2022-08-16 Minutes of the Network Security Working Group

CA/Browser Forum NetSec Meeting

Attendance: Adam Jones – Microsoft Aaron Poulsen – Amazon Trust Services Ben Wilson – Mozilla Bruce Morton – entrust Clint Wilson – Apple Corey Bonnell – DigiCert Corey Rasmussen – OATI Daryn Wright – Go Daddy Dustin Hollenback – Microsoft Joanna Fox – TrustCor Kiran Tummala – Microsoft Rebecca Kelley – Apple Ruben Annemans – GlobalSign Tim Crawford – BDO Tobias Josefowitz – Opera Trevoli Ponds – Amazon Trust Services Wendy Brown – FPKI

Minutes:

1. Read Antitrust Statement a. Clint Wilson read the antitrust statement
2. Roll Call a. No new members in attendance
3. Review Agenda a. Approved minutes from previous meetings b. Meta Update (Clint Wilson) c. Update on Air-Gapped Systems Ballot (Ben Wilson) d. Open for other business
4. Meta Update a. Moving and closing out previous backlog in the server working group to a repository in GitHub over the next few weeks.
5. Update on Air Gap Systems Ballot

• Reviewed and discussed all multiple aspects of section 5 i. Questions and commentary focused on what the review encompasses and what is the expected outcome. Looking for more details. ii. Language and terms need to be updated/changed due to over-specification on configuration iii. Find a location for Network Security guidelines or requirements within document, as it doesn’t fit into this section well. Iv. Discussed Patch Management in relation to this ballot v. Discussed Certificate Management in relation to this ballot
• Possible goal of changes summarized by Clint Wilson: “For a CA to successfully and Ideally, in a timely manner, detect an unexpected change occurred to the area of any part of the Air-gapped Systems.”
• Reviewed System Designs section and discussed vulnerabilities language in Section 4.

6. Other Business a. Possibly schedule additional meeting to go more in-depth into language and understanding of the Air Gapped Systems Ballot. b. Corey Rasmussen asked if the group had address how the updated versions (ie; OpenSSL) even get on the air-gapped systems? (Marked as a follow up question and will be placed on next agenda topics in regards to this ballot)