2022-11-08 Minutes of the Network Security Working Group
CA/Browser Forum NetSec Meeting Attendance: Adam Jones – Microsoft; Aaron Poulsen – Amazon Trust Services; Ben Wilson – Mozilla; Clint Wilson – Apple; Corey Rasmussen – OATI; David Kluge – Google; Joanna Fox – TrustCor; Marcelo Silva – Visa; Paul van Brouwershaven – Entrust; Pedro Fuentes – OISTE; Prachi Jain – Fastly; Rebecca Kelley – Apple; Ruben Annemans – GlobalSign; Tim Crawford – BDO; Tobias Josefowitz – Opera
Minutes
Read Antitrust Statement
Clint Wilson read the antitrust statement 2. Roll Call
No new members in attendance 3. Review Agenda
Waiting to approve minutes from previous meeting that was held at the F2F
New Meeting time and link https://cabf.webex.com/cabf/j.php?MTID=m0192d60c00c649d7c4c5d0dfceb74ef2
Risk Assessment/ Cloud Services review (David Kluge)
Continue Air Gapped CAs project (Ben Wilson) 5. Risk Assessment/ Cloud Services
The first round of the assessment is complete. Now in Revision 1 Last call it was decided to move into the drafting stage
The CCM (Cloud Security Alliance Risk Control Matrix) was brought to the attention of the group, and propose a mapping between the CCM and the NSR’s, with additional mapping for the threats that have been identified. Next points to be addressed are to either write requirements or just reference the CCM. Aaron Poulsen commented that this is beneficial, as some are unfamiliar with the cloud control matrix (CCM). They do have a cross-walk with other programs, and feels there should be control requirements that are familiar.
8.Air-Gapped Systems document.
Reviewed slides that were presented at the F2F – Review definitions (Glossary Working Group) – Replace zones – Miscellaneous items b. Look at the possible reorganization of the section “Trusted Roles” – Possibly move into Section 5 (RFC 3647 section) – Section 5.2.1 could possibly work c. Clint suggested an exercise of comparing what has been written and compare it against published version. – Trusted roles may have to be a separate project d. Reviewed Sections 5 and 2