Within the last 2 days, the testserver got the running signer integration into the testserver environment. This was one of the milestones in getting a testing environment as identical as possible to the production system.
Continue reading
Todays systemlog message marks the quantum leap in our about 10 months project work, to become the Software-Assessment area auditable.
As many Software-Updates are in the queue from the software developers, that needs testing and reviews by Software Assessors, the team started by end of last year with this project,
The systemlog message signals, that the first tested and reviewed patches has received by the critical system webdb and is incorporated into production. A new tarball has been generated to build the next basis for applying the next patches.
So here my thanks goes to all the involved teams,
With all these people assistance, this project hadn’t be pushed to this milestone. Thank you Andreas, to build the project plan and the technical background, and also hosting the current testserver, Thank you Wytze for all your work to build the new testserver from scratch as identical as possible to the production server, to Michael, who assist us in deploying the new git repository and also assistance in deploying the Testserver-Mgmt-System, so everybody can start testing w/o the need of console access, Thank you Markus, for all your time and effort to deploy the repository and testserver environment and also your work together with Philipp as Software-Assessor, to finalyze the Software-Update-Cycle. Thank you Dirk for all your suggestions to move on with this project.
Some more work is todo:
Now the teams have to walk thru the list of open bugs, that needs to be pushed thru … First of all is the “Thawte” bug … to signal all users who’ve got their Thawte points transfered by the old Tverify program if they are effected by the points removal or if they are safe. The CCA-Rollout with a couple of patches, a list of new Policies and Subpolicies related patches (eg. PoJAM, TTP program), a list of Arbitration pushed patches, and so on …
So guys, lets have a party tonight, we’ve wiped out one of the biggest audit blockers!
Back in January 2010 the former Board decided by Board motion m20100117.3 “No new subroots on current root, plan for new root”. In the discussion a date was scheduled by end of Dec 31, 2010. On my 2nd thought, probably nobody did recognize, what that means, 
to finish all the projects from the bottom left corner at beginning of 2010 to the top right corner by end of the year with the “New Roots and Escrow” (
) process running. So this article should bring Audits mistery to light.
Policy Group worked on the last few essential Policies (
), that are essential for the Audit. One essential requirement for Audit is to Rollout the CAcert Community Agreement to all the members, so they can decide to continue or to leave the Community. To become “CCA Rollout Ready” (
), the running Software needs to be updated. This opens the next problem: by starting 2010, there was no Software Update Process defined, nor documented. But we’re on the lucky side, the Software-Assessment-Project started November last year to fulfill this requirement (
). The task was: To get a repository system controlled by Software-Assessment team, a controlled testserver environment and a documentation system. Currently the team tests the transfer of a test patch to the production system. Involved parties: Software-Assessment Project team, Software-Assessment team and the Critical Sysadmins team.
CAcert’s Big Masterplan To become Audit Ready (10/2010)
In the meantime, another issue pop’d up: the “Thawte points removal” with a deadline of Nov 16th, 2010. We’ve allready posted several blog posts on this topic. So also this is related onto the Software-Assessment-Project progress ().
The next topic is running Assurer Training Events (ATE) (
). ATE’s are an essential concept in the Audit over Assurance (RA) business area. To scale a worldwide community, the community has to assist Auditors work in doing Co-Audits over Assurers. The question: How to contact groups of Assurers was answered back in 2009 with the ATE concept. The purpose of ATE is twofolded: first to communicate to the Assurers all the new informations and second to do Co-Audits. As Assurers follows the invitations to the ATEs we can expect, that they are more active in the community. So also from 2009 ATE experiences, we’ve got new resources from the community by contacts on ATEs (). So this was the plan for 2010 ATE season, to find more people, who can help on the several tasks and projects that needs to be finished, before the new Roots and Escrow project and also the Audit can be (re-)started. E.g.
Helping CAcert
). This project is running about 2 years, but currently without progress.
), that was started last year, after Auditors review of the Software that concludes: „Serious difficulties in maintaining, improving and securing.” and „Cannot form conclusion over software.”, so if the plan to start with the Audit over the old Software fails, we’re close to the 2nd path: BirdShack.
