Updates on draft ballot to allow Log Storage Systems in cloud environments

[Corey Bonnell]

Hello,

First, thank you for the excellent discussion and feedback on the initial proposal to permit log storage/”archive” systems to be operated in cloud environments. I especially thank Dustin for his comments and concrete language suggestions on the initial PR.

 

I have incorporated the feedback and Dustin’s concrete text into a new branch in the cabforum/netsec Github repository and have opened a draft PR in the netsec repo to continue the discussion there: https://github.com/cabforum/netsec/pull/59.

 

I welcome feedback on the proposal thus far and your suggestions to improve the draft. One area that likely needs improving is the new section 5, which was heavily inspired from TLS BR section 3.2.2.9 regarding best practices for MPIC Remote Perspective operation.

 

A few concerns raised on last week’s call regarding new section 5 (and likely applicable to TLS BR 3.2.2.9) were:

 

1. Lack of clarity regarding whether the specific items listed in Section 5 are CA obligations or the cloud operator’s obligations
2. Lack of alignment between the vulnerability scanning and management functions in TLS BR 3.2.2.9/draft NSR section 5.2 and NSR section 4.

 

Given the interplay between TLS BR 3.2.2.9 and the NSRs here, likely we want to come up with a single solution that is applicable to both documents. It’s probably best to tackle this topic here in netsec WG and bring the conclusions reached in netsec back to servercert WG, but that can certainly be discussed.

 

Thanks again for the discussion and feedback so far and I look forward to further improving this draft ballot.

 

Thanks,

Corey

[Corey Bonnell]

Hello,

Thanks for the further discussion on this ballot. I think we’re getting close to finalizing the language.

 

I went ahead and updated the PR to reflect the today’s (and last week’s) discussion, in particular:

 

1. Introduce definition for “Shared Responsibility Model”
2. Rework Section 5 to remove specific and potentially confusing configuration guidance and instead require a risk assessment and follow the third-party provider’s Shared Responsibility Model.

 

Please take a look at the changes and let me know (either here on the list or on Github) which additional changes should be made.

 

Thanks,

Corey

--
You received this message because you are subscribed to the Google Groups "NetSec WG - Public (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to netsec+un...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/netsec/DS0PR14MB6216A741E9B277B03107A90D92252%40DS0PR14MB6216.namprd14.prod.outlook.com.

[Ben Wilson]

Hi Corey,

I made a few suggestions in PR#59.  I'll endorse a ballot.

Ben

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/netsec/DS0PR14MB6216CDFCDDE1FC698C3856F7922C2%40DS0PR14MB6216.namprd14.prod.outlook.com.