diff --git a/zaza/charm_tests/security/tests.py b/zaza/charm_tests/security/tests.py
index 51c685e..74f81e3 100644
--- a/zaza/charm_tests/security/tests.py
+++ b/zaza/charm_tests/security/tests.py
@@ -20,14 +20,32 @@ import unittest
 
 import zaza.model as model
 import zaza.charm_lifecycle.utils as utils
+import zaza.utilities.openstack as zaza_openstack
 
 
 def _make_test_function(application, file_details):
     def test(self):
+        until = file_details.get('until')
+        since = file_details.get('since')
         expected_owner = file_details.get("owner", "root")
         expected_group = file_details.get("group", "root")
         expected_mode = file_details.get("mode", "600")
         for unit in model.get_units(application):
+            # Have we configured a until or since for this file?
+            if until or since:
+                release = zaza_openstack \
+                    .get_current_os_release_pair(application).split('_')[-1]
+                current_release = zaza_openstack.get_os_release(release)
+                if until:
+                    until_release = zaza_openstack.get_os_release(until)
+                    if current_release >= until_release:
+                        return self.skipTest("{!r} is before {!r}".
+                                             format(until, release))
+                if since:
+                    since_release = zaza_openstack.get_os_release(since)
+                    if current_release <= since_release:
+                        return self.skipTest("{!r} is after {!r}".
+                                             format(since, release))
             unit = unit.entity_id
             result = model.run_on_unit(
                 unit, 'stat -c "%U %G %a" {}'.format(file_details['path']))
@@ -58,9 +76,14 @@ def _add_tests():
             if name in deployed_applications:
                 for file in attributes['files']:
                     test_func = _make_test_function(name, file)
+                    test_name = 'test_{}_{}'.format(name, file['path'])
+                    if file.get('until'):
+                        test_name += '_until_{}'.format(file['until'])
+                    if file.get('since'):
+                        test_name += '_since_{}'.format(file['since'])
                     setattr(
                         cls,
-                        'test_{}_{}'.format(name, file['path']),
+                        test_name,
                         test_func)
         return cls
     return class_decorator
diff --git a/zaza/utilities/openstack.py b/zaza/utilities/openstack.py
index b3ae064..be62b54 100644
--- a/zaza/utilities/openstack.py
+++ b/zaza/utilities/openstack.py
@@ -17,6 +17,7 @@
 This module contains a number of functions for interacting with Openstack.
 """
 from .os_versions import (
+    CEPH_CODENAMES,
     OPENSTACK_CODENAMES,
     SWIFT_CODENAMES,
     PACKAGE_CODENAMES,
@@ -95,6 +96,14 @@ CHARM_TYPES = {
         'pkg': 'ceilometer-common',
         'origin_setting': 'openstack-origin'
     },
+    'ceph-mon': {
+        'pkg': 'ceph',
+        'origin_setting': 'source'
+    },
+    'ceph-osd': {
+        'pkg': 'ceph',
+        'origin_setting': 'source'
+    },
 }
 UPGRADE_SERVICES = [
     {'name': 'keystone', 'type': CHARM_TYPES['keystone']},
@@ -107,6 +116,8 @@ UPGRADE_SERVICES = [
     {'name': 'openstack-dashboard',
      'type': CHARM_TYPES['openstack-dashboard']},
     {'name': 'ceilometer', 'type': CHARM_TYPES['ceilometer']},
+    {'name': 'ceph-mon', 'type': CHARM_TYPES['ceph-mon']},
+    {'name': 'ceph-osd', 'type': CHARM_TYPES['ceph-osd']},
 ]
 
 
@@ -1099,6 +1110,11 @@ def create_floating_ip(neutron_client, network_name, port=None):
     return floatingip
 
 
+def get_ceph_codename(version):
+    """Determine ceph package version from version number."""
+    return CEPH_CODENAMES[version]
+
+
 # Codename and package versions
 def get_swift_codename(version):
     """Determine OpenStack codename that corresponds to swift version.
@@ -1146,6 +1162,8 @@ def get_os_code_info(package, pkg_version):
         # < Liberty co-ordinated project versions
         if 'swift' in package:
             return get_swift_codename(vers)
+        elif 'ceph' in package:
+            return get_ceph_codename(vers)
         else:
             return OPENSTACK_CODENAMES[vers]
 
@@ -1220,7 +1238,15 @@ def get_os_release(release_pair=None):
     if release_pair is None:
         release_pair = get_current_os_release_pair()
     try:
-        index = OPENSTACK_RELEASES_PAIRS.index(release_pair)
+        try:
+            release_codename = release_pair.split('_')[-1]
+        except AttributeError:
+            release_codename = release_pair
+        ceph_releases = list(CEPH_CODENAMES.values())
+        if release_codename in ceph_releases:
+            index = ceph_releases.index(release_codename)
+        else:
+            index = OPENSTACK_RELEASES_PAIRS.index(release_pair)
     except ValueError:
         msg = 'Release pair: {} not found in {}'.format(
             release_pair,
diff --git a/zaza/utilities/os_versions.py b/zaza/utilities/os_versions.py
index 0071e2c..e74cf33 100644
--- a/zaza/utilities/os_versions.py
+++ b/zaza/utilities/os_versions.py
@@ -94,6 +94,15 @@ SWIFT_CODENAMES = OrderedDict([
         ['2.18.0', '2.19.0']),
 ])
 
+# Map UCA codenames to ceph codenames
+CEPH_CODENAMES = OrderedDict({
+    '0.80': 'firefly',
+    '0.94': 'hammer',
+    '10.2': 'jewel',
+    '12.2': 'luminous',
+    '13.2': 'mimic',
+})
+
 # >= Liberty version->codename mapping
 PACKAGE_CODENAMES = {
     'nova-common': OrderedDict([