[Servercert-wg] Ballot SC 21 - Section 3 of the NetSec Requirements - Voting Period

Tue Oct 1 02:16:48 MST 2019

HARICA votes "yes" to ballot SC21.

On 27/9/2019 2:15 π.μ., Ben Wilson via Servercert-wg wrote:
>
> Ballot SC21: To Revise a Final Maintenance Guideline - the Network and 
> Certificate Systems Security Requirements section 3.e. to allow for 
> continuous, automated monitoring; edit section 3.f. to improve 
> wording, and add section 3.g. to establish a response time for 
> automated alerts.
>
> Purpose of Ballot
>
> The Network and Certificate System Security Requirements committee is 
> proposing this ballot to revise the current requirements to better 
> allow for automation and continuous monitoring of systems. The goal of 
> this ballot is to remove manual efforts that can be less effective and 
> more resource-intensive than automated monitoring and alerting.
>
> This ballot also adds specific requirements in terms of the timeliness 
> for addressing alerting from automated monitoring and alerting to 
> ensure the implementation of automation does not increase the length 
> of time that a potential issue could go without being detected.
>
> It is proposed by Ben Wilson of DigiCert and endorsed by Trevoli 
> Ponds-White of Amazon and Fotis Loukos of SSL.com to revise the 
> Network and Certificate System Security Requirements (Requirements) as 
> set forth in the following language of Section 3 of the Requirements, 
> to be EFFECTIVE  ninety (90) days after completion of the IPR Review 
> Period:
>
> *— BALLOT BEGINS —*
>
> DELETE SUBSECTIONS e. and f. of SECTION 3 OF THE NETWORK AND 
> CERTIFICATE SYSTEM SECURITY REQUIREMENTS
>
> AND
>
> INSERT THE FOLLOWING IN SECTION 3:
>
> e.        Monitor the integrity of the logging processes for 
> application and system logs through continuous automated monitoring 
> and alerting or through a human review to ensure that logging and 
> log-integrity  functions are effective. Alternatively, if a human 
> review is utilized and the system is online, the process must be 
> performed at least once every 31 days.
>
> f.        Monitor the archival and retention of logs to ensure that 
> logs are retained for the appropriate amount of time in accordance 
> with the disclosed business practices and applicable legislation.
>
> g.        If continuous automated monitoring and alerting is utilized 
> to satisfy sections 1.h. or 3.e. of these Requirements, respond to the 
> alert and initiate a plan of action within at most twenty-four (24) hours.
>
> *— BALLOT ENDS —*
>
> The procedure for approval of this ballot is as follows:
>
> Voting (7 days)
>
> Start Time: 23:00 UTC, Thursday, September 26, 2019
>
> End Time: 23:00 UTC, Thursday, October 3, 2019
>
> *** WARNING ***:  USE THE PDF ATTACHMENT / GITHUB AT YOUR OWN RISK.  
> THE REDLINE VERSIONS PROVIDED ARE NOT THE OFFICIAL VERSION OF THE 
> CHANGES AND THE BALLOT VERSION ABOVE TAKES PRECEDENCE OVER SUCH 
> REDLINE VERSIONS IN ACCORDANCE WITH SECTION 2.4.1 OF THE FORUM BYLAWS: 
> https://github.com/cabforum/documents/compare/master...tobij:25169b17812645641b9843426eb0af41d8e96ec6 
>
>
>
> _______________________________________________
> Servercert-wg mailing list
> Servercert-wg at cabforum.org
> http://cabforum.org/mailman/listinfo/servercert-wg

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/servercert-wg/attachments/20191001/b82ea51e/attachment.html>