Restrict the scope of the NCSSRs

[BenWilson-Mozilla]

2019-Mar-07: Daymion’s approach would be to restrict the scope of the Network Security Requirements (in the Scope section at the beginning of the document). He is considering adding the following:
The network security requirements apply to all system components included in or connected to the publicly trusted certificate authority (CA) environment. The CA environment consists of people, processes and technologies that store, process, or transmit CA data. “System components” include network devices, servers, hardware security modules(HSM), computing devices, and applications residing within the CA environment. Examples of system components include, but are not limited to the following:
a. Systems that provide security services (for example, authentication servers), facilitate segmentation (for example, internal firewalls), or may impact the security of (for example, name resolution or web redirection servers).
b. Virtualization components such as virtual machines, virtual switches/routers, virtual appliances, virtual applications/desktops, and hypervisors.
c. Network components including but not limited to firewalls, switches, routers, network appliances, HSM and other security appliances.
d. Server types including but not limited to web, application, database, authentication, mail, proxy, Network Time Protocol (NTP), and Domain Name System (DNS).
e. Applications including all purchased and custom applications.
f. Any other component or device located within the CA environment.
To be considered out of scope for CA environment, a system component must be properly isolated (segmented) from the CA environment, such that even if the out-of-scope system component was compromised it could not impact the security of the CA environment.
His proposal would also add definitions for “Certificate Authority Environment” (“The area where certificates are generated, and stored for later transmission to the requester”) and “Connected To” (“Components within the certificate authority environment which exchange data”).
The group discussed parts of the proposed language. The phrase “connected to” received the most criticism because it seemed to be too broad – anything could be considered “connected” whether it is operating, transmitting, or exchanging data. Similarly, “exchange data” was discussed.