Trust check was suspended TopMinutes-20070917 and not required for critical systems Advisory/HRMinutes20070921. It was eventually superceded by the ABC process described in SM9.1.4 and SP9.1.4. Following text is therefore deprecated.
There are several roles that are very security-critical:
- Administrators of the Servers and Services
- Core-Developers (who are developing themself or approving changes from Non-Core-Developers)
- Support-Personnel (who can access personal data, and have support-privileges on the database)
- Internal auditors
The people who are applying for any of those roles need to undergo the following checks and procedures:
- Knowledge checks (good knowledge of the following topics has to be determined)
- Secure programming (applies only to developers, and partly to administrators)
- Responsibilities brought by the role
http://certification.about.com/od/securitycerts/a/seccertessentls.htm
- Trustworthiness
- Any information the person gives, should be cross-checked, and verified.
- Lie-detection: Any detected lies makes the person untrustworthy.
- Risk and Liability
- Is the person able and willing to accept the risk and liability attached to the role?
- Detecting potential conflicts of interest, and securing the person and CAcert from it
- Alcohol/Drug abuse
- Identity
- The identity of the person has to be checked. (Assurer-Status)
- The location of the person has to be checked. (Where does he/she live?)
- Persuasion-Resistance
- Social-Engineering
- Family