Attendees:
Voting Participants: Ken Dagg, Martin Smith, Mark Hapner, Mark King, Richard Wilsher
Non-voting participants: Roger Quint, Varun Lal, Chris Lee, Jimmy Jung
Staff: Kay Chopard
Agenda:
- Administration:
- Roll Call and quorum determination
- Agenda Confirmation
- Minute approval (DRAFT minutes of 2021-08-12)
- Staff reports and updates
- LC reports and updates
- Call for Tweet-worthy items to feed (@KantaraNews)
- Discussion
- Finalize proposed criterion language regarding "comparable alternative controls."
- Finalize proposed text (if any) regarding use of "presentation attack detection" (PAD.)
- Confirmation of other non-substantive changes to criteria to be included in the package to be submitted.
- Finalize proposed criterion language regarding "comparable alternative controls."
- Any Other Business and Next Meeting Date
Meeting notes:
Administrative items:
IAWG Chair Ken Dagg called the meeting to order at about 1:04PM (US Eastern), and called the roll. It was noted that the meeting was quorate.
Minutes approval: Mark King moved approval of the draft Minutes of the IAWG meeting of Aug 12 . Richard W. seconded. The minutes as distributed were approved unanimously.
Staff reports and updates: ED Kay Chopard–New APM Lynzie Adams, starts next week on Monday. Hope she will be on the next IAWG call. Kay Invites anyone to offer suggestions re: any Kantara issues, strategy, etc. .
LC reports and updates: Ken – The LC met yesterday. There was a discussion of the appropriate scope of activity of Kantara WGs, DGs. Results to be communicated to all when guidance is finalized. Ken says IAWG's activities seem to be well within our appropriate scope.
Ken reminded WG participants that Kantara staff is ready to help them publicize their newsworthy activities via the @KantaraNews Twitter handle. Requests can be sent to Ken D or Kay C.
Discussion:
Finalize proposed criterion language regarding "comparable alternative controls (CACs)."
Ken invited Richard W. to comment.
Richard thinks "make available" discussion last week (which he reviewed via the recording of the meeting) was off-target. The term "make available" has been used for a long time in Kantara criteria texts, and has not caused a problem. The principle is to tell assessees what must be done, not how to do it.
Martin S.– In proposing a more pro-active approach, I think we were taking account of NIST's David T's reported view, that use of an alternative control should be an explicit client (i.e., RP) risk decision taken at the executive level. and that Kantara should not appear to be endorsing the service-provider's assertion that an alternative control is "comparable."
Richard W.-- But Kantara can't make the RP do something. We might further insure the RPs attention via things we already do, like requiring a statement of criteria applicability; we might also consider requiring that use of a CAC is mentioned explicitly at least in their published material.
Martin S.: Assuming we do want to take account of David T's viewpoint, it seems we need to find some way to make sure the RP is specifically alerted to the use of a CAC.
Ken: should we add to the criterion that the RP acknowledge receipt of the CAC information? Jimmy J. - that would not be possible or effective – the RPs won't read it. But if KI provided notice we would have done all we can,
Ken : Given this discussion, is it OK with everyone to go with "no change"
Jimmy J: can we put in the "Notes" column of the criteria spreadsheet that we (KI) are going to publish fact of CAC? If we do something unusual, we need to make sure they (the RP) know about it.
Richard W: Maybe mod language to make avail : publish how you determined CAC and config requirements to make sure it is CAC. Fact of use in S3A could be noted.
Ken: with that add-- is group OK?
Mark H: Ok with current language but CAC is so poorly defined in 63-3 hard to understand how an assessor should proceed.
RW: did try in sub-clause a-c to add some specificity.
MH: still uncomfy, but don't see what else we can do.
RW: without NIST risk assessment, how can assessor establish "comparable."? Difficult situation.
KD: asks for motion to approve language for the package: KD, MH
KD: approved.
Finalize proposed text (if any) regarding use of "presentation attack detection" (PAD.)
KC: background just an email question: does KI require PAD to approve CSP at IAL2? cc: David T.
RQ: NIST does not require PAD currently, thought the letter might be asking if KI was doing anything more.
MK, MH motion – approved.
To change SAC in 63 a nd b to reflect optional nature of PAD, and if used to assess as indicafted.
Confirmation of other non-substantive changes to criteria to be included in the package to be submitted.
KD: Asks Richard to confirm misc changes.
RW: Can be ready for next week. 5 sets of errata
KD: will vote next week to complete package for submission.
Other Business:
MK: Any further UK response? KC: Still on holiday. Allison did respond from vacation and will connect next week. MK: add to agenda for next week please.
KD: Australia? KC: did have 1-on-1 with Jon Thorpe. Very high level official. Supportive of Kantara's goals for interop and also they are using NIST standards. Hoping companies don't have to go through same process multiple times for different countries. Looking for KI to provide some leadership in these areas. KD: excellent–may influence other countries.
RW: just modified criteria (for PAD?) – sanity check of revised language. Ken OK with it, JJ too but would like to have KI "lean forward a bit to credit companies who implement it." KD: We can vote next week.
Next Meeting: August 26 to finalize the criteria change package for submission to Kantara review.
Ken adjourned the meeting at about2:01PM US Eastern.