Review NSR Ballot SC03 - Two Factor Authentication and Password Improvements

[weirdscience]

SC3 Ballot: https://cabforum.org/2018/08/16/ballot-sc3-two-factor-authentication-and-password-improvements/

SC3 Github: cabforum/servercert@4a98c09#diff-50fc941f7be640a0bf58764b83d5d9e7

Looks like four new additions to the NSR and we've incorporated the NSR in the CP. The section interpretation is our own because the NSR is not in a RFC 3647 format.

• Group accounts or shared role credentials shall not be used.

• Good. CP Section 5.2.3 "All trusted roles shall use a unique credential created by or assigned to a single individual for identification and authentication."

• Revised password requirements for trusted role access using a username or password.

• Good. Both the Root and Issuer CPS require MFA for all trusted roles. Possibly consider updating CP to match MFA reference in CPS or add password requirements to keep it flexible and compliant. CP Section 5.2.3 "CAs shall implement multi-factor or multi-party authentication for all Administrator trusted role access to Certificate System Components including operating system and software."

• Have a policy (vice require) for log out or lock when a workstation is no longer used.

• Potential CP update. No CP or CPS reference of an inactivity log or lock. Only related to failed access attempts. CP 6.6.2 "All system accounts and trusted role accounts shall have be configured to lockout access after five (5) failed access attempts"

• Have a procedure to configure (vice just configure) inactivity time-outs.

• Potential CP update. Same as above. May not need to update CP if both root and issuer have an SOP to configure inactivity time-outs.

[weirdscience]

These were integrated into CP v0.4.

[weirdscience]

Retract last statement. Did not make it in the v0.4.

[lachellel]

I caught these in 28cea42

For a statement that says "have a policy" - USG has many policies including those defined and governed by DoD, NIST, OMB, DHS (govt wide), and other Agency level. As a practice, CA operator teams should not be develop/write local policies and can reference an existing govt policy.

[weirdscience]

Looks like ready to close.