1. Guidelines for auditing Grid CAs
Yoshio Tanaka
AIST, Japan

2. background APGrid PMA is doing external (mutual) audit.
The purpose of auditing is to improve CA operation
NAREGI has subjectively selected audit items from the WebTrustTM Criteria based on the minimum CA requirements.
It would be helpful to have documentation which
justifies the choices
describes the detailed procedures of auditing
e.g. how each item should be verified? by document review, interview, or inspection ?

3. Proposed contents (1/4) Introduction Audit checklist
describes audit items and justifies them.
Procedures of auditing
Pre examination: static review of documents (~weeks)
CP/CPS
Manuals for subscribers (e.g. enrollment manual)
Operational manuals (for CA operators)
CA repository
checks whether all documents described as “published on the repository” in the CP/CPS are available
CA Certificate
CRL
End entity certificates
HSM manual (or appropriate web site)
As a result of pre-examination, an auditor prepares score sheets and figures out issues need to be interviewed.

4. Proposed contents (2/4) Procedures of auditing (cont’d)
Main examination: interview & inspection (half day)
interview (~ 3 hours)
All issues which were not clarified by static review will be interviewed to the CA operators.
An auditor especially interested in
How the CA private key is protected (including access control to the CA room).
Enough events have been recorded?
Flow chart of issuing end entity certificates. (1) generate a key pair (2) send a CSR (3) RA verifies the end entity (4) RA communicates with the CA (5) CA issues an end entity certificate (6) the end entity obtains her/his certificate

5. Proposed contents (3/4) Procedures of auditing (cont’d)
Main examination: interview & inspection (half day) (cont’d)
inspection (~ 1 hour)
All archived logs
CA system log s
records of how the RA verified end entities …
Facilities, devices
CA room (how the access is controlled)
CA server (including network connection)
RA server
Repository (web) server
HSM
backup media
a safe box

6. Proposed contents (4/4) Procedures of auditing (cont’d)
Post examination: draft report
Send the report to the CA
The CA is requested to send a report which describes plans (including schedule) for the improvements.

7. Plans for drafting NGO/Singapore uses a commercial CA (Netrust Inc.)
Netrust agreed to publish their audit report.
confidential and available only for APGrid PMA auditors
I’ll review the audit report, then draft this document.
PROMISE to draft by the next GGF in Tokyo 

8. a question How to justify the audit checklist
audit items were subjectively selected from WebTrustTM criteria based on the minimum CA requirements.
Does ‘justify’ mean to justify the minimum CA requirements?