Guidelines for auditing Grid CAs Yoshio Tanaka AIST, Japan

background APGrid PMA is doing external (mutual) audit. The purpose of auditing is to improve CA operation NAREGI has subjectively selected audit items from the WebTrustTM Criteria based on the minimum CA requirements. It would be helpful to have documentation which justifies the choices describes the detailed procedures of auditing e.g. how each item should be verified? by document review, interview, or inspection ?

Proposed contents (1/4) Introduction Audit checklist describes audit items and justifies them. Procedures of auditing Pre examination: static review of documents (~weeks) CP/CPS Manuals for subscribers (e.g. enrollment manual) Operational manuals (for CA operators) CA repository checks whether all documents described as “published on the repository” in the CP/CPS are available CA Certificate CRL End entity certificates HSM manual (or appropriate web site) As a result of pre-examination, an auditor prepares score sheets and figures out issues need to be interviewed.

Proposed contents (2/4) Procedures of auditing (cont’d) Main examination: interview & inspection (half day) interview (~ 3 hours) All issues which were not clarified by static review will be interviewed to the CA operators. An auditor especially interested in How the CA private key is protected (including access control to the CA room). Enough events have been recorded? Flow chart of issuing end entity certificates. (1) generate a key pair (2) send a CSR (3) RA verifies the end entity (4) RA communicates with the CA (5) CA issues an end entity certificate (6) the end entity obtains her/his certificate

Proposed contents (3/4) Procedures of auditing (cont’d) Main examination: interview & inspection (half day) (cont’d) inspection (~ 1 hour) All archived logs CA system log emails records of how the RA verified end entities … Facilities, devices CA room (how the access is controlled) CA server (including network connection) RA server Repository (web) server HSM backup media a safe box

Proposed contents (4/4) Procedures of auditing (cont’d) Post examination: draft report Send the report to the CA The CA is requested to send a report which describes plans (including schedule) for the improvements.

Plans for drafting NGO/Singapore uses a commercial CA (Netrust Inc.) Netrust agreed to publish their audit report. confidential and available only for APGrid PMA auditors I’ll review the audit report, then draft this document. PROMISE to draft by the next GGF in Tokyo 

a question How to justify the audit checklist audit items were subjectively selected from WebTrustTM criteria based on the minimum CA requirements. Does ‘justify’ mean to justify the minimum CA requirements?