Hi Arshad,

The policy guidelines contains some general issues, which are the same for PKI and SKMS. There is one general guideline for SKMS, SKMSG- 9, that also should apply to PKI.

In the PKI guidelines I will now only refrence to the policy guidelines document. Below is some text that I had written there before the policy guidelines were produced. Perhaps there is something interesting in there.

Cheers, Tomas

----- A best practice policy should balance the cost of a certain action against the benefit, and the cost of a breach of security due to a lower level of protection. An example of such balance is requirement for separation of duties for the staff operating the PKI. Strict separation of duties will require lots of staff, only to operate your PKI. If the persons operating the PKI are the same persons operating some of the systems using the PKI for protection, separation of duties for the PKI is unlikely to enhance the security on the organization. In that case it is probably better to allow single, trusted, persons to maintain several roles and spend money on other issues more likely to enhance security.

The cost of a potential security breach should always be calculated when determining the policy. The cost of the security system should never be higher than the objects actually protected. This is something only the organization itself can calculate.

A best practice policy for a middle- to large size organization for a PKI used primarily for EKMI could have he following features: - Requires a hardware security module. The same level of HSM used both for PKI and EKMI. - Logging of all security related events in the PKI should occur to a separate log server with limited access. - Trusted staff members are allowed to administer the PKI and register new entities. Other staff members should perform audit. - There must be some process of approving trusted personnel, and only trusted personnel are allowed to handle the PKI systems. Contractors can not handle the PKI systems without surveillance by trusted personnel. - Dual person control is required for backup and restore of CA signature keys. The PKI servers must be located in a separate, locked, part of the server room. Only trusted PKI personnel can access this room. - Availability is 24/7, 99.9%. Disaster recovery should be on the same level as other critical systems using the EKMI. - An approval process by management is required before issuing certificates to new systems. Enrollment for certificates can be done by trusted personnel, or require at least a shared secret transferred out-of-band to a technician performing the installation and enrollemnt.- Revocation information must be made available to the EKMI not more than 24 hours after revocation occurred. - No particular compliance is needed. - No warranties.

-----

Arshad Noor skrev:

implementation/docu>>