CA/Browser Forum
Home » All CA/Browser Forum Posts » 2022-11-08 Minutes of the Network Security Working Group

2022-11-08 Minutes of the Network Security Working Group

CA/Browser Forum NetSec Meeting Attendance: Adam Jones – Microsoft; Aaron Poulsen – Amazon Trust Services; Ben Wilson – Mozilla; Clint Wilson – Apple; Corey Rasmussen – OATI; David Kluge – Google; Joanna Fox – TrustCor; Marcelo Silva – Visa; Paul van Brouwershaven – Entrust; Pedro Fuentes – OISTE; Prachi Jain – Fastly; Rebecca Kelley – Apple; Ruben Annemans – GlobalSign; Tim Crawford – BDO; Tobias Josefowitz – Opera

Minutes

Read Antitrust Statement

Clint Wilson read the antitrust statement 2. Roll Call

No new members in attendance 3. Review Agenda

Waiting to approve minutes from previous meeting that was held at the F2F

New Meeting time and link https://cabf.webex.com/cabf/j.php?MTID=m0192d60c00c649d7c4c5d0dfceb74ef2

Risk Assessment/ Cloud Services review (David Kluge)

Continue Air Gapped CAs project (Ben Wilson) 5. Risk Assessment/ Cloud Services

The first round of the assessment is complete. Now in Revision 1 Last call it was decided to move into the drafting stage

The CCM (Cloud Security Alliance Risk Control Matrix) was brought to the attention of the group, and propose a mapping between the CCM and the NSR’s, with additional mapping for the threats that have been identified. Next points to be addressed are to either write requirements or just reference the CCM. Aaron Poulsen commented that this is beneficial, as some are unfamiliar with the cloud control matrix (CCM). They do have a cross-walk with other programs, and feels there should be control requirements that are familiar.

8.Air-Gapped Systems document.

Reviewed slides that were presented at the F2F – Review definitions (Glossary Working Group) – Replace zones – Miscellaneous items b. Look at the possible reorganization of the section “Trusted Roles” – Possibly move into Section 5 (RFC 3647 section) – Section 5.2.1 could possibly work c. Clint suggested an exercise of comparing what has been written and compare it against published version. – Trusted roles may have to be a separate project d. Reviewed Sections 5 and 2

Latest releases
Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.6 - Ballot SMC08 - Aug 29, 2024

This ballot sets a date by which issuance of certificates following the Legacy generation profiles must cease. It also includes the following minor updates: Pins the domain validation procedures to v 2.0.5 of the TLS Baseline Requirements while the ballot activity for multi-perspective validation is concluded, and the SMCWG determines its corresponding course of action; Updates the reference for SmtpUTF8Mailbox from RFC 8398 to RFC 9598; and Small text corrections in the Reference section

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).