[cabf_netsec] SCXX: Offline CA Security Requirements

[Ben Wilson]

Thanks, Pavan,

Here is another draft:

Replace 1.c. with " Maintain Root CA Systems in a High Security Zone and as
Air-Gapped CA Systems, in accordance with Section 5;"

Add definition of "Air-Gapped CA System" as " A system that is kept offline
or otherwise air-gapped and separated from other systems used by a CA or
Delegated Third Party in storing and managing CA private keys and
performing signing and logging operations."

Add a new Section 5 -

5. GENERAL PROTECTIONS FOR AIR-GAPPED CA SYSTEMS

This Section 5 separates requirements for Air-Gapped CA Systems into two
categories--logical security and physical security.

*Logical Security of Air-Gapped CA Systems*

Certification Authorities and Delegated Third Parties SHALL implement the
following controls to ensure the logical security of Air-Gapped CA Systems:

a. Review static configurations of Air-Gapped CA Systems at least on an
annual basis to determine whether any changes violated the CA’s security
policies;

b. Follow a documented procedure for appointing individuals to Trusted
Roles on Air-Gapped CA Systems;

c. Grant logical access to Air-Gapped CA Systems only to persons acting in
Trusted Roles and require their accountability for the Air-Gapped CA
System's security;

d. Document the responsibilities and tasks assigned to Trusted Roles and
implement "separation of duties" for such Trusted Roles based on the
security-related concerns of the functions to be performed;

e. Ensure that an individual in a Trusted Role acts only within the scope
of such role when performing administrative tasks assigned to that role;

f. Require employees and contractors to observe the principle of "least
privilege" when accessing, or when configuring access privileges on,
Air-Gapped CA Systems;

g. Require that all access to systems and offline key material can be
traced back to an individual in a Trusted Role (through a combination of
recordkeeping, use of logical and physical credentials, authentication
factors, video recording, etc.);

h. If an authentication control used by a Trusted Role is a username and
password, then, where technically feasible require that passwords have at
least twelve (12) characters;

i. Review logical access control lists at least annually and deactivate any
accounts that are no longer necessary for operations;

j. Enforce Multi-Factor Authentication OR multi-party authentication for
administrator access to Air-Gapped CA Systems;

k. Identify those Air-Gapped CA Systems capable of monitoring and logging
system activity and enable those systems to continuously monitor and log
system activity. Back up logs to an external system each time the system is
used or on a quarterly basis, whichever is less frequent;

l. On a quarterly basis or each time the Air-Gapped CA System is used,
whichever is less frequent, check the integrity of the logical access
logging processes and ensure that logging and log-integrity functions are
effective;

m. On a quarterly basis or each time the Air-Gapped CA System is used,
whichever is less frequent, monitor the archival and retention of logical
access logs to ensure that logs are retained for the appropriate amount of
time in accordance with the disclosed business practices and applicable
legislation.

n. Reserved for future use

o. Reserved for future use

*Physical Security of Air-Gapped CA Systems*

Certification Authorities and Delegated Third Parties SHALL implement the
following controls to ensure the physical security of Air-Gapped CA Systems:

p. Grant physical access to Air-Gapped CA Systems only to persons acting in
Trusted Roles and require their accountability for the Air-Gapped CA
System’s security;

q. Ensure that only personnel assigned to Trusted Roles have physical
access to Air-Gapped CA Systems and multi-person access controls are
enforced at all times;

r. Implement a process that removes physical access of an individual to all
Air-Gapped CA Systems within twenty four (24) hours upon termination of the
individual’s employment or contracting relationship with the CA or
Delegated Third Party;

s. Implement video monitoring, intrusion detection, and prevention controls
to protect Air-Gapped CA Systems against unauthorized physical access
attempts;

t. Implement a Security Support System that monitors, detects, and reports
any security-related configuration change to the physical access to
Air-Gapped CA Systems;

u. Review all system accounts on physical access control lists at least
every three (3) months and deactivate any accounts that are no longer
necessary for operations;

v. On a quarterly basis or each time the Air-Gapped CA System is used,
whichever is less frequent, monitor the archival and retention of the
physical access logs to ensure that logs are retained for the appropriate
amount of time in accordance with the disclosed business practices and
applicable legislation.

w. On a quarterly basis or each time the Air-Gapped CA System is used,
whichever is less frequent, check the integrity of the physical access
logging processes and ensure that logging and log-integrity functions are
effective.


