[Servercert-wg] Ballot SC40: Security Requirements for Air-Gapped CA Systems

[Jos Purvis (jopurvis)]

Should add: Ben’s email below formally opens the discussion period for this ballot as of 2021-02-02 21:00 UTC, which will conclude 2021-02-09 21:00 UTC if no further updates are required. 😊


--
Jos Purvis (jopurvis at cisco.com<mailto:jopurvis at cisco.com>)
.:|:.:|:. cisco systems | Cryptographic Services
PGP: 0xFD802FEE07D19105 | Controls and Trust Verification


From: Servercert-wg <servercert-wg-bounces at cabforum.org> on behalf of CABF Server Cert WG <servercert-wg at cabforum.org>
Reply-To: Ben Wilson <bwilson at mozilla.com>, CABF Server Cert WG <servercert-wg at cabforum.org>
Date: Tuesday, February 2, 2021 at 3:26 PM
To: CABF Server Cert WG <servercert-wg at cabforum.org>
Subject: [Servercert-wg] Ballot SC40: Security Requirements for Air-Gapped CA Systems


Ballot SC40: Security Requirements for Air-Gapped CA Systems


Purpose of the Ballot:


This ballot increases the security of Air-Gapped/Offline CA systems (“Air-Gapped CA Systems”) by clarifying the controls that CAs must implement to protect them.


Air-Gapped CA systems (usually Root CA private keys) are maintained in highly secure locations, and while they can share certain exterior physical controls with online systems, they are not connected to online systems or the Internet. Thus, they have different operational requirements and controls due to their separate risk profile. While the scope of the current Network and Certificate System Security Requirements (NCSSRs) includes Air-Gapped CA systems, the current NCSSRs focuses on online systems and contains a number of requirements that are not practical to implement in an offline environment and could actually increase the risk to such offline systems.

As an example, access to offline/air-gapped CA systems frequently elevates the risk to the environment. A quarterly vulnerability scan in the offline environment is not practical, because there is an increased risk involved with attaching a scanning device to such Air-Gapped CA system. Just as another example among several, because such systems are not connected, the provisions of subsection 1.g (ports and protocols) are not applicable.

This ballot develops a working definition for an “Air-Gapped CA System” to allow for a clear delineation between those system components that fall under this category of Air-Gapped/Offline requirements and those under other requirements. In doing so, the ballot creates two sets of requirements tailored to their respective operating environments and characteristics.

Not only does this ballot introduce a new section 5, it also adds additional physical security requirements for air-gapped CAs by requiring video monitoring, intrusion detection, and other intrusion prevention controls to protect Air-Gapped CA Systems against unauthorized physical access attempts. The new section 5 presents logical security requirements in subsections a through m and physical security requirements in subsections p through w.


These proposed subsections in the proposed new section 5 are based on sections 1 through 3 of the existing NCSSRs as follows:


Description

Offline

Criteria #

General

Criteria #

Logical Security of Air-Gapped CA Systems

Configuration review

5a

1h

Appointing individuals to trusted roles

5b

2a

Grant access to Air-Gapped CAs

5c

1i

Document responsibilities of Trusted roles

5d

2b

Segregation of duties

5e

2d

Require least privileged access for Trusted Roles

5f

2e

All access tracked to individual account

5g

2f

Password requirements

5h

2gi

Review logical access

5i

2j

Implement multi-factor access

5j

2m

Monitor Air-Gapped CA systems

5k

3b

Review logging integrity

5l

3e

Monitor archive and retention of logs

5m

3f

Physical Security of Air-Gapped CA Systems

Grant physical access

5p

1i

Multi-person physical access

5q

1j

Review physical access

5r

2j

Video monitoring

5s

3a

Physical access monitoring

5t

3a

Review accounts with physical access

5u

2j

Monitor retention of physical access of records

5v

3f

Review integrity of physical access logs

5w

3e


This motion is made by Ben Wilson of Mozilla and endorsed by David Kluge of Google Trust Services and Neil Dunbar of TrustCor.


--- Motion Begins ---


That the CA/Browser Forum Server Certificate Working Group adopt the following requirements as amendments to the Network and Certificate System Security Requirements.


1. Replace the current language in section 1.c. with "Maintain Root CA Systems in a High Security Zone and as Air-Gapped CA Systems, in accordance with Section 5;"

2. Add a definition of "Air-Gapped CA System" as "A system that is kept offline or otherwise air-gapped and separated from other systems and that is used by a CA or Delegated Third Party in storing and managing CA private keys and performing signing operations."