), that becomes the ground base for the New Roots and Escrow project () that should be keep tracked by an Auditor, and the re-start of the Audit ( 1) and ( 2).The New Roots and Escrow Project Relation to Audit
As said before, the New Roots and Escrow Project should be keep tracked by an Auditor. From the experiences back in 2008 on creating New Roots but fail on Roots Escrow, we’re warned to separate the Audit steps of the New Roots and Escrow Project () and the Audit over Systems ( 2). Both tasks should be close together.
On the other side, we have to do an Audit over Assurance (Registration Authority, RA) ( 1). There is no requirement on bundling the RA Audit and CA Audit as both business areas have their own Policy sets and can be checked separately. This can make our work presumably easier. Easier to get Audit funding for Audit over RA. As Assurance area is closer to be Audit Ready, we can also signal to the Community Audit is back on track. This will probably push the other tasks. With a small budget we probably can double the result by getting new resources, “Hey, there is progress on the overall Audit task” – CAcert is back!
This weekend, the Security Policy goes into DRAFT. Consensus has erupted in policy group once again.
The practicle work now can start, to write down all the documentation for the practice documents. Clean out the wiki with all the informations of the old TTP program and start spreading the new TTP-Assisted-Assurance to the CAcert deserts after the old program was frozen.
Who volunteers now to becoming the first TTP-admins ? As policy defines
Senior-Assurers to be the TTP-admins and the first new TTP requests will come soon probably
we have to deploy the policy now into practice. Thats again a Community Task. We need at least 3 TTP-Admins as following graphic displays:
TTP ----:--> TTP-Admin (1) --> 35 points max
/ : \
Assuree = - - :- > =----> TTP-Admin (3) --> 35 points max (Topup)
\ : /
TTP ----:--> TTP-Admin (2) --> 35 points max
:........ CAcert internal ................................................
TTP-Admins should become familiar with the TTP’s available in a country of the TTP requestor so the program gets a strong path of reliance. One idea is to work close together with Organisation Assuers, who are familiar with the regulations in a country but its not limited to. These are only thoughts.
July 2010 was full of activities. Two Board members resigned. New procedures for Assurers were updated. And the Software-Assessment Project reaches one milestone.
Continue reading
Within the last week we’ve reached one milestone in our new Software-Assessment-Project.
The team is working since November 2009 on a new Software Repository and a new Testserver.
The Testserver needed a Testserver Mgmt System to set the environment for testing new Software and Patches for the Webdb system.
Continue reading
This weekend, the Security Policy goes into DRAFT. We’ve battled and we’ve won: consensus has erupted in policy group. Not only do we get our Security Policy, but SP going to DRAFT marks a major milestone for CAcert:
We now have a complete set of policies for audit !
We’ve been close before, but never the cigar. In early 2009, some audit work was done, but with gaps: the CPS and the “index” were missing. The CPS came into DRAFT in June 2009, it was close enough at the time. The “index” is called the Configuration-Control Specification (CCS), which is a rather clumsy name for such a simple thing. CCS is a list to all the assets that have to be audited, so it’s worth a little attention. The structure more or less looks like this:
Audit => Criteria (we call them DRC) => CCS (the index)
Then, with CCS in hand, the Auditor can find the parts needed:
--> Policies
/
CCS ==----> critical systems
\
--> roles in control, etc
CCS was the missing link. Luckily the index CCS is relatively easy to write, if all the other policies and systems are clear, and this also means it was doomed to always be last, once the other policies were clear. A month back policy group pushed it through, we brought the CCS finally into its place as a (DRAFT) binding policy.
Which should have been the completion of our policy set for audit, but as CCS was finishing, the Board of CAcert Inc decided to veto the Security Policy, as they can under the rules (PoP 4.6). Now, much has been written about this drama in the maillists, and the debate did raise some serious questions at the time, but they can be left for another day. This week, then we in policy group are taking Security Policy back to DRAFT. Has anything changed? Here are the major points of change:
Other than tighter wording, etc, that’s it. Welcome to our complete Policy set!
