2022-12-06 Minutes of the Network Security Working Group

Attendance:

Adam Jones – Microsoft

Ben Wilson – Mozilla

David Kluge – Google

Jozef Night – Disig

Paul van Brouwershaven – Entrust

Prachi Jain – Fastly

Rebecca Kelley – Apple

Tim Crawford – BDO

Wendy Brown – FPKI

Minutes:

Read Antitrust Statement

Clint Wilson read the antitrust statement

2.   Roll Call

No new members in attendance

3.   Review Agenda

Review and Approval of Nov 8th and F2F in Oct minutes

New Meeting times in 2023 (NEXT MEETING JAN 3rd)

Will send out poll to vote on what time works best for all.

https://cabf.webex.com/cabf/j.php?MTID=m0192d60c00c649d7c4c5d0dfceb74ef2

Risk Assessment/ Cloud Services review (David Kluge)

Continue Air Gapped CAs project (Ben Wilson)

5. Risk Assessment/ Cloud Services

Not ready at the point to draft ballot, but did have a call to proceed with the Cloud Requirements. 

Chose a CCM (Cloud Security Alliance Risk Control Matrix) as the standard to align with 

Compliance department made a mapping between the CCM and the NSRs, and found the CCM (in the short amount of time) had significant changes, and the mapping was no longer valid. 

Requested a new mapping, for the most recent version of the CCM to the NSRs. 

Received this mapping 

c. Next step is to map the results of the Threat Modeling against the CCM. 

a. If a good mapping, then work on the CCM instead of drafting new requirements.

d. David Kluge showed the map, and reviewed findings with group

e. Paul van Brouwershaven shared a link that shows a mapping between CCM and CIS

a. https://www.cisecurity.org/controls/v8#v8-mappings

b. https://www.cisecurity.org/controls/cis-controls-navigator/ (click add on the right top to add frameworks to compare, click the individual items to see the control numbers)

f. Is there a licensing concern if we utilized CCM? Auditors would have to decide. 

8. Air-Gapped Systems document (Redline)

Comparing the existing NSRs Requirements, to the new Requirements that would be set up for Air Gapped CAs. 

b. Ben compared the one way mapping that was discussed, and made marks in the documents where the comparisons fit best. 

c. Ben made some edits sections 1-4

a. Add phrase “air-gapped CA” I sections 1-4, identifying it as a separate systems

b. Need to differentiate between the systems, to avoid overlap in definitions. 

d. Ben asked if “Air-Gapped” needs to be redefined to make it more clear on which one is offline CAs and the other is Air Gapped systems. 

a. Need requirements to focus more specifically to help define the difference.

e. Paul van Brouwershaven mentioned this topic has been frequently debated in the Net Sec meetings before.

a. Would it help to make requirements under each description? 

b. Ben brought up having objectives and controls 

d. Ben brought up the idea of reorganizing the document to make it easier for mapping, audit frameworks, and cross-referencing. 

e. More discussion went into the definition of Air Gapped systems and Air Gapped CA Systems. 

Check Also

2023-01-12 Minutes of the Code Signing Certificate Working Group

Attendees Atsushi Inaba, Ben Dewberry, Corey Bonnell, Dean Coclin, Dimitris Zacharopoulos, Inigo Barreira, Janet Hines, …