Certificate Authority Security Council
 | This article needs to be updated. The reason given is: In July 2021 the Certificate Authority Security Council (CASC) announced that it restructured and renamed the organization to the PKI Consortium (Public Key Infrastructure Consortium or PKIC).
https://pkic.org/2021/07/12/from-casc-to-the-public-key-infrastructure-consortium/ The PKI Consortium was born out of the CA Security Council, with a broader mission to advance trust in assets and communication for everyone and everything using public key infrastructure (PKI). The consortium removed membership-fees and many new members diversified the view on PKI. The website and articles on http://casecurity.org/ also redirect to https://pkic.org/.. (July 2021) |
 | |
| Abbreviation | CASC |
|---|---|
| Formation | February 2013 |
| Type | Industry Advocacy Organization |
| Purpose | Exploration and promotion of best practices that advance trusted SSL deployment and CA operations as well as the security of the Internet in general |
Region served | Worldwide |
Membership | 7 publicly trusted PKI authorities |
| Website | casecurity |
The Certificate Authority Security Council (CASC) is a multi-vendor industry advocacy group created to conduct research, promote Internet security standards and educate the public on Internet security issues.
History
[edit]The group was founded in February 2013 with the seven largest certificate authorities, issuers of SSL certificates — Comodo, Symantec,[1] Trend Micro, DigiCert, Entrust,[2] GlobalSign[3] and GoDaddy.[4][5][6][7][8] DigiCert withdrew[9] from the group June 15, 2018.
Objectives
[edit]The CASC supports the efforts of the CA/Browser Forum and other standards-setting bodies.[10] They support the development of enhancements that improve the Secure Sockets Layer (SSL) and the operations of the certificate authorities (CA).[11][12]
According to Robin Alden, CTO of Comodo and member of the Council, the CASC will serve as a united front for all of the CAs involved: "While not a standards-setting organization, we’re committed to supplementing standards-setting organizations by providing education, research, and advocacy on the best practices and use of SSL."[13]
Membership requirements
[edit]The CASC limits membership to SSL certificate authorities that meet their requirements for reputation, operation, and security. Members are required to undergo an annual audit and to adhere to industry standards, such as the CA/Browser Forum’s Baseline Requirements and Network Security Guidelines.[14]
Industry initiatives
[edit]The group works collaboratively to create and define the initiatives to improve the understanding of policies and their impact on Internet infrastructure.
Certificate Revocation and OCSP Stapling
[edit]The group's primary focus[15] was promoting an understanding of the importance of certificate revocation checking and the benefits of OCSP stapling. The protocol is intended to ensure that web users are aware when they visit a web site with a revoked or expired SSL certificate.[16]
Securing Software Distribution with Digital Code Signing
[edit]The group has also worked to secure software distribution with digital code signing.[17] Code signing certificates play a key role in helping users identify authentic software code from reputable publishers and receive the assurance that the code has not been tampered with beforehand.
References
[edit]- ^ Let’s Build a More Secure Future | Symantec Connect Community
- ^ Entrust Joins World's Leading CAs to Form Certificate Authority Security Council, Advance Internet Security and Trusted SSL Ecosystem - Feb 14, 2013
- ^ "The Paypers. Insights in payments". Archived from the original on 2015-07-02. Retrieved 2013-03-15.
- ^ "Announcing the Certificate Authority Security Council | Inside GoDaddy.com". Archived from the original on 2013-11-11. Retrieved 2013-03-15.
- ^ "Major Certificate Authorities Unite In The Name Of SSL Security - Dark Reading". Archived from the original on 2013-04-10. Retrieved 2013-03-15.
- ^ "Multivendor power council formed to address digital certificate issues - Network World". Archived from the original on 2013-07-28. Retrieved 2013-03-15.
- ^ Website Certificate Authorities Set Up Security Council for Advocacy, Research
- ^ SSL Certificate Authority Security Council Takes Root | Electronic Staff Archived 2014-07-14 at the Wayback Machine
- ^ "Notice of Withdrawal from the CA Security Council | DigiCert Blog". DigiCert. 2018-06-15. Retrieved 2018-07-02.
- ^ "About the CA Security Council". Archived from the original on 2017-07-14. Retrieved 2013-03-15.
- ^ CA Security Council | World’s Leading Certificate Authorities Come Together to Advance Internet Security and the Trusted SSL Ecosystem
- ^ Certificate authorities band together to boost security – Network World Archived February 25, 2014, at the Wayback Machine
- ^ CAs Form New Alliance to Focus on Security Issues, Education | threatpost Archived March 8, 2013, at the Wayback Machine
- ^ "CA Security Council | About the CA Security Council". Archived from the original on 2017-07-14. Retrieved 2013-03-15.
- ^ "New Certificate Authorities group promises better revocation checking - Techworld.com". Archived from the original on 2014-02-01. Retrieved 2013-03-15.
- ^ Certificate Authorities to push for better certificate-revocation checking - Computerworld
- ^ Kerner, Sean Michael. "Code Signing Seen as Effective Way to Safeguard App Security". eWeek. Archived from the original on January 26, 2014.