Which final comment brings us to the success of CAcert’s Policy project. It was 5 calendar years in the making, starting off with Christian’s original CPS, and it cost many Member-Years of effort. Some examples: The SP was probably a Member-Year of effort. The CPS is likely equal, the agreements and foundations (CCA, DRP, PoP, etc) another huge lump. I said CCS was an easy one to write, but “easy” still runs to around a Member-Month of effort. PoJAM, similar.
If we think how much a commercial company pays for a Member-Year of effort (100k, plus or minus), that’s a serious investment.
Thank your policy group, and help out with reading and voting!
35 decisions, 13 policies to DRAFT and beyond, 55 contributors. Here’s the top ten, a Hall of Fame, collected a wiki-scraping script I wrote last night:
| Name | # | Decisions |
|---|---|---|
| Tomáš | 10 | p20100510,p20100426,p20100401,p20100119,p20100113,p20091108,p20091106,p20090706,p20090327,p20081016 |
| Faramir | 10 | p20100510,p20100426,p20100401,p20100326,p20100120,p20100119,p20100113,p20091106,p20090706,p20090327 |
| Lambert | 10 | p20100426,p20100401,p20100326,p20100113,p20091108,p20091106,p20090706,p20090327,p20090105.1,p20081016 |
| Philipp D | 9 | p20100510,p20100426,p20100401,p20100113,p20091106,p20090706,p20090327,p20090105.1,p20081016 |
| Pieter | 8 | p20100510,p20100426,p20100401,p20100306,p20100120,p20100113,p20091106,p20090327 |
| Iang | 8 | p20100510,p20100426,p20100306,p20100120,p20100119,p20100113,p20091106,p20090706 |
| Ulrich | 7 | p20100510,p20100426,p20100401,p20100326,p20100306,p20100120,p20100119 |
| Ted | 7 | p20100510,p20100120,p20100119,p20100113,p20091106,p20090706,p20081016 |
| Brian | 7 | p20100510,p20100426,p20100401,p20100119,p20091108,p20091106,p20090706 |
| Morten | 6 | p20100510,p20100426,p20100306,p20100120,p20100119,p20100113 |
(That’s not a formal result, and it only counts voters from the last 2 years, many others did other things that are harder to measure.)
We now have a set of policies that not only deals with the criteria of the Audit (DRC), not only removes that critical path blockage of documentation for audit, but also presents the only honest, fair, presentable and sustainable policy set in the entire business. In my humble opinion.
This is a set of documents everyone can be proud of. On this foundation we can build. We can, for our Members, create business of real value, not just issue certificates that defy valuation to people who don’t understand their need.
Now, on to implementation and audit. Questions about the audit are questions about implementation, so don’t forget:
Do not ask when your audit is done, rather, ask how you, yourself, are doing your audit!
And now, you’ve got the full policy set, so you know what the Auditor is going to be looking for 😉
Contributions to this Community Update by: Ian, Daniel, Uli
The November 2009 blog post Last chance: End of thawte points transfer on 16th november 2009 was the starting point for the moving of Thawte Notarys to CAcert … but this is half of the story. November 16th 2010 ends the verification period of transfered points. So the 150 points transfer will be lost. To prevent the loss of Assurance and Experience Points all members using this program needs to search for assurers to get fully assured and starting also assurances to get the needed experience points. Until now, the addtl. Assurances doesn’t count, but added to the account until the Points Count process will be changed before Nov 16th 2010, so the last assurance points counts.
This will become a big shift in this year until November 2010. Current work is to prepare the building of the Software Assessment Team and the Repository project to make Software updates possible. This project is a not so well noticed project still running in the background. But if someone reads the Software MiniTOP Updates from Dec 2009 and February 2010, those can reads the progress that is made in this area. This is also a requirement for the CCA Rollout plan that needs to be started around mid of this year to succeed before Audit can continue.
If you have further questions regarding the Thawte transfer points removal, please go to the public CAcert Support mailing list.
This years CeBIT 2010, CAcert got a booth as part of 15 projects within the Open Source Project Lounge sponsored by Linux New Media. CAcert thanks Linux-Magazin and Linux New Media for the sponsoring of the booth presentation at CeBIT 2010.
Continue reading