Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CA Infrastructure Scope update #44

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

CA Infrastructure Scope update #44

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5142604
CA Infrastructure Scope update
clintwilson Nov 20, 2024
675271f
Update from comments
clintwilson Dec 17, 2024
8412df0
Merge branch 'main' into ca-infrastructure-scope
clintwilson Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 19 additions & 30 deletions docs/NSR.md
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For this objective, "CAs are able to clearly understand the minimum security requirements found in this document and successfully adapt/implement these Requirements to their own infrastructure and architecture" maybe add something like ", which requires a comprehensive inventory of their Certificate Systems to ensure that their infrastructure is adequately protected."

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CS group thoughts: What if we use something similar to what is in section 3.1.2.1 "The CA SHOULD ensure retained and/or archived audit logs are kept and managed in a manner sufficiently effective to prevent unapproved alteration or access." for all other relevant security support system sections (e.g. change management, vuln management, etc.) The benefit of this is that it would bring back the requirements to protect security support systems without blowing up the trusted roles bit (which was a concern in the past).

Vuln management example: "Vuln management systems would have to be configured/locked down in a way that prevents malicious attacks on Certificate Systems"

Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
---
title: Network and Certificate System Security Requirements
subtitle: Version 2.0.1
subtitle: Version {}
author:
- CA/Browser Forum
date: 28 Oct, 2024
date: {}
copyright: |
Copyright 2024 CA/Browser Forum

Expand Down Expand Up @@ -64,15 +64,10 @@ The following are outcomes that this document seeks to achieve:

**CA Infrastructure**: Collectively the infrastructure used by the CA or Delegated Third Party which qualifies as a:

* Certificate Management System;
* Certificate System;
* Delegated Third Party System;
* Issuing System;
* Root CA System (Air-Gapped and otherwise); or
* Security Support System.

**Certificate Management System**: A system used by a CA or Delegated Third Party to process, approve issuance of, or store certificates or certificate status information, including the database, database server, and storage.

**Certificate System**: A system used by a CA or Delegated Third Party to access, process, or manage data or provide services related to performing:
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to store, access, process, or manage data

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cloud Services Subgroup Concern: Removal of Support Systems from Certificate Systems no longer encompasses those periphery systems in any kind of requirements for controls. How can we incorporate those requirements into this definition?


1. identity validation;
Expand All @@ -89,10 +84,6 @@ The following are outcomes that this document seeks to achieve:

**Delegated Third Party**: A natural person or legal entity that is not the CA and that operates any part of a Certificate System.

**Delegated Third Party System**: Any part of a Certificate System used by a Delegated Third Party while performing the functions delegated to it by the CA.

**Issuing System**: A system used to sign certificates or validity status information.

**Key Pair**: The Private Key and its associated Public Key.

**Multi-Factor Authentication**: An authentication mechanism consisting of two or more of the following independent categories of credentials (i.e. factors) to verify the user’s identity for a login or other transaction:
Expand Down Expand Up @@ -145,20 +136,20 @@ Each factor is independent of the other(s).
2. store a Root CA Private Key; or
3. create digital signatures using a Root CA Private Key.

**Security Support System**: A system or set of systems supporting the security of the CA Infrastructure, which minimally includes:
**Security Support System**: The System(s) supporting the security of CA Infrastructure, performing functions such as:

1. authentication;
2. network boundary control;
3. audit logging;
4. audit log reduction and analysis;
5. vulnerability scanning;
6. physical intrusion detection;
7. host-based intrusion detection; and
8. network-based intrusion detection.
#. authentication;
#. network boundary control;
#. audit logging;
#. audit log reduction and analysis;
#. vulnerability scanning;
#. physical intrusion detection;
#. host-based intrusion detection; and
#. network-based intrusion detection.

**System**: One or more pieces of equipment or software that stores, transforms, or communicates data.

**Trusted Role**: An employee or contractor of a CA or Delegated Third Party who has authorized access to any component of CA Infrastructure.
**Trusted Role**: An individual employee or contractor of a CA or Delegated Third Party who has authorized access to any Certificate System or Root CA System.

**Workstation**: A device, such as a phone, tablet, or desktop or laptop computer, which is:

Expand All @@ -171,6 +162,8 @@ Prior to 2025-03-12, the CA SHALL adhere to these Requirements or Version 1.7 of

### 1. CA Infrastructure and Network Equipment Configuration

The CA MUST define an inventory of Certificate Systems.

#### 1.1 Network Segmentation

##### 1.1.1
Expand Down Expand Up @@ -208,13 +201,10 @@ CA Infrastructure MUST be in a Physically Secure Environment.

##### 1.2.2

Connections to the CA Infrastructure MUST be authenticated and encrypted, except where documented that a formal specification prohibits or limits the use of authentication and/or encryption.
Connections to the CA Infrastructure MUST be authenticated and encrypted, except where formal specification(s) prohibits or limits the use of authentication and/or encryption.

Connections within the CA Infrastructure SHOULD be authenticated and encrypted.

1. between CA Infrastructure components; and
2. between CA Infrastructure and non-CA Infrastructure.

CA Infrastructure and Network Equipment MUST be implemented and configured in a manner that minimizes unnecessary active components and capabilities such that:

1. all connections, communications, applications, services, protocols, and ports not used are removed and/or disabled; and
Expand Down Expand Up @@ -292,6 +282,7 @@ The CA MUST ensure personnel assigned to Trusted Roles that are authorized to ac
###### 2.2.1.2

The CA SHOULD NOT allow group accounts or shared role credentials to authenticate to or access CA Infrastructure and/or Network Equipment. If group accounts or shared role credentials are used, the CA MUST be able to attribute each use to

* an approved activity; and
* an individual user or service account.

Expand Down Expand Up @@ -441,16 +432,14 @@ The CA SHOULD ensure incident response plans minimally include:

### 4. Vulnerability Management

The CA MUST implement the policies and procedures in this Section for identifying, evaluating, and resolving security vulnerabilities.
#### 4.1

The CA MUST implement the policies and procedures in [Section 4](#4-vulnerability-management) for identifying, evaluating, and resolving security vulnerabilities.

These policies and procedures MUST apply to all Certificate Systems.

These policies and procedures SHOULD apply to Security Support Systems.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Support Systems has been removed as a defined term.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1


#### 4.1 Inventory of Certificate Systems

The CA MUST define an inventory of Certificate Systems.

#### 4.2 Intrusion Detection and Prevention

The CA MUST protect the systems in the inventory of Certificate Systems against common network and system threats using intrusion detection and prevention controls.
Expand Down