2022-07-19 Minutes of the Network Security Working Group
CA/Browser Forum NetSec Meeting
Attendance
- Aaron Poulsen – Amazon
- Adam Jones – Microsoft
- Amanda Mendieta – Apple
- Ben Wilson – Mozilla
- Bruce Morton – entrust
- Clint Wilson – Apple
- Corey Bonnell – DigiCert
- Corey Rasmussen – OATI
- Daryn Wright – GoDaddy
- David Kluge – Google Trust Services
- Iñigo Barreira – Sectigo
- Janet Hines – SecureTrust
- Jillian Karner – Let’s Encrypt
- Jozef Nigut – Disig
- Marcelo Silva – Visa
- Prachi Jain – Fastly
- Rebecca Kelley – Apple
- Tobias Josefowitz – Opera
- Tony Seymour – Comsign
- Trevoli Ponds – Amazon Trust Services
Minutes
1. Roll Call
a. Clint Wilson took attendance
2. Read Antitrust Statement
a. Clint Wilson read the antitrust statement
3. Review Agenda
a. Cloud Services Risk Assessment Effort Update (David Kluge)
b. Zones Ballot/ Air Gapped Offline (Ben Wilson)
c. GitHub Definitions
4. Cloud Services Sub-Group Risk Assessment effort (David Kluge)
b. The Assessment Threat Modeling of the OCSP Responders (The first component of the model architecture) has been completed due to a great amount of feedback.
c. Next area of focus is the Storage of certificates or certificate database.
d. Always appreciate those who have the extra time to work on the document offline during the week.
5. Ballots (Ben Wilson)
a.No updates at this time
b.** **** Touched on briefly at end of meeting to cover definitions ******
6. GitHub Definitions
a.Reviewed and provided feedback on section that covers the 96 hour process for remediation of critical vulnerabilities.
- Propose a rewrite or modification to this section
b. Reviewed and Provided feedback on a section that covers “Restrict the scope of the NCSSRS”
c. Reviewed and provided feedback over “Define and modify references to “Account” #6”
d. Reviewed and provided feedback on all subjects listed in GitHub to become more familiar with each topic needing attention.
- Looked at in depth over “Clarify “Cannot be leveraged for a denial of service attack” #16”.
e. Group liked “Revise 2.g-k. authentication #16” to work on
f. Ben generated labels/ tags to assist with topic recognition within GitHub