is not open source. It is stored on a local Git server accessible only to the repository development team. Detailed documentation about software, installation, configuration, maintenance, and troubleshooting available on Confluence and Jira is accessible only to the development team. This documentation enables easy replication of procedures and ensures continuity in case of staff changes.

The following main procedures are covered in the documentation:

• setting up the vitural machine
• setting up DSpace using the customized installation package stored on the internal Git server
• customizing the iterface design
• setting up the e-mail for the feedback form and registration alerts
• setting up APIs enabling integration with ORCID, Scopus, Web of Science, Dimensions and Altmetric
• installing additionall applications (APP, Ellena, NomadLite, RM)
• ingesting metadata and data (only in case curated metadata and data are available for import or harvesting)
• PID assignment
• migration to the production environment
• setting up service monitoring procedures
• testing according to a checklist
• preparing and uploading a stadardized repository policy
• defining a standard set od collections and user groups in DSpace
• unblocking robot.txt to enable indexing by search engines
• registering the repository with OpenDOAR, ROAR, BASE, CORE, and OpenAIRE
• setting up and launching the initial harvesting by WorldCat; defining the harvesting interval.

Capacity and availability

RCUB ensures sufficient storage capacity for DAIS. Hardware resources are incrementally adjusted to the database size and the number of visitors. This is possible thanks to the fact that RCUB relies on the public infrastructure and services provided by the Academic Network of the Republic of Serbia (AMRES). Furthermore, according to the Policy for Transparent Access to Research Infrastructures at the Computer Centre of the University of Belgrade: TRAP-RCUB IT solution and organizational model for the implementation of institutional or thematic repositories (which also applies in the case of DAIS), 15% of the service fee paid by institutions are allocated for equipment purchase.

According to the Policy for Transparent Access to Research Infrastructures at the Computer Centre of the University of Belgrade, TRAP-RCUB Team guarantees the Service Operating Time of 99%, which means that the repository is available 24/7. Monitoring mechanisms, remote services and staff are allocated to ensure this.

The repository provides its access to web services through a shared 1 Gbps internet connection supported by the Academic Network of the Republic of Serbia (AMRES).

Backup and monitoring

Backups are regularly performed at the virtual machine level. Both live instances and their passive backups reside on hardware-enabled and redundant RAID setups. The monitoring and alerting service MONIT, maintained by the RCUB team, constantly monitors the operation of the repository and sends alerts to system administrators in case of unexpected events. RCUB also performs regular traffic monitoring.

The repository follows a regular upgrade cycle and, where possible, existing and widely accepted best practices.

In case of major software configuration changes or updates, the virtual machine is cloned and all changes are tested on the clone. Before any intervention on the production machine, a snapshot is created in the virtualization system, to enable roll-back and prevent data loss. End-users are duly informed about planned changes and upgrades.

Authentication and authorization

DAIS uses the Authentication by Password method, using the e-mail address/password-based log-in supported by DSpace. Users can register themselves without needing approval from the administrators, and can set their own passwords upon registration. DSpace supports multiple authentication methods. If a need arises, the authentication method in DAIS could be changed to ensure greater security.

Plain-text passwords are encrypted using the SHA-512 hashing algorithm. Passwords must be at least six characters long, and users are encouraged to use strong passwords. Password change may be prompted by the repository manager. When resetting a password the user will be sent an email containing a special link they can follow to choose a new password. The password change procedure can be launched by users, from the login page.

Users are not members of any special user groups upon registration, which means that they can access only publicly available features even when logged in. In order to authorize users to deposit content in a particular collection and access restricted content, the repository manager must first create appropriate user groups and then assign users to particular user groups. The repository managers will check the eligibility of registered users (institutional affiliation) and will remove (delete) from the system those who are not eligible.

Two external applications (Ellena and NomadLite) for repository managers require authentication and authorization. In order to be able to use these applications, users must be registered in the repository. Passwords and permissions are assigned by the DAIS Administrator & RCUB user support coordinator in the Ellena Dashboard. Passwords are encrypted using the SHA-512 hashing algorithm. The same credentials are used to log in to Ellena and NomadLite. Authentication in these applications is independent from that in the repository.

Password handling is guided by the Terms of Service and standard institutional policies applying to credentials for services (e.g. institutional e-mail, intranet, subscribed services, etc.). The credentials for the service backend, project management system and documentation, Git server and back-up facilities are managed in line with the internal document "Guidelines for Employees" (UP 101), adopted by RCUB. Passwords, authorization procedures, access to services, and related security measures are defined in Article 3.10 of this document.

