Page tree
Skip to end of metadata
Go to start of metadata


Attendees


Voting participants: Ken Dagg; Scott Shorter; Richard Wilsher; Mark Hapner; José López

Non-voting participants: Roger Quint, Stuart Young, Martin Smith. 

Staff: Colin Wallis, Ruth Puente

Quorum: 4 of 7. There was quorum.

Agenda

  1. Administration

a. Roll Call

b. Agenda Confirmation

c. Action Item Review: action item list

d. Minutes Approval: 2019-01-24 DRAFT Minutes  and 2019-01-17 DRAFT Minutes

e. Staff reports and updates - Director´s Corner January 2019 and Keep Up with Kantara January 2019

f. LC reports and updates

e. Call for Tweet-worthy items to feed (@KantaraNews or #kantara)

2. Discussion

a. New revised Overview document - IAF 1000 (Attached).  
b. DHS CISA Emergency Directive ED 19-01 on the topic of securing DNS infrastructure.

c. KBV at IAL2

3. Any Other Business

Updates

Minutes Approval 

2019-01-17 Minutes and  2019-01-24 Minutes were approved by motion. 

Discussion on the revised Overview document - IAF 1000

  • Richard provided substantive comments to the document, so a new draft would be provided soon. 
  • Ken went through the various sections, starting with the Abstract. He stressed some definitions of the terms, Relying Party (org that is running the online services),  End User (client of online services) and Credential Service Provider (that the RP would rely on for authentication of the end user). 
  • Richard highlighted that we need to describe the Kantara´s IAF and suggested to look the terminology within the KI IAF scope. He suggested including the Glossary in the Overview, and using terms that have been defined. He added that there are some cases where the End user directly contact the KI CSP, and the RP may get involved later once the End user have a credential. Also, he suggested avoiding a definition for End user. 
  • Martin asked if the IoT would be included or it would refer to humans only. Richard responded that there are no criteria that allow to recognize non-human entities. Colin commented that someone has reached out Kantara for IoT Assurance, so if there is a business proposition, this would be included within the IAF scope. Scott said that it would be helpful to clarify in the Overview that we are not doing this for the devices benefit yet. 
  • It was said that it would be better to use "client" instead of "end user". Ken accepted the suggestion. 

DHS CISA Emergency Directive ED 19-01 on the topic of securing DNS infrastructure.

  • Scott commented that there have been recent reports on more active attacks on the Domain Name System, including the federal government. The Directive tells the agencies that they have 10 days to accomplish specific actions (audit DNS records, implement MFA, change passwords, make sure that only authorized certificates have been issued) to mitigate the problem. 
  • Colin encouraged to be sensitive with the market needs. 
  • Ken suggested reaching out DHS about this Emergency Directive. Colin responded that Kantara will take advantage of the good relationship with DHS S&T team on the KIPI Program, so the plan would be to request the contacts of CISA.

KBV at IAL2

  • Scott wonders what´s the approach of other TFPs to this issue. 

  • It was concluded that we need clarification from NIST. 
  • Richard asked if IAWG would be able to shape the criteria and make it implementable, in the absence of NIST comments? (set reasonable expectation). Ken suggested to follow up on this during the next meeting, as IAWG needs to discuss and get clarification on how to do this and how to record it. 

Action items

  • Colin to get contacts of DHS CISA.
  • Continue the discussion on the way forward in the absence of NIST clarifications. 


  • No labels