The Readiness Assessment Report based on“WebTrust Principles and Criteria for Certification Authorities– SSL Baseline with Network Security”

September 30, 2015
Administrative Management Bureau,
Ministry of Internal Affairs and Communications

The Application CA 2(“APCA2”) and a Local Registration Authority (“LRA”) of theGovernmental Public Key Infrastructure (“GPKI”) had the Readiness Assessment based on“WebTrust Principles and Criteria for Certification Authorituies – SSL Baseline with Network
Security” by KPMG AZSA LLC.
Please refer to the following.

1

PurposeThis assessment is to report the result of assessment for any gaps on design andimplementation of requirements by comparing “WebTrust Principles and Criteria for
Certification Authorities – SSL Baseline with Network Security” with rules of the Certificate
Policy (CP) and Certification Practice Statement (CPS) ,etc. and other related documents of the
Application CA 2(“APCA2”) and a Local Registration Authority (“LRA”) of theGovernmental Public Key Infrastructure (“GPKI”) as of September 16, 2015.
This assessment report described the gaps found at this assessment.

2

Overview of this assessment
2.1

Criteria
The criteria used at this assessment is “CPA Canada WebTrust Principles and Criteria
for Certification Authorities – SSL Baseline with Network Security – Version 2.0” (“thiscriteria”).
Principles of this criteria are as follows:

2.2

PRINCIPLE 1

Baseline Requirements Business Practices Disclosure

PRINCIPLE 2

Service Integrity

PRINCIPLE 3

CA Environmental Security

PRINCIPLE 4

Network and Certificate Systems Security

Scope
The scope of this assessment is below:
CA

APCA2 (Root)
APCA2 (Sub)Ministry LRA

2.3

LRA of the Ministry of Internal Affairs and Communications

Procedures
At this assessment, in order to assess how meet the requirements described in this criteria
for the above CAs and LRA, our procedures include reading related rules, inspecting one
sample of evidence for each requirement, interviewing their personnel and observing
related facilities. The findings at this assessment are described in section 3.

3

Results
Refer to the attachment

Attachment: Findings Description
No.
1

Baseline Requirements
Ref.
Criteria
1.1
The CA discloses on its website its:
(snip)
its commitment to conform to thelatest version of the Baseline
Requirements for the Issuance andManagement of Publicly-Trusted
Certificates issued by the
CA/Browser Forum.
1.4

Findings
According to WTBR, the CA shall develop,
implement, enforce, and annually update a
Certificate Policy and/or Certification PracticeStatement that describes in detail how the CA
implements the latest version of these
Requirements.

The CP/CPS provide the Application CA2complies with guidelines of the latest version of
The Certificate Authority has controls the"AICPA/CICA WebTrust Program forto provide reasonable assurance that Certification Authorities " and "CA/Browser
the CA CP and/or CPS that describes Forum, Baseline Requirements for the Issuanceand Management of Publicly-Trusted Certificates
how the CA implements the latest
version of the Baseline Requirements ", and that these guidelines have a priority to the
CP/CPS if there is any inconsistency between these
are updated annually.
guidelines' requirements and the CP/CPS.
However, there are several inconsistencies notcomplying with WTBR. These inconsistencies
are as described below.
Therefore, the CAs and LRA shall operate inaccordance with all WTBR requirements.

2

2.3.4

Subscriber Agreement and Terms of According to WTBR, a Subscriber Agreement
Use
and/or Terms of Use shall contain the following
The CA maintains controls andtwo items, an obligation to respond to the CA’s
procedures to provide reasonable
instructions and an entitlement to revoke theassurance that the CA, prior to thecertificate.
issuance of a Certificate, obtains a
Subscriber and/or Terms of Use
However, the two items mentioned above are notagreement in accordance with thedescribed in the Terms of Use.
SSL Baseline Requirements Section
10.3.1. That agreement contains
Therefore, the CAs shall update the Terms of Use
provisions imposing obligations and to contain an obligation to respond to the CA’s
warranties on the Application relating instructions and an entitlement to revoke theto:certificate.
(snip)・ responsiveness・ acknowledgement andacceptance.

