- WG-IDAssurance - mailman.kantarainitiative.org

Addressing the infosec posture of KI
by Richard G. WILSHER (＠Zygma Inc.) 05 Oct '23

05 Oct '23

In response to your comments in this vein Kay (IAWG mtg 2023-10-05), the two first thoughts into my head are: 1) Secure the TSL. This document is fundamental to KI's being and a lot of parties (Approved CSPs, Accredited Assessors and those seeking the services of those listed on it) rely upon its integrity and availability. Our TSL follows the principles of the Trust List defined in the attached ETSI standard. However, it is not hosted as an electronic list in the manner described in that standard and therefore it is not cryptographically signed nor machine searchable. The standard goes into some depth to describe the purpose and structure of each element plus it allows for list-owner specific extensions where required. I daresay there are apps which can support the populating and provisioning of such lists, though I've not recently explored this. The key point however is that we would have a secure digitally-signed list in a manner which adopts a defined standard, which is what we're all about. 2) Getting certified against IS27001 wouldn't be a bad idea. Lead from the front! Happy to contribute further in exploring these points. Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

2 1

Join in an hour - Invitation & Agenda for IAWG Call 2023-10-05
by Amanda Gay 05 Oct '23

05 Oct '23

Dear IAWG Members, Please join us in an hour at *12pm *US Eastern Time (Thursday, October 5th) for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom details are below. *Date and Time* - *Date: Thursday, 2023-10-05* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - 2023-09-21 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/264339457/2023-9-21+Me…> - 2023-9-28 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/267452417/2023-9-28+DR…> - Kantara Updates - Assurance Updates 2. *Discussion: * - CO_SAC Updates: Richard’s updated analysis (an additional note on CO#0050), linked here <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> 3. *Any Other Business* Please let me know any questions or concerns! Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation & Agenda for IAWG Call 2023-10-05
by Amanda Gay 03 Oct '23

03 Oct '23

Dear IAWG Members, Please join us today in an hour at *12pm *US Eastern Time (Thursday, October 5th) for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-08-24* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - 2023-09-21 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/264339457/2023-9-21+Me…> - 2023-9-28 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/267452417/2023-9-28+DR…> - Kantara Updates - Assurance Updates 2. *Discussion: * - CO_SAC Updates: Richard’s updated analysis (an additional note on CO#0050), linked here <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> 3. *Any Other Business* Please let me know any questions or concerns! Best, -A -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 0

Invitation & Agenda for IAWG Call 2023-09-28
by Amanda Gay 28 Sep '23

28 Sep '23

Dear IAWG Members, Please join us at *12pm *US Eastern Time on Thursday, September 28 for our next IAWG meeting. If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey.* The survey can be accessed at https://www.surveymonkey.com/r/KI_DEIA. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-08-24* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - 2023-09-21 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/264339457/2023-9-21+Me…> - Kantara Updates - Assurance Updates 2. *Discussion: * - Charter and Structure Discussion 3. *Any Other Business* Reach out with any concerns/questions! Best, -Amanda -- *Amanda Gay | **Administrative** Coordinator* *Twitter:* @KantaraNews *LinkedIn:* @KantaraInitiative

1 1

Improper amendment to 63B#1900
by Richard G. WILSHER (＠Zygma Inc.) 26 Sep '23

26 Sep '23

A few weeks ago, during our IAWG call, we agreed to amend 63B#1900 as shown below: 63B#1900 The CSP SHALL revoke promptly the binding of authenticators to the Subject's online identity, unless prohibited by any legal instrument, and give notice of such to the Subject, when any one of the following occurs: 63B#1900 a) the Subject's online identity ceases to exist; OR 63B#1900 b) the Subject requests revocation; OR 63B#1900 c) the CSP determines that the Subject no longer meets its eligibility requirements; OR 63B#1900 d) the CSP is obligated to do so in response to a legal instrument. This time the baby went out with the bath water. Whilst I find the revision to the main clause to be acceptable (well, a minor tweak to the grammar, see below), we should NOT have eliminated sub-clause d). This clause actually requires the CSP to respond to a legal instrument requiring that they revoke, so must be retained. The introduced clause should be taken to be a broad reference to ANY legal prohibition, whereas d) applies to an express order or instruction. I therefore suggest that the change should be only as shown below (purple text just to be clear about differentiation): 63B#1900 The CSP SHALL revoke promptly the binding of authenticators to the Subject's online identity and, unless prohibited by any legal instrument, and give notice of such to the Subject, when any one of the following occurs: 63B#1900 a) the Subject's online identity ceases to exist; OR 63B#1900 b) the Subject requests revocation; OR 63B#1900 c) the CSP determines that the Subject no longer meets its eligibility requirements; OR 63B#1900 d) the CSP is obligated to do so in response to a legal instrument. Lessons? Maybe always allow a little breathing time between what look like good changes but may deserve more consideration before pouring the concrete (not sure what that has to do with babies and bathwater, but . subject for discussion this week?) Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Request: CO_SAC Review Against ISMS Schemes
by Lynzie Adams 22 Sep '23