3. Revise the definition of Security Support System to read:

"A system used to provide physical and logical security support functions, which MAY include authentication, network boundary control, audit logging, audit log reduction and analysis, vulnerability scanning, and intrusion detection (physical intrusion detection, Host-based intrusion detection, Network-based intrusion detection)."

4. Add a new Section 5 to read as follows:

5. GENERAL PROTECTIONS FOR AIR-GAPPED CA SYSTEMS

This Section 5 separates requirements for Air-Gapped CA Systems into two categories--logical security and physical security.

Logical Security of Air-Gapped CA Systems

Certification Authorities and Delegated Third Parties SHALL implement the following controls to ensure the logical security of Air-Gapped CA Systems:

a. Review configurations of Air-Gapped CA Systems at least on an annual basis;

b. Follow a documented procedure for appointing individuals to those Trusted Roles that are authorized to operate Air-Gapped CA Systems;

c. Grant logical access to Air-Gapped CA Systems only to persons acting in Trusted Roles and implement controls so that all logical access to Air-Gapped CA Systems can be traced back to an accountable individual;

d. Document the responsibilities assigned to Trusted Roles based on the security principle of multi-person control and the security-related concerns of the functions to be performed;

e. Ensure that an individual in a Trusted Role acts only within the scope of such role when performing administrative tasks assigned to that role;

f. Require employees and contractors to observe the principle of "least privilege" when accessing, or when configuring access privileges on, Air-Gapped CA Systems;

g. Require that all access to systems and offline key material can be traced back to an individual in a Trusted Role (through a combination of recordkeeping, use of logical and physical credentials, authentication factors, video recording, etc.);

h. If an authentication control used by a Trusted Role is a username and password, then, where technically feasible require that passwords have at least twelve (12) characters;

i. Review logical access control lists at least annually and deactivate any accounts that are no longer necessary for operations;

j. Enforce Multi-Factor Authentication OR multi-party authentication for administrator access to Air-Gapped CA Systems;

k. Identify those Air-Gapped CA Systems capable of monitoring and logging system activity and enable those systems to continuously monitor and log system activity. Back up logs to an external system each time the system is used or on a quarterly basis, whichever is less frequent;

l. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, check the integrity of the logical access logging processes and ensure that logging and log-integrity functions are effective;

m. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, monitor the archival and retention of logical access logs to ensure that logs are retained for the appropriate amount of time in accordance with the disclosed business practices and applicable legislation.

n. Reserved for future use

o. Reserved for future use

Physical Security of Air-Gapped CA Systems

Certification Authorities and Delegated Third Parties SHALL implement the following controls to ensure the physical security of Air-Gapped CA Systems:

p. Grant physical access to Air-Gapped CA Systems only to persons acting in Trusted Roles and implement controls so that all physical access to Air-Gapped CA Systems can be traced back to an accountable individual;

q. Ensure that only personnel assigned to Trusted Roles have physical access to Air-Gapped CA Systems and multi-person access controls are enforced at all times;

r. Implement a process that removes physical access of an individual to all Air-Gapped CA Systems within twenty-four (24) hours upon termination of the individual’s employment or contracting relationship with the CA or Delegated Third Party;

s. Implement video monitoring, intrusion detection, and intrusion prevention controls to protect Air-Gapped CA Systems against unauthorized physical access attempts;

t. Implement a Security Support System that monitors, detects, and alerts personnel to any physical access to Air-Gapped CA Systems;

u. Implement a process that prevents physical access of an individual to an Air-Gapped CA within twenty-four (24) hours of removal from the relevant authorized Trusted Role, and review lists of holders of physical keys and combinations to doors and safes as well as logical accounts tied to physical access controls at least every three (3) months, and;

v. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, monitor the archival and retention of the physical access logs to ensure that logs are retained for the appropriate amount of time in accordance with the disclosed business practices and applicable legislation.

w. On a quarterly basis or each time the Air-Gapped CA System is used, whichever is less frequent, check the integrity of the physical access logging processes and ensure that logging and log-integrity functions are effective.


--- Motion Ends ---


Discussion Period -


This ballot proposes a Final Maintenance Guideline.


The procedure for approval of this ballot is as follows:


Discussion (7+ days)

Start Time: 2021-02-02 21:00 UTC

End Time: not before 2021-02-09 21:00 UTC


Vote for approval (7 days)

Start Time: TBD

End Time: TBD
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20210202/16f5b43b/attachment-0001.html>