3

2.5.2

The CA maintains controls to provide
reasonable assurance that it:(snip)
begin investigation of Certificate
Problem Reports within 24 hours:

According to WTBR, the CA shall begin
investigation of Certificate Problem Report within
24 hours of receipt.
The above requirement is established for problem
reports between LRA and CA, however as to the
CA (GPKI) response to problem reports fromsubscription users, investigation of Certificate

No.

Baseline Requirements
Ref.
Criteria

Findings
Problem Report is designed to start within 24 hours
of receipt in business days, but not on holidays.
Therefore, CAs shall establish a process that the
CA (GPKI) response to problem reports fromsubscription users can begin investigation within
24 hours on holidays.

4

2.6.2

The CA maintains controls to provide
reasonable assurance that:(snip)
the CA requires all Validation
Specialists to pass an examination
provided by the CA on theinformation verification requirements
outlined in the Baseline
Requirements.

According to WTBR, the LRA shall require all
Validation Specialists to pass an examination
provided by the LRA on the information
verification requirements.
However, the LRA only requires all Validation
Specialists to participate in a training (basic
education, security training, privacy dataprotection, requirements of verification), but
passing an examination after training is not
required.
Therefore, the LRA shall document and implementa policy to have all Validation Specialists passing
an examination provided by the CA afterparticipating the training.

5

2.6.2

The CA maintains controls to provide
reasonable assurance that:(snip)
the CA documents each Validation
Specialist possesses the skills
required by a task before allowing the
Validation Specialist to perform thattask.

According to WTBR, the CA shall document each
Validation Specialist possesses the skills requiredby a task before allowing the Validation Specialist
to perform that task.
However, the LRA has not a rule to document
skills required for a specific task for each
Validation Specialist before he/she performs thetask.
Therefore, the LRA shall document skill required
for specific tasks for each Validation Specialist.

6

2.6.6

The CA maintains controls to provide
reasonable assurance that the CA
internally audits each DelegatedThird Party’s compliance with theBaseline Requirements on an annual
basis.

According to WTBR, the CA shall internally audit
each Delegated Third Party’s compliance withWTBR on an annual basis.
However, the CAs do not perform the WTBR
compliance audit for neither IA nor LRA, whereas
they perform the internal audits for WebTrust andtheir CP/CPS.
Therefore, the CAs shall include the WTBR
compliance for IA and LRA in the scope of theirinternal audit.

7

2.7.2

The CA maintains controls to provide According to WTBR, the CA and each DelegatedNo.

Baseline Requirements
Findings
Ref.
Criteria
reasonable assurance that theThird Party shall record details of the actions taken
following events are recorded:
to process a certificate request, including(snip)(1)Time of processing a certificate request
CA and Subscriber Certificate(2)Communications with the applicant.
lifecycle management events,
including:
There is no field to record the processing time and・Certificate Requests, renewal and communication description with the applicants on
the form ruled by the LRA internal operation
re-key requests, and revocation
・ all verification activities stipulated procedures, although the form has the date field.
In addition, although their internal operationin the Baseline Requirements andprocedures require that the Validation Specialist
the CA’s Certification Practice
should record the results of verification on thisStatement
form, they do not use it, but use a different form.
・ date, time, phone number used,persons spoken to, and end results
The LRA shall add the fields to this form in orderof verification telephone calls
to record the processing time and communication・acceptance and rejection ofdescription with the applicants and operate to use
certificate requests
this form effectively.
・ issuance of Certificates・ generation of Certificate
Revocation Lists (CRLs) and
OCSP entries.

8

2.7.3

The CA has a policy and maintains
According to WTBR, the CA shall retain any audit
controls to provide reasonablelogs generated after the effective date for at least
assurance that audit logs generated
seven years.
after the effective date of the Baseline
Requirements are retained for at least However, the policy has documented that firewall
seven years.
log is retained at three years.
Therefore, the CAs shall update the rule to retain
firewall log at least seven years.

9

10

2.8.1

2.8.3

The CA maintains controls to provide
reasonable assurance that thefollowing requirements are followed
for Subordinate CAs:
(snip)
for a Subordinate CA that is nottechnically constrained:
・the CA verifies that Subordinate
CAs that are not technicallyconstrained are audited inaccordance with SSL Baseline
Requirements 17.1.