22 Sep '23

Hello IAWG, This is a follow-up to Richard Wilsher's email below from 9/16. During the IAWG call yesterday, the group reviewed his suggestions and felt as though they were appropriate. We are requesting individuals in IAWG to review Richard's first cut analysis and examine in light of FEDRAMP and 27001 - and anyone with specialized knowledge of other potential ISMS schemes is requested to do a similar analysis using those schemes (i.e., SOC2 Type 2). The IAWG will revisit this on October 5. Please plan to attend that call if you are able to do an analysis. Lynzie Adams Assurance Program Manager On Sat, Sep 16, 2023 at 8:40 PM Richard G. WILSHER (@Zygma Inc.) < RGW(a)zygma.biz> wrote: > As actioned (by myself!) during the most recent IAWG mtg, herewith a first > stab at how the CO_SAC could/should be reviewed for potential revisions to > accomplish at least the following objectives: > > 1) Aligning requirements between CO and 63x, where there is overlap > and non-uniformity (col. Q)*; > > 2) How a ‘free pass’ might be given for CSPs whose service(s) fall > within scope of some InfoSec Management scheme (col. R); > > 3) And any other ideas which occurred to me whilst making this > initial pass … (col.S). > > Hopefully any notes will be sufficiently helpful, but you can badger me > next Thursday if that isn’t so. This is a first stab, so chip in if you > can. > > * Just a minor caveat. Potentially, 63A/B criteria may need to change to > ensure uniformity, of terms at least, though I think the real changes need > to be in the CO_SAC (e.g. remove ‘Service Defn’, stick to ‘CrP’). > > > > > > > *Richard G. WILSHERCEO & Founder, Zygma Inc.www.Zygma.biz > <http://www.Zygma.biz>+1 714 797 9942* > > > _______________________________________________ > A Community Group mailing list of KantaraInitiative.org > WG-IDAssurance mailing list -- wg-idassurance(a)kantarainitiative.org > To unsubscribe send an email to staff(a)kantarainitiative.org > List archives -- > https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantar… > ______ > Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance > >

1 0

Join Us in 1 Hour - IAWG Call - 2023-09-21
by Lynzie Adams 21 Sep '23

21 Sep '23

Dear IAWG Members, Please join us at *12pm *US Eastern Time for our next IAWG meeting. The public comment period for the 63A_SAC is open. You can view the information here <https://kantara.atlassian.net/wiki/spaces/GI/pages/252837889/PCIPR20230905> . If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey <https://www.surveymonkey.com/r/KI_DEIA>* on behalf of your organization. Feel free to forward the link to an appropriate contact within your organization. They will be closing the survey soon. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-09-21* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - Kantara Updates - Assurance Updates 2. *Discussion: * - CO_SAC updates <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> as we continue the work toward removing Technical class of approval - Richard's first stab is linked. 3. *Any Other Business* Lynzie Adams Assurance Program Manager

1 0

Invitation & Agenda for IAWG Call 2023-09-21
by Lynzie Adams 20 Sep '23

20 Sep '23

Dear IAWG Members, Please join us at *12pm *US Eastern Time on Thursday, September 21 for our next IAWG meeting. The public comment period for the 63A_SAC is open. You can view the information here <https://kantara.atlassian.net/wiki/spaces/GI/pages/252837889/PCIPR20230905> . If you have not done so yet, please take a moment to complete the *2023 Kantara Initiative DEIA survey <https://www.surveymonkey.com/r/KI_DEIA>* on behalf of your organization. Feel free to forward the link to an appropriate contact within your organization. They will be closing the survey soon. The proposed agenda and Zoom detail are below. *Date and Time* - *Date: Thursday, 2023-09-21* - *Time: 9:00 PT | 12:00 ET (**time zone calculator* <https://www.timeanddate.com/worldclock/converter.html>*)* - Please join the meeting from your computer, tablet or smartphone: https://zoom.us/j/93167965850?pwd=dldoT0hYK1k4MkVGYkQ3TkNqdG1Idz09 - Meeting ID: 931 6796 5850 - Passcode: 884696 - You can also dial in using your phone. Find your local number: https://zoom.us/u/aeg9vt8LSr <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2FabUx61ivsc&sa=D&us…> - Need to add IAWG meetings to your calendar? Do so here! <https://kantara.atlassian.net/wiki/spaces/IAWG/overview> *Proposed Agenda* 1. *Administration:* - Roll call, determination of quorum - Minutes approval - 2023-09-07 DRAFT Minutes <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/261390337/2023-09-07+D…> - Kantara Updates - Assurance Updates 2. *Discussion: * - CO_SAC updates <https://kantara.atlassian.net/wiki/spaces/IAWG/pages/198311945/2023+Meeting…> as we continue the work toward removing Technical class of approval - Richard's first stab is linked. 3. *Any Other Business* Lynzie Adams Assurance Program Manager

1 0

2023-09-07 action fulfilled
by Richard G. WILSHER (＠Zygma Inc.) 16 Sep '23

16 Sep '23

As actioned (by myself!) during the most recent IAWG mtg, herewith a first stab at how the CO_SAC could/should be reviewed for potential revisions to accomplish at least the following objectives: 1) Aligning requirements between CO and 63x, where there is overlap and non-uniformity (col. Q)*; 2) How a 'free pass' might be given for CSPs whose service(s) fall within scope of some InfoSec Management scheme (col. R); 3) And any other ideas which occurred to me whilst making this initial pass . (col.S). Hopefully any notes will be sufficiently helpful, but you can badger me next Thursday if that isn't so. This is a first stab, so chip in if you can. * Just a minor caveat. Potentially, 63A/B criteria may need to change to ensure uniformity, of terms at least, though I think the real changes need to be in the CO_SAC (e.g. remove 'Service Defn', stick to 'CrP'). Richard G. WILSHER CEO & Founder, Zygma Inc. www.Zygma.biz +1 714 797 9942

1 0

Reminder: No IAWG Call Today
by Lynzie Adams 14 Sep '23

14 Sep '23

Hello all, Just a reminder we will NOT meet today. Watch for an agenda next week! Lynzie Adams Assurance Program Manager

1 0