[Servercert-wg] Potential addition to Cleanups and Clarifications Ballot about Section 5.4.1

[Ponds-White, Trevoli]

As a part of the network security meetings we’ve been looking a lot at the requirements related to logging procedures. One question that came up is whether or not the last 4 lines of section 5.4.1 are a subset of 3.f or part of section 5.4.1 as a whole. Because of the tabbing the format of the last 4 lines looks like it’s part of section 5.4.1 as a whole but when you read it it doesn’t seem consistent with that section and makes more sense as being specifically a part of 5.4.1.3.f.

If it’s supposed to be part of 3.f can it be reformatted in the cleanup ballot? If there is consensus that it’s not a part of 3.f the net sec group can include an edit to the language in an upcoming ballot. We have a draft ballot with a relevant reason to edit the list IF it’s not a subset of 3.f.

To give you an idea here are the last 11 lines of section 5.4.1.

Security events, including:

a.       Successful and unsuccessful PKI system access attempts;

b.       PKI and security system actions performed;

c.       Security profile changes;

d.       System crashes, hardware failures, and other anomalies;

e.       Firewall and router activities; and

f.        Entries to and exits from the CA facility.

Log entries MUST include the following elements:

1.       Date and time of entry;

2.       Identity of the person making the journal entry; and

3.       Description of the entry.

Thoughts?

- Trev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/servercert-wg/attachments/20200514/eda18320/attachment-0001.html>