The Australian Health Geography Data (AHGD) project is committed to maintaining the highest security standards for handling Australian health and geographic data. This policy outlines our security practices, vulnerability reporting process, and response procedures.

We actively support the following versions with security updates:

• Current Version (1.0.x): Full support including security patches, bug fixes, and feature updates
• Previous Version (0.9.x): Critical security fixes only until end-of-life
• Legacy Versions: No security support - immediate upgrade recommended

• Email: security@ahgd-project.org
• Response Time: Within 24 hours for critical vulnerabilities
• Encryption: PGP public key available upon request

• Development Team: dev@ahgd-project.org
• Project Maintainer: massimo.raso@ahgd-project.org

For critical security issues requiring immediate attention:

• Emergency Email: security-emergency@ahgd-project.org
• Expected Response: Within 2 hours during business hours (AEST)

DO NOT create public GitHub issues for security vulnerabilities. Instead:

1. Email us directly at security@ahgd-project.org

2. Include the following information:

   • Detailed description of the vulnerability
   • Steps to reproduce the issue
   • Potential impact assessment
   • Any proof-of-concept code (if applicable)
   • Your contact information for follow-up

3. Use encryption if the vulnerability is sensitive:

   • Request our PGP public key
   • Encrypt sensitive details

1. Acknowledgement: Within 24 hours for critical issues, 48 hours for others
2. Initial Assessment: Within 48-72 hours
3. Progress Updates: Weekly updates on investigation status
4. Resolution Timeline: Communicated within 5 business days

• Definition: Remote code execution, authentication bypass, data exposure
• Acknowledgement: Within 2 hours (business hours), 24 hours (after hours)
• Initial Fix: Within 24-48 hours
• Public Disclosure: 7-14 days after fix is available

• Definition: Denial of service, privilege escalation, significant data integrity issues
• Acknowledgement: Within 24 hours
• Initial Fix: Within 1 week
• Public Disclosure: 14-30 days after fix is available

• Acknowledgement: Within 48 hours
• Initial Fix: Within 2-4 weeks
• Public Disclosure: 30-90 days after fix is available

• Privacy Act 1988: Full compliance with Australian privacy legislation
• Australian Government Information Security Manual (ISM): Following relevant security guidelines
• Healthcare Sector Cyber Security Framework: Implementing recommended practices

• Data at Rest: AES-256 encryption for sensitive datasets
• Data in Transit: TLS 1.3 for all network communications
• Access Control: Role-based access with principle of least privilege
• Audit Logging: Comprehensive logging of all data access and modifications

• Regular Audits: Monthly security audits using pip-audit and GitHub Dependabot
• Automated Scanning: CI/CD pipeline includes security vulnerability detection
• Update Policy: Security patches applied within defined response timeframes

• 20 vulnerabilities addressed across 15 packages
• 100% elimination of critical and high-severity vulnerabilities
• 70% overall reduction in security vulnerabilities
• Comprehensive testing of all security fixes

• ✅ 0 Critical vulnerabilities (down from 1)
• ✅ 0 High-severity vulnerabilities (down from 4)
• ✅ 0 Moderate vulnerabilities (down from 5)
• ⚠️ 6 Low-severity vulnerabilities remaining (development tools only)

See our Security Fix Report for complete details.

1. Keep Dependencies Updated: Regularly update to latest versions
2. Use Virtual Environments: Isolate project dependencies
3. Enable Security Scanning: Use pre-commit hooks for security checks
4. Follow Secure Coding: Review our security guidelines in docs/security/

1. Data Classification: Understand sensitivity levels of different datasets
2. Access Controls: Use only necessary permissions for your role
3. Secure Storage: Store derived datasets in approved locations
4. Incident Reporting: Report any suspected security issues immediately

1. Regular Updates: Apply security patches promptly
2. Network Security: Implement appropriate firewall and network controls
3. Monitoring: Enable comprehensive security logging
4. Backup Security: Ensure backups are encrypted and tested

• Security Fix Report
• Vulnerability Analysis
• Security Guidelines
• Security Checklist

• June 2025 Security Audit
• Vulnerability Summary

1. Acknowledge vulnerability report
2. Assess initial severity and impact
3. Isolate affected systems if necessary
4. Assemble response team

1. Investigate vulnerability thoroughly
2. Develop mitigation strategies
3. Test potential fixes
4. Prepare communication plan

1. Implement security fixes
2. Conduct comprehensive testing
3. Deploy fixes to staging environment
4. Prepare public disclosure

1. Deploy fixes to production
2. Monitor for any issues
3. Conduct post-incident review
4. Update security procedures

• Application Layer: Input validation, secure coding practices
• Data Layer: Encryption, access controls, audit trails
• Infrastructure Layer: Network security, system hardening
• Operational Layer: Security monitoring, incident response

• Authentication & Authorisation: Multi-factor authentication for admin access
• Data Encryption: End-to-end encryption for sensitive health data
• Network Security: VPN access for remote administration
• Logging & Monitoring: Comprehensive security event logging

• Acknowledge all security reports promptly
• Investigate thoroughly and communicate progress
• Fix vulnerabilities in a reasonable timeframe
• Credit security researchers appropriately (with permission)

We maintain a Security Researchers Hall of Fame to recognise contributions to project security.

• Day 0: Vulnerability reported
• Day 1-2: Initial assessment and acknowledgement
• Day 3-7: Investigation and fix development
• Day 8-14: Testing and validation
• Day 15-30: Deployment and public disclosure

• Secure Coding Practices: Annual training on OWASP Top 10
• Threat Modelling: Regular threat assessment exercises
• Incident Response: Quarterly incident response drills

• Security Documentation: Comprehensive security guides
• Best Practices: Regular communication of security best practices
• Awareness Updates: Monthly security awareness communications

• Internal Audits: Quarterly security reviews
• External Audits: Annual third-party security assessments
• Penetration Testing: Annual penetration testing exercises

• Regulatory Compliance: Regular compliance assessments
• Policy Updates: Annual review and update of security policies
• Training Records: Maintenance of security training records

• Email: security@ahgd-project.org
• Response Time: 24-48 hours

• Email: security-emergency@ahgd-project.org
• Response Time: 2-24 hours

• General Support: support@ahgd-project.org
• Development Issues: Create GitHub issue for non-security matters

Last Updated: 2025-06-22
Policy Version: 1.0
Next Review Date: 2025-12-22

This security policy is reviewed and updated every 6 months or after significant security incidents.