<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=NL-BE link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Hi Ben<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>GlobalSign would like to endorse.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Thanks<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Arvid<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US>From:</span></b><span lang=EN-US> Netsec <netsec-bounces@cabforum.org> <b>On Behalf Of </b>Ben Wilson via Netsec<br><b>Sent:</b> maandag 16 november 2020 17:32<br><b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org>; CABF Network Security List <netsec@cabforum.org><br><b>Subject:</b> Re: [cabf_netsec] Ballot SCXX: Security Requirements for Air-Gapped CA Systems<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>Sorry for the cross-posting, but I am now looking for endorsers of this ballot so that we can bring it to final discussion and vote.<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Thu, Nov 12, 2020 at 9:19 AM Ben Wilson <<a href="mailto:bwilson@mozilla.com">bwilson@mozilla.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><div><div><p style='margin:0cm' id="gmail-m_-6414654059894597686m_-5351122722150319618gmail-docs-internal-guid-91f5ee84-7fff-f361-f5a2-a49e6fb37ec8"><span style='font-size:10.0pt;font-family:"Courier New";color:black'>For informal discussion and comment, here is Ballot SCXX: Security Requirements for Air-Gapped CA Systems </span><o:p></o:p></p><p style='margin:0cm'><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Ballot SC XX: Security Requirements for Air-Gapped CA Systems</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Purpose of the Ballot:</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>This ballot increases the security of Air-Gapped/Offline CA systems (“Air-Gapped CA Systems”) by clarifying the controls that CAs must implement to protect them.</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Air-Gapped CA systems are maintained in entirely distinct zones, and while they can share certain exterior physical controls with online systems, they are not connected to online systems or the Internet. Thus, they have different operational requirements and controls due to their separate risk profile. While the scope of the current Network and Certificate System Security Requirements includes Air-Gapped CA systems, the document focuses on online systems and contains a number of requirements that are not practical to implement in an offline environment and could increase the risk to offline systems. </span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>As an example, access to offline systems frequently elevates the risk to the environment. A quarterly vulnerability scan in the offline environment is not practical, because there is an increased risk involved with attaching a scanning device to an Air-Gapped CA system. As another example, because such systems are not connected, the provisions of subsection 1.g (ports and protocols) are not applicable.</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>This ballot develops a working definition for an “Air-Gapped CA System” to allow for a clear delineation between those system components that fall under this category of Air-Gapped/Offline requirements and those under other requirements. In doing so, the ballot creates two sets of requirements tailored to their respective operating environments and characteristics.</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Not only does this ballot introduce a new section 5, it also adds additional physical security requirements for air-gapped CAs by requiring video monitoring, intrusion detection, and other intrusion prevention controls to protect Air-Gapped CA Systems against unauthorized physical access attempts. The new section 5 presents logical security requirements in subsections a through m and physical security requirements in subsections p through w. </span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>These proposed subsections in a new section 5 come from the current NCSSRs as follows:</span><o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='border-collapse:collapse'><tr><td valign=top style='border:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><b><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Description</span></b><o:p></o:p></p></td><td valign=top style='border:solid black 1.0pt;border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><b><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Offline </span></b><o:p></o:p></p><p style='margin:0cm'><b><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Criteria #</span></b><o:p></o:p></p></td><td valign=top style='border:solid black 1.0pt;border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><b><span style='font-size:10.0pt;font-family:"Courier New";color:black'>General </span></b><o:p></o:p></p><p style='margin:0cm'><b><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Criteria #</span></b><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><b><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Logical Security of Air-Gapped CA Systems</span></b><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Configuration review</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5a</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>1h</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Appointing individuals to trusted roles</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5b</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2a</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Grant access to Air-Gapped CAs</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5c</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>1i</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Document responsibilities of Trusted roles</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5d</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2b</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Segregation of duties </span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5e</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2d</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Require least privileged access for Trusted Roles</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5f</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2e</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>All access tracked to individual account</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5g</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2f</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Password requirements</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5h</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2gi</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Review logical access</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5i</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2j</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Implement multi-factor access</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5j</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2m</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Monitor Air-Gapped CA systems</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5k</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>3b</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Review logging integrity </span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5l</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>3e</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Monitor archive and retention of logs</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5m</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>3f</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><b><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Physical Security of Air-Gapped CA Systems</span></b><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Grant physical access</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5p</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>1i</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Multi-person physical access </span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5q</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>1j</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Review physical access</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5r</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2j</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Video monitoring</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5s</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>3a</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Physical access monitoring</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5t</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>3a</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Review accounts with physical access</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5u</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>2j</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Monitor retention of physical access of records</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5v</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>3f</span><o:p></o:p></p></td></tr><tr><td valign=top style='border:solid black 1.0pt;border-top:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Review integrity of physical access logs</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>5w</span><o:p></o:p></p></td><td valign=top style='border-top:none;border-left:none;border-bottom:solid black 1.0pt;border-right:solid black 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;overflow:hidden'><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>3e</span><o:p></o:p></p></td></tr></table><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>This motion is made by Ben Wilson of Mozilla and endorsed by David Kluge of Google Trust Services and ________ of _________.