CA/Browser Forum
Home » Posts » 2022-12-06 Minutes of the Network Security Working Group

2022-12-06 Minutes of the Network Security Working Group

Attendance

Adam Jones – Microsoft

Ben Wilson – Mozilla

David Kluge – Google

Jozef Night – Disig

Paul van Brouwershaven – Entrust

Prachi Jain – Fastly

Rebecca Kelley – Apple

Tim Crawford – BDO

Wendy Brown – FPKI

Minutes

Read Antitrust Statement

Clint Wilson read the antitrust statement

2. Roll Call

No new members in attendance

3. Review Agenda

Review and Approval of Nov 8th and F2F in Oct minutes

New Meeting times in 2023 (NEXT MEETING JAN 3rd)

Will send out poll to vote on what time works best for all.

https://cabf.webex.com/cabf/j.php?MTID=m0192d60c00c649d7c4c5d0dfceb74ef2

Risk Assessment/ Cloud Services review (David Kluge)

Continue Air Gapped CAs project (Ben Wilson)

5. Risk Assessment/ Cloud Services

Not ready at the point to draft ballot, but did have a call to proceed with the Cloud Requirements.

Chose a CCM (Cloud Security Alliance Risk Control Matrix) as the standard to align with

Compliance department made a mapping between the CCM and the NSRs, and found the CCM (in the short amount of time) had significant changes, and the mapping was no longer valid.

Requested a new mapping, for the most recent version of the CCM to the NSRs.

Received this mapping

c. Next step is to map the results of the Threat Modeling against the CCM.

a. If a good mapping, then work on the CCM instead of drafting new requirements.

d. David Kluge showed the map, and reviewed findings with group

e. Paul van Brouwershaven shared a link that shows a mapping between CCM and CIS

a. https://www.cisecurity.org/controls/v8#v8-mappings

b. https://www.cisecurity.org/controls/cis-controls-navigator/ (click add on the right top to add frameworks to compare, click the individual items to see the control numbers)

f. Is there a licensing concern if we utilized CCM? Auditors would have to decide.

8. Air-Gapped Systems document (Redline)

Comparing the existing NSRs Requirements, to the new Requirements that would be set up for Air Gapped CAs.

b. Ben compared the one way mapping that was discussed, and made marks in the documents where the comparisons fit best.

c. Ben made some edits sections 1-4

a. Add phrase “air-gapped CA” I sections 1-4, identifying it as a separate systems

b. Need to differentiate between the systems, to avoid overlap in definitions.

d. Ben asked if “Air-Gapped” needs to be redefined to make it more clear on which one is offline CAs and the other is Air Gapped systems.

a. Need requirements to focus more specifically to help define the difference.

e. Paul van Brouwershaven mentioned this topic has been frequently debated in the Net Sec meetings before.

a. Would it help to make requirements under each description?

b. Ben brought up having objectives and controls

d. Ben brought up the idea of reorganizing the document to make it easier for mapping, audit frameworks, and cross-referencing.

e. More discussion went into the definition of Air Gapped systems and Air Gapped CA Systems.

Latest releases
Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed

Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.6 - Ballot SMC08 - Aug 29, 2024

This ballot sets a date by which issuance of certificates following the Legacy generation profiles must cease. It also includes the following minor updates:

  • Pins the domain validation procedures to v 2.0.5 of the TLS Baseline Requirements while the ballot activity for multi-perspective validation is concluded, and the SMCWG determines its corresponding course of action;
  • Updates the reference for SmtpUTF8Mailbox from RFC 8398 to RFC 9598; and
  • Small text corrections in the Reference section

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).