September 2008 - caops-wg

Auditing Guidelines Doc. (1.0-b7)
by Yoshio Tanaka 01 Oct '08

01 Oct '08

Hi Christos and all, Attached is the latest version (1.0b7) of Auditing Guidelines Document which was revised based on the discussions at OGF24 and the follow-up discussion via email. This document is also available on GridForge. I believe this document is ready to be submitted to public comment. What should be the next step? Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

2 1

Comment for Auditing Guidelines Doc.
by Yoshio Tanaka 18 Sep '08

18 Sep '08

Hi Scott, As you might see in the meeting minutes which was sent by Dave, we got a comment about Auditor Qualification. ---------------------------------------------------------------------- Auditor Qualification The audit/assessment/evaluation team and the individuals on that team, should be qualified to assess the policies and practices of a PKI. Auditors should be competent to evaluate the CA management processes and operational procedures, its related IT security components and its PKI-unique elements. A PKI audit team shall consist of individuals who together have the necessary skills and experience to assess the policies, procedures and practices of the PKI. Auditors should be individually and organizationally independent of the PKI that is being audited. The following list comprises a set requirements for considering the expertise and qualifications of members of the assessment team carrying out a PKI audit: - Professional Certifications such as CISSP and CISA or equivalent; - Successful completion of training courses in assessment of IT security controls; - ... ---------------------------------------------------------------------- We got a comment that the list of requirements is very heavy, particularly the professional certification. Do you intend that auditors must satisfy all the requirements? Would you clarify your intention? Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

3 6

Auditing Guidelines Doc.
by Yoshio Tanaka 17 Sep '08

17 Sep '08

Hi David(G), I missed to discuss one issue which was commented by Scott. The introduction section of the auditing guidelines document describes "It should be noted that it was determined that the OGF mission would not include responsibility (and thereby liability) to either vet certificate policies (CPs) or audit CAs." Scott gave us a comment that we should at least say who made this determination and perhaps when. How should I describe who and when? Any suggestions? Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

My notes from today's CAOPS and IGTF meeting
by Kelsey, DP (David) 16 Sep '08

16 Sep '08

Dear all, Here are my notes from today's meeting(s). Corrections welcome! Cheers ------------------------------------------------ Dr David Kelsey Particle Physics Department Rutherford Appleton Laboratory Chilton, DIDCOT, OX11 0QX, UK e-mail: D.P.Kelsey(a)rl.ac.uk Tel: [+44](0)1235 445746 (direct) Fax: [+44](0)1235 446733 ------------------------------------------------

1 0

Auditing Guidelines Doc. 1.0b6
by Yoshio Tanaka 13 Sep '08

13 Sep '08

Dear all, Thanks to Scott, Auditing Guidelines Document has been revised and it is available on GridForge as version 1.0b6. The major revision is to add author clarification. We will discuss this document in next Tuesday so that the document will proceed to public comments. Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

CAOPs-IGTF Agenda (Tuesday 16, Sep.)
by Yoshio Tanaka 12 Sep '08

12 Sep '08

Dear all, CAOPs-IGTF session will be held on 16th, Tuesaday, in the week of OGF24 in Singapore. Three IGTF sessions will be dedicated for the APGridPMA meeting. Here is a schedule and agenda of the four sessions. Thanks, ---------------------------------------------------------------------- Date: September 16 (Tuesday) Venue: Room Discovery, Biopolis, Singapore CAOPs Session 09:00 - 09:10 IPR issues and agenda bashing 09:10 - 09:30 Review charter (Christos) 09:30 - 09:50 Auditing Guidelines Document (Yoshio) 09:50 - 10:10 Authentication Service Profile (Christos) 10:10 - 10:30 Use Cases for Relying Party Enforced Namespace Constraints (David) 10:30 - 11:00 Coffee/Tea Break IGTF/APGridPMA (1) 11:00 - 11:15 Self Introduction of participants 11:15 - 11:30 Opening remarks and updates of the APGrid PMA (Yoshio Tanaka, Chair, APGridPMA) 11:30 - 11:45 Updates of the EUGrid PMA (David Groep, Chair, EUGridPMA) 11:45 - 12:00 Updates of the TAGPMA (Vinod Rebello, Chair, TAGPMA) 12:00 - 12:15 MICS Profile (Vinod Rebello) 12:15 - 12:30 New Charter of the APGridPMA (Yoshio Tanaka) 12:30 - 13:30 Lunch / Town Hall 13:30 - 14:15 Keynote - Accelerating Enterprise Grid Adoption (Lawrence Wong, National University of Singapore) IGTF/APGridPMA (2) 14:15 - 14:45 New CA (Indian Grid CA) 14:45 - 15:45 Brief status reports from member CAs * AIST (JP) * APAC (AU) * ASGCC (TW) * CNIC (CN) * IHEP (CN) * KEK (JP) * KISTI (KR) * NAREGI (JP) 15:45 - 16:00 Coffee/Tea Break IGTF/APGridpMA (3) 16:00 - 16:30 Brief status reports from member CAs (cont'd) * NCHC (TW) * NECTEC (TH) * PRAGMA-UCSD (US) * THAI (TH) * HKU (HK) 16:30 - 16:45 Heavy traffic for downloading CRLs 16:45 - 17:00 Frequency of issuing CRLs 17:00 - 17:10 Frequency of F2F meetings and plans in the next year 17:10 - 17:20 Lessons learned from IGTF-RAT test 17:20 - 17:30 Summary and the next meeting -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0