On Mon, Jun 29, 2020 at 2:47 PM Chander, Pavan <pchander at deloitte.ca> wrote:

> Hi Ben,
>
>
>
> I notice there aren’t any changes to 1.c in your diff. Just wanted to
> check if that was a purposeful omission?
>
>
>
> Now that your proposed wording defines Offline CA Systems as air-gapped,
> perhaps requirement 1.c about Root CAs being in either “offline state OR
> air-gapped” should be updated to either say “offline AND air-gapped” or
> something similar to “Maintain Root CA Systems in a High Security Zone as
> an Offline CA System”?
>
>
>
> Pavan
>
>
>
> *From:* Netsec <netsec-bounces at cabforum.org> *On Behalf Of *Ben Wilson
> via Netsec
> *Sent:* Monday, June 29, 2020 12:14 PM
> *To:* CABF Network Security List <netsec at cabforum.org>
> *Subject:* [EXT] [cabf_netsec] SCXX: Offline CA Security Requirements
>
>
>
> The Document Structure subgroup (Tim Crawford, David Kluge, and myself)
> met this morning and finalized the following ballot.  We need a proposer
> and two endorsers:
>
>
>
>
> https://github.com/cabforum/documents/compare/095fc4f7992dbd186503a4b0ec4e643ae4ea1624...BenWilson-Mozilla:
> 99ea75f4ad19c58a7f9eb2829e63fb1678a838fa
> <https://secure-web.cisco.com/1xWwZd_cmeFl6Wo_6UnD9yndY-91SE2BLQMB66tkJxNbdveawFdMG_dr9LWTsW1fgDVwMiS_8LaIZXgfaqYETPEu3j6PnWGrwkWsRkIdgj_DM8YJ33XziwfwlLH3MN_Br9VDqnSD2GutwLZekzB4gEPisbmmUVHAwtA4Kvz6jBiEIvXdHsXVoS3l9ZfaQtby1FcOt1Qkl8fbZdZ5MXCLpoOCE7GzJElyWhF_c7_8uV6wR8UlGN7lpl93ubChysPb6etjUMF2ikThUPLxT7kHOs6JJPMjRhdOHt_zQJMVvnykLz5JPDe2bdo94McAJQ5hclWG7d10oiAtnM4y79R1r8w/https%3A%2F%2Fgithub.com%2Fcabforum%2Fdocuments%2Fcompare%2F095fc4f7992dbd186503a4b0ec4e643ae4ea1624...BenWilson-Mozilla%3A99ea75f4ad19c58a7f9eb2829e63fb1678a838fa>
>
>
>
> Thanks,
>
>
>
> Ben
>
> *Confidentiality Warning:*
>
> *Deloitte refers to a Deloitte member firm, one of its related entities,
> or Deloitte Touche Tohmatsu Limited (“DTTL”). Each Deloitte member firm is
> a separate legal entity and a member of DTTL. DTTL does not provide
> services to clients. Please see *www.deloitte.com/about* to learn more.*
>
> *This message and any attachments are intended only for the use of the
> intended recipient(s), are confidential, and may be privileged. If you are
> not the intended recipient, you are hereby notified that any review,
> retransmission, conversion to hard copy, copying, circulation or other use
> of this message and any attachments is strictly prohibited. If you are not
> the intended recipient, please notify the sender immediately by return
> e-mail, and delete this message and any attachments from your system. Thank
> You.*
>
> *If you do not wish to receive future commercial electronic messages from
> Deloitte, forward this email to *unsubscribe at deloitte.ca
>
> *Avertissement de confidentialité:*
>
> *Deloitte désigne un cabinet membre de Deloitte, une de ses entités liées
> ou Deloitte Touche Tohmatsu Limited (DTTL). Chaque cabinet membre de
> Deloitte constitue une entité juridique distincte et est membre de DTTL.
> DTTL n’offre aucun service aux clients. Pour en apprendre davantage, voir *
> www.deloitte.com/ca/apropos*.*
>
> *Ce message, ainsi que toutes ses pièces jointes, est destiné
> exclusivement au(x) destinataire(s) prévu(s), est confidentiel et peut
> contenir des renseignements privilégiés. Si vous n’êtes pas le destinataire
> prévu de ce message, nous vous avisons par la présente que la modification,
> la retransmission, la conversion en format papier, la reproduction, la
> diffusion ou toute autre utilisation de ce message et de ses pièces jointes
> sont strictement interdites. Si vous n’êtes pas le destinataire prévu,
> veuillez en aviser immédiatement l’expéditeur en répondant à ce courriel et
> supprimez ce message et toutes ses pièces jointes de votre système. Merci.*
>
> *Si vous ne voulez pas recevoir d’autres messages électroniques
> commerciaux de Deloitte à l’avenir, veuillez envoyer ce courriel à
> l’adresse *unsubscribe at deloitte.ca
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/netsec/attachments/20200806/5ab0ff12/attachment.html>