According to WTBR, the CA shall ensure that theSubordinate CA meets all applicable Baseline
Requirements.

The CA maintains controls to provide
reasonable assurance that:・it performs ongoing
self-assessments on at least aquarterly basis against a randomly
selected sample of at least three

According to WTBR, the CA shall monitor
adherence to its CP/CPS and WTBR and strictly
control its service quality by performing self audits
on at least a quarterly basis against a randomly
selected sample of certificate.

However, the subordinate CA (APCA2 (Sub)) has
not been audited in accordance with theserequirements.
Therefore, the APCA2 (Sub) in addition to the
APCA2 (Root) shall be taken the WTBR audit.

No.

Baseline Requirements
Ref.
Criteria
percent (3%) of the Certificatesissued during the period
commencing immediately after theprevious self-assessment samples
was taken.

Findings
However, as to the sample based self audits
including LRA, performed by the CAs, there are no
rules to audit whether the RA procedures were
performed in compliance with WTBR. And also,
the CAs did not retain sufficient evidence of theseaudits.
Therefore, the CAs shall document the audit
procedures to monitor their RA process incompliance with WTBR, and retain sufficient audit
evidence.

11

3.9

The CA maintains controls to provide
reasonable assurance that personnel
and employment practices enhanceand support the trustworthiness of the
CA’s operations.

According to WTBR, the CA shall provide all
personnel performing information verification
duties with skills-training.
However, the CA internal operation procedures
require that the members' training should bedetermined by the LRA controller, and that each
LRA member should study the knowledge andtechniques needed at starting the LRA work.
Therefore, they do not have a unified education
standard and do not have any curriculum fortraining the all LRA personnel including LRA
controllers.
Therefore, the CAs shall document the rule thatthey establish the unified training plan in theinternal operation procedures, and the LRA shall
implement those processes covering the controller
and all other personnel in LRA.

12

4.1

The CA maintains controls to provide
reasonable assurance that:(snip)
Authentication keys and passwords
for any privileged account or service
account on a Certificate System ischanged, when a person’s
authorization to administratively
access that account on the Certificate
System is changed or revoked;

According to WTBR, each CA or Delegated Third
Party shall change authentication keys andpasswords for any privileged accounts or service
account on a Certificate System whenever a
person's authorization to administrative access ischanged or revoked.
However, the CAs and LRA’s internal operation
procedures require that the LRA personnel have tochange the password only but do not have tochange the authentication key when a personnel isreplaced or terminated.
Therefore, the CAs and LRA shall document andimplement the rule of authentication key change of
IC authentication card, not only password change,
when a personnel is replaced or terminated.

13

4.1

The CA maintains controls to provide According to WTBR 4.1, each CA or Delegatedreasonable assurance that:
Third Party shall implement multi-factor

No.

Baseline Requirements
Ref.
Criteria(snip)
Multi-factor authentication is
implemented to each component of
the Certificate System that supports
it;
The CA maintains controls to provide
4.2
reasonable assurance that:(snip)
Enforce multi-factor
authentication for administrator
access to Issuing Systems andCertificate Management Systems;

Findings
authentication to each component of the Certificate
System.
According to WTBR 4.2, the CAs shall implement
multi-factor authentication for administrator accessto Issuing Systems and Certificate Management
Systems.
The CAs implement multi-factor authentication to
Issuing Systems by password and IC card.
However, for some administrator accounts on
Certificate Management Systems the CAs do not
implement the logical multi-factor authentication,
whereas they implement the physical facility
access control and the logical password
authentication.
Therefore, the CAs shall implement multi-factor
authentication for these accounts to Certificate
Management Systems.

14

4.2

The CA maintains controls to provide
reasonable assurance that:(snip)
Review all system accounts at least
every 90 days and deactivate any
accounts that are no longer necessary
for operations;

According to WTBR, each CA or Delegated Third
Party shall review all system accounts at least
every 90 days.
However, the review of all operator user accounts
is performed every 6 months for the CAs.
Therefore, the CAs shall update the rule to performthe accounts review every 90 days.