Hardware security

Hardware security is ensured based on a SLA between SASA and RCUB. The computer hardware that runs the repository is the property of RCUB. A dedicated team at RCUB takes care of the configuration, maintenance, security, software updates and development. RCUB has a dedicated team responsible for infrastructure security. RCUB security officers are responsible for general network security, server security, and service maintenance and they collaborate closely with the repository development team. Servers and network devices are kept in a dedicated area with physical access strictly limited to authorized staff. Access to the backup facilities is strictly limited access. The premises are equipped with fire alarms and a fire retardant system. Uninterrupted power supply is ensured by means of an automatic stand-by electric power generator.

Dedicated staff members are physically present on the premises 24/7. Remote security services are also provided.

Business Continuity and Disaster Recovery Plan

Actions aimed at threat management and disaster recovery in DAIS are guided by the Business Continuity and Disaster Recovery Plan for Repositories, adopted by RCUB as an internal document. The document applies to all repositories developed and maintained by RCUB. The plan ensures the continuity of the system's operations in the event of unplanned disruptions and provides guidance for dealing with potential threats to the system’s integrity and security. The document is aligned with other internal documents guiding infrastructure security, such as the "Guidelines for Employees" (UP 101) and the Guidelines for Resolving Tickets. The implementation of the measures defined in the document is supported by the services available to RCUB as a member of the Academic Network of Serbia.

The plan defines major threats and the corresponding response actions, as well as individuals and teams responsible for their implementation. This is a brief summary of the document.

The following threats are identified:

Hardware failure

Measures to prevent hardware failure are described under Hardware security.

Response: The repository systems are virtualized, regularly backed-up, and can easily be replicated to a secondary site in the event of failure. RCUB uses a monitoring and alert system to receive notifications when servers have failed. (Responsibility: TRAB-RCUB Team)

In case such a need arose, RCUB could use additional resources provided through AMRES. (Responsibility: RCUB management)

Normally, hardware failure events are resolved within 2-3 hours. In case of a major failure, this may take 24-48 hours. (Responsibility: TRAB-RCUB Team, other RCUB teams)

Software failure

Measures to prevent software failure:

• Local firewall appliances, such as Iptables and Fail2ban, are used to protect and restrict access to the DAIS instance. (Responsibility: TRAB-RCUB Team)
• Software is regularly updated. (Responsibility: TRAB-RCUB Team)
• Software is documented and stored on a secure Git server. (Responsibility: TRAB-RCUB Team)
• Backup procedures are in place. (Responsibility: TRAB-RCUB Team)
• Traffic monitoring is performed. (Responsibility: other RCUB teams and AMRES)
• Only authorized and authenticated users have access to the submission module. (Responsibility: repository managers and participating institutions)
• Passwords are encrypted using the SHA-512 hashing algorithm. (Responsibility: TRAB-RCUB Team)
• A ticketing system to report technical issues is in place. End-users can use multiple channels to report issues: the repository feedback form, direct messaging to repository managers or the DAIS Administrator & RCUB user support coordinator, and the RCUB Helpdesk. In the former two cases, the DAIS Administrator & RCUB user support coordinator will register the issue as a "task" in the Jira project management system and assign it to a responsible IT team member, indicating the priority level. The IT team member will immediatelly receive an e-mail alert. The issue should be resolved within 48 hours. However, most issues are resolved during the same working day.

Response: The TRAB-RCUB Team will try to diagnose and resolve the issue. In case of a severe failure, the repository system can be replicated from the backup.

Power failure

Measures to prevent power failure:

• Installations are regularly maintained. (Responsibility: other RCUB teams)
• Dedicated staff members are physically present on the premises 24/7. (Responsibility: other RCUB teams)
• UPS devices are used. (Responsibility: other RCUB teams)

Response: RCUB staff members should establish whether the failure is local or has to do with the public power supply network. In the former case, staff members will try to resolve the issue, in the latter, they will contact the power supply service. In the event of a prolonged power failure, virtual machines could be moved to a different IT environment.

After power supply is reestablished, the TRAP-RCUB team will check the repository system for potential damages due to power failure.

Compromised security of the system

Measures to prevent malware attacks and other events that may compromise the system security:

• RCUB uses AMRES CSIRT services for handling incidents related to safety of ICT infrastructure and systems. (Responsibility: AMRES)

Response: The system has to be isolated. Tests are run to identify and address potential issues. The operation of the system may be temporarily suspended. In case of severe damage, the repository system could be replicated from the backup in a different IT environment.

After the issue is resolved, the TRAP-RCUB team will check the integrity of the repository system.