</span><o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>--- Motion Begins ---</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>That the CA/Browser Forum Server Certificate Working Group adopt the following requirements as amendments to the Network and Certificate System Security Requirements.</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Replace 1.c. with " Maintain Root CA Systems in a High Security Zone and as Air-Gapped CA Systems, in accordance with Section 5;"</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Add definition of "Air-Gapped CA System" as "A system that is kept offline or otherwise air-gapped and separated from other systems and that is used by a CA or Delegated Third Party in storing and managing CA private keys and performing signing operations."</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:0cm;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Add a new Section 5 -</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><b><span style='font-size:18.0pt;font-family:"Times New Roman",serif;color:black'>5. GENERAL PROTECTIONS FOR AIR-GAPPED CA SYSTEMS</span></b><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>This Section 5 separates requirements for Air-Gapped CA Systems into two categories--logical security and physical security.</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><b><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Logical Security of Air-Gapped CA Systems</span></b><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Certification Authorities and Delegated Third Parties SHALL implement the following controls to ensure the logical security of Air-Gapped CA Systems:</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>a. Review static configurations of Air-Gapped CA Systems at least on an annual basis to determine whether any changes violated the CA’s security policies;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>b. Follow a documented procedure for appointing individuals to Trusted Roles on Air-Gapped CA Systems;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>c. Grant logical access to Air-Gapped CA Systems only to persons acting in Trusted Roles and require their accountability for the Air-Gapped CA System's security;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>d. Document the responsibilities and tasks assigned to Trusted Roles and implement "separation of duties" for such Trusted Roles based on the security-related concerns of the functions to be performed;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>e. Ensure that an individual in a Trusted Role acts only within the scope of such role when performing administrative tasks assigned to that role;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>f. Require employees and contractors to observe the principle of "least privilege" when accessing, or when configuring access privileges on, Air-Gapped CA Systems;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>g. Require that all access to systems and offline key material can be traced back to an individual in a Trusted Role (through a combination of recordkeeping, use of logical and physical credentials, authentication factors, video recording, etc.);</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>h. If an authentication control used by a Trusted Role is a username and password, then, where technically feasible require that passwords have at least twelve (12) characters;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>i. Review logical access control lists at least annually and deactivate any accounts that are no longer necessary for operations;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>j. Enforce Multi-Factor Authentication OR multi-party authentication for administrator access to Air-Gapped CA Systems;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>k. Identify those Air-Gapped CA Systems capable of monitoring and logging system activity and enable those systems to continuously monitor and log system activity. Back up logs to an external system each time the system is used or on a quarterly basis, whichever is less frequent;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>l. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, check the integrity of the logical access logging processes and ensure that logging and log-integrity functions are effective;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>m. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, monitor the archival and retention of logical access logs to ensure that logs are retained for the appropriate amount of time in accordance with the disclosed business practices and applicable legislation.</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>n. Reserved for future use</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>o. Reserved for future use</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><b><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Physical Security of Air-Gapped CA Systems</span></b><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>Certification Authorities and Delegated Third Parties SHALL implement the following controls to ensure the physical security of Air-Gapped CA Systems:</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>p. Grant physical access to Air-Gapped CA Systems only to persons acting in Trusted Roles and require their accountability for the Air-Gapped CA System’s security;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>q. Ensure that only personnel assigned to Trusted Roles have physical access to Air-Gapped CA Systems and multi-person access controls are enforced at all times;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>r. Implement a process that removes physical access of an individual to all Air-Gapped CA Systems within twenty four (24) hours upon termination of the individual’s employment or contracting relationship with the CA or Delegated Third Party;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>s. Implement video monitoring, intrusion detection, and intrusion prevention controls to protect Air-Gapped CA Systems against unauthorized physical access attempts;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>t. Implement a Security Support System that monitors, detects, and reports any security-related configuration change to the physical access to Air-Gapped CA Systems;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>u. Review all system accounts on physical access control lists at least every three (3) months and deactivate any accounts that are no longer necessary for operations;</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>v. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, monitor the archival and retention of the physical access logs to ensure that logs are retained for the appropriate amount of time in accordance with the disclosed business practices and applicable legislation.</span><o:p></o:p></p><p style='mso-margin-top-alt:12.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:black'>w. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, check the integrity of the physical access logging processes and ensure that logging and log-integrity functions are effective.</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>--- Motion Ends ---</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Discussion Period - </span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>This ballot proposes a Final Maintenance Guideline.</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>The procedure for approval of this ballot is as follows:</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Discussion (7+ days)</span><o:p></o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Start Time: 2020-11-XX 17:00 UTC</span><o:p></o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>End Time: not before 2020-11-XX 17:00 UTC</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Vote for approval (7 days)</span><o:p></o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>Start Time: TBD</span><o:p></o:p></p><p style='margin:0cm'><span style='font-size:10.0pt;font-family:"Courier New";color:black'>End Time: TBD</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></div></div></blockquote></div></div></div></div></body></html>