Chunghwa Telecom: outdated and stale policy documents disclosed to the CCADB
Categories
(CA Program :: CA Certificate Compliance, task)
Tracking
(Not tracked)
People
(Reporter: tmkuo, Assigned: tmkuo)
Details
(Whiteboard: [ca-compliance] [policy-failure] [disclosure-failure])
Incident Report
Summary
On 29th January 2025, it was identified that the policy documents disclosed to the CCADB was not kept up to date, as well as the URL of our new repository, resulting in users accessing the policy documents through public websites, e.g. crh.sh, may obtain outdated and stale policy documents.
Impact
The failure to update the policy documents resulted in a violation of the Chrome Root Program Policy and CCADB Policy. However, no security incidents or misuse of certificates occurred during this delay. The issue primarily reflected the efficiency of our internal processes rather than causing any direct harm to the integrity of the certificates.
Timeline
All times are UTC.
2025-01-03: CHT submitted a request case to update the CA repository URLs and add 2 CPS documents in CCADB.
2025-01-03: Got a comment from the Root Store reviewer to our CCADB Case stating the version number provided for the CCADB Self-Assessment did not align with the official versions hosted on https://www.ccadb.org/cas/self-assessment. And the reviewer asked that this be revised.
2025-01-15 : CHT responded saying it would provide it soon.
2025-01-16-2025-01-26 : the processing staff took leave during the processing period for personal reason.
2025-01-25-2025-02-02 : holiday of lunar new year.
2025-01-29 : Google Chrome Root Program informed CHT that they had observed that the policy documents disclosed to CCADB are outdated and stale
2025-02-03 : CHT updated the version number of the Self-Assessment, and re-submitted the case, including policy documents, for review.
2025-02-06 : The case has been closed after reviewed.
Root Cause Analysis
The root cause of the incident was an oversight during the update of CA information. While the CPS documents was updated in our new repository, the processing staff took leave during the processing period for personal reason and did not complete the processing of CCADB update in parallel. And our CA team did not assign a proxy to take over as well, leading to outdated policy documents disclosed to the CCADB.
Lessons Learned
This incident highlighted the importance of ensuring all publicly accessible information is kept in sync with our repository updates. Following the discovery of this issue, we conducted an internal procedure meeting and discussed the work handover matter of the leave staff to ensure that updates, such as those in our CP/CPS, can promptly reflected in the CCADB.
Moving forward, CHT will conduct a check of compliance, such as Bugzilla, every month to ensure all information remains up to date. This incident also underscores the importance of continuous monitoring and internal tracing mechanisms to ensure that all publicly available information is accurate and current.
What went well
- The internal team promptly acted on the discrepancy after the Chrome Root Program’s notification, and the CCADB was updated. The issue was resolved before it could escalate.
What didn't go well
- Due to an oversight, CCADB failed to promptly update the CPS documents and the URL of our new repository. As a result, the policy documents disclosed to CCADB were not kept up to date. The lack of synchronization between the two sources of information exposed gaps in our updating process.
Where we got lucky
- The Chrom Root Program’s timely inform helped us identify and correct the issue early. The required corrective actions were straightforward and quick to implement, preventing further issues.
Action Items
| Action Item | Kind | Due Date |
|---|---|---|
| Updated CA repository URLs and added 2 