<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.line874, li.line874, div.line874
{mso-style-name:line874;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
p.line867, li.line867, div.line867
{mso-style-name:line867;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
p.line862, li.line862, div.line862
{mso-style-name:line862;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Unfortunately GlobalSign has to vote Abstain at this point.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>This document has made a ton of progress but still has a few implementation specific gotchas, for example:<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='color:#1F497D'>“For accounts that are accessible from outside a Secure Zone or High Security Zone, require that passwords have at least eight (8) characters, be changed at least every 90 days, use a combination of at least numeric and alphabetic characters, that are not a dictionary word or on a list of previously disclosed human-generated passwords, and not be one of the user’s previous four passwords; and implement account lockout for failed access attempts in accordance with”<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I suspect an auditor will read “password” and apply the same rules to “pins” on smartcards where the word list and previous password vectors are mitigated by the smartcards lockout mechanism vs checking the pin with some central system for these conditions as is required for passwords.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>There are a few examples of this, all of which look like they could be addressed with additional definitions so there is no reading between the lines needed when it comes to audits.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Ryan <o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='color:#1F497D'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> management-bounces@cabforum.org [mailto:management-bounces@cabforum.org] <b>On Behalf Of </b>Eddy Nigg (StartCom Ltd.)<br><b>Sent:</b> Wednesday, August 01, 2012 11:35 AM<br><b>To:</b> 'management@cabforum.org'<br><b>Cc:</b> CABFPub<br><b>Subject:</b> Re: [cabfman] [cabfpub] Ballot[83] - Adopt Network and Certificate System Security Requirements<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>StartCom votes ABSTAIN<br><br>The effort is excellent, but might be difficult to implement and audit as a requirement rather than best practice. I believe some parts of the proposed requirements should be incorporated into the BR, respectively EV guidelines, whereas others should remain as best practice instructions for the CAs to follow.<br><br>On 07/23/2012 04:22 PM, From Tim Moses: <o:p></o:p></p><p class=line874 style='background:white'><span style='font-family:"Arial","sans-serif"'>Ben Wilson made the following motion, and Bill Madell and Rick Andrews endorsed it:</span><o:p></o:p></p><p class=line867 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><strong><span style='font-family:"Arial","sans-serif"'>Motion begins</span></strong><o:p></o:p></p><p class=line862 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Arial","sans-serif"'>As of 1 January 2013 (“Effective Date”), the CA/Browser Forum adopts the “Network and Certificate System Security Requirements” Ballot Draft 1 (available here:<span class=apple-converted-space> </span><a href="https://www.cabforum.org/wiki/Balloted%20Drafts"><span style='border:none windowtext 1.0pt;padding:0in'>https://www.cabforum.org/wiki/Balloted%20Drafts</span></a>) as Version 1.0. Upon adoption the Ballot Draft shall be assigned a version number of 1.0 and be posted as a Forum Guideline to the cabforum.org Web site.</span><o:p></o:p></p><p class=line862 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Arial","sans-serif"'>The members request that those members who have worked on the Network and Certificate System Security Requirements coordinate with the<span class=apple-converted-space> </span><a href="https://www.cabforum.org/wiki/WebTrust"><span style='color:gray;border:none windowtext 1.0pt;padding:0in'>WebTrust</span></a><span class=apple-converted-space> </span>Task Force and ETSI and work on adaptations of the Network and Certificate System Security Requirements that can be incorporated into the respective<span class=apple-converted-space> </span><a href="https://www.cabforum.org/wiki/WebTrust"><span style='color:gray;border:none windowtext 1.0pt;padding:0in'>WebTrust</span></a><span class=apple-converted-space> </span>and ETSI audit criteria as soon as feasible.</span><o:p></o:p></p><p class=line874 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Arial","sans-serif"'>The ballot review period comes into effect at 2100 UTC on 20 July '12 and will close at 2100 UTC on 27 July '12. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 2100 UTC on 3 Aug '12. Votes must be cast by posting an on-list reply to this thread.</span><o:p></o:p></p><p class=line867 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><strong><span style='font-family:"Arial","sans-serif"'>Motion ends</span></strong><o:p></o:p></p><p class=line874 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Arial","sans-serif"'>A vote in favour of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted.</span><o:p></o:p></p><p class=line874 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Arial","sans-serif"'>Voting members are listed here:</span><o:p></o:p></p><p class=line867 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Arial","sans-serif"'><a href="http://www.cabforum.org/forum.html"><span style='border:none windowtext 1.0pt;padding:0in'>http://www.cabforum.org/forum.html</span></a></span><o:p></o:p></p><p class=line862 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Arial","sans-serif"'>with the addition of<span class=apple-converted-space> </span><a href="https://www.cabforum.org/wiki/TrendMicro"><span style='color:gray;border:none windowtext 1.0pt;padding:0in'>TrendMicro</span></a>.</span><o:p></o:p></p><p class=line874 style='background:white;orphans:
2;text-align:-webkit-auto;widows: 2;-webkit-text-size-adjust:
auto;-webkit-text-stroke-width: 0px;word-spacing:0px'><span style='font-family:"Arial","sans-serif"'>In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and one half or more of the votes cast by members in the browser category must be in favour. Also, at least seven members must participate in the ballot, either by voting in favour, voting against or abstaining.</span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>T: +1 613 270 3183<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br><br><br><o:p></o:p></span></p><pre>_______________________________________________<o:p></o:p></pre><pre>Public mailing list<o:p></o:p></pre><pre><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><o:p></o:p></pre><pre><a href="http://cabforum.org/mailman/listinfo/public">http://cabforum.org/mailman/listinfo/public</a><o:p></o:p></pre></div></body></html>