15

4.2

The CA maintains controls to provide
reasonable assurance that:(snip)Disable all privileged access of anindividual to Certificate Systems
within 24 hours upon termination of
the individual’s employment orcontracting relationship with the CA
or Delegated Third Party;

According to WTBR, each CA or Delegated Third
Party shall implement a process that disables allprivileged access of an individual to Certificate
Systems within 24 hours upon termination of theindividual’s employment or contracting
relationship with the CA or Delegated Third Party.
However, the CAs disable privileged access of theindividual’s employment or contracting
relationship by deleting the physical access of theirfacilities.
Therefore, the CAs shall document the rule andimplement to delete not only the physical access,but also the logical access, e.g. the administrator's
password change, within 24 hours upon
termination of the individual’s employment orcontracting relationship with them.

16

4.2

The CA maintains controls to provide According to WTBR, each CA or Delegated Third
reasonable assurance that:
Party shall implement the controls to require that

No.

Baseline Requirements
Findings
Ref.
Criteria(snip)
passwords have at least twelve (12) characters for
Trusted Role using an username and accounts that are not publicly accessible
password to authenticate shall(accessible only within Secure Zones or High
configure accounts to include but not Security Zones).
be limited to
However, for some user accounts, the internal
・Passwords have at least
operation procedures require at least 8 characters
twelve (12) characters forand 8 characters are actually implemented.
accounts not publicly
accessible (accessible only within
Therefore, the CAs shall update the rule andSecure Zones or High Security
implement to have at least 12 characters for all
Zones);
・Configure passwords for accounts accounts.
that are accessible from outside a
Secure Zone or High Security Zone
to have at least eight (8) characters,
be changed at least every 90 days,
use a combination of at least
numeric and alphabetic characters,
and not be one of the user’s
previous four passwords; andimplement account lockout for
failed access attempts; OR・Implement a documented password
management and account lockout
policy that the CA has determined
provide at least the same amount ofprotection against password
guessing as the foregoing controls.

17

4.2

The CA maintains controls to provide
reasonable assurance that:(snip)
Trusted Role use a unique credential
created by or assigned to that person
for authentication to Certificate
Systems;

According to WTBR, each CA or Delegated Third
Party shall require that each individual in a Trusted
Role use a unique credential created by or assigned
to that person for authentication to Certificate
Systems.
However, the users of a LRA system can spoof theothers because of improper control of their IC
authentication cards and passwords.
Therefore, the LRA shall perform proper
management of IC authentication cards andpasswords.

18

4.4

The CA maintains controls to provide
reasonable assurance that:(snip)A formal documented vulnerability
correction process is followed andincludes identification, review,
response, and remediation ofvulnerabilities;

According to WTBR, the CA and Delegated Third
Party shall document a vulnerability correction
process including identification, review, response,
and remediation of vulnerabilities.
The CAs collect vulnerability information on adaily basis and also perform the vulnerability
identification, review, response, and remediation
against the vulnerability scan and penetration test

No.

Baseline Requirements
Ref.
Criteria

Findings
results.
However, the CA does not have any documentationof policies for these activities.

19

4.4

Therefore, the CAs shall document the rule thatvulnerability correction process and improve theprocess to include the penetration test results.
The CA maintains controls to provide According to WTBR, the CA and Delegated Third
reasonable assurance that:
Parties shall perform a Vulnerability Scan based on(snip)
the following:
Perform a Vulnerability Scan on
・Target systempublic and private IP addresses
All related Certificate Systems
identified by the CA or Delegated・Target IP Address
Third Party as the CA’s or DelegatedPublic and private IP addresses
Third Party’s Certificate Systems
・Frequency
based on the following:Within one week of receiving a request from the・Within one week of receiving a
CA/Browser Forum,
request from the CA/Browser
After any system or network changes that theForum,CA determines are significant, and・After any system or network
At least once per quarter, on public and privatechanges that the CA determines are IP addresses identified by the CA or Delegatedsignificant, andThird Party as the CA’s or Delegated Third Party’s
・At least once per quarter;
Certificate Systems.
However, per inspection of the scan report, thefrequency of the scan is annual, and targeted
servers and IP addresses are limited.
Therefore, the CAs shall document and implement
the vulnerability scan policy based on WTBR
including their target systems, target IP addresses
and frequency.

20

4.4

The CA maintains controls to provide According to WTBR, the CA and Delegated Third
reasonable assurance that:
Party shall undergo a Penetration Test on the CA’s
(snip)and each Delegated Third Party’s Certificate
Perform a Penetration Test on the
Systems on at least an annual basis and after
CA’s and each Delegated Third
infrastructure or application upgrades or
Party’s Certificate Systems on at least modifications that the CA determines arean annual basis and after
significant.
infrastructure or application upgrades
However, per inspection of the report, they perform
or modifications that the CA
these tests as a part of the vulnerability scan on an
determines are significant;annual basis, these tests are insufficient against thePenetration Test requirements in WTBR.
Therefore, the CAs shall document the rule andimplement to undergo Penetration Test of which
contents are in conformity with WTBR.

21

4.4

The CA maintains controls to provide According to WTBR, the CA and Delegated Third
reasonable assurance that:
Party shall record evidence that each Vulnerability

No.

Baseline Requirements
Ref.
Criteria(snip)
Document that Vulnerability Scan
and Penetration Test was performed
by a person or entity with the skills,
tools, proficiency, code of ethics, andindependence necessary to provide areliable Vulnerability Scan or
Penetration Test;

Findings
Scan and Penetration Test was performed by aperson or entity (or collective group thereof) withthe skills, tools, proficiency, code of ethics, andindependence necessary to provide a reliable
Vulnerability Scan or Penetration Test.
However, per inspection of the report ofVulnerability Scan and Penetration Test, there were
not any records of the above items required by
WTBR.
Therefore, the CAs shall document and implement
the rule of recording the above items in
Vulnerability Scan and Penetration Test reports.

22

4.4

The CA maintains controls to provide According to WTBR, the CA and Delegated Third
reasonable assurance that:
Parties shall perform one of the following (i) –(snip)(iii) within 96 hours of discovery of a Critical
Perform one of the following within Vulnerability not previously addressed by the CA’svulnerability correction process:96 hours of discovery of a Critical
Vulnerability not previously
addressed by the CA’s vulnerability (i) Remediate the Critical Vulnerability;(ii) If remediation of the Critical Vulnerability
correction process:within 96 hours is not possible, create and・Remediate the Criticalimplement a plan to mitigate the Critical
Vulnerability;
Vulnerability, giving priority to the following:・If remediation of the Critical(1) Vulnerabilities with high CVSS scores,
Vulnerability within 96 hours is
starting with the vulnerabilities thenot possible, create andCA determines are the most critical; andimplement a plan to mitigate the(2) Systems that lack sufficient compensating
Critical Vulnerability, giving
controls that, if the vulnerability were left
priority to the following:
unmitigated, would allow external
・Vulnerabilities with high CVSS
system control, code execution,
scores, starting with theprivilege escalation, or system compromise;vulnerabilities the CA determinesor
are the most critical (such as those(iii) Document the factual basis for the CA’s
with a CVSS score of 10.0); anddetermination that the vulnerability does not
・Systems that lack sufficientrequire remediation because of one of thecompensating controls that, if thefollowing:
vulnerability were left unmitigated,(a) The CA disagrees with the NVD rating;would allow external system(b) The identification is a false positive;
control, code execution,(c) The exploit of the vulnerability is prevented
privilege escalation, or system
by compensating controls or an absence ofcompromise; orthreats;
Document the factual basis for the(d)Other similar reasons.
CA’s determination that thevulnerability does not require
The CA’s internal operation procedures document
remediation because of one of thea correction process based on materiality andfollowing:priority of correction.
・The CA disagrees with the NVD
However, there are some gaps between the actual
rating;correction process and WTBR, such as no rules of・The identification is a false positive;
the correction process within 96 hours.
・The exploit of the vulnerability is

No.

Baseline Requirements
Findings
Ref.
Criteria
prevented by compensating
controls or an absence of threats; or Therefore, the CAs shall update and implement the
Other similar reasons.
rules of vulnerability correction process based on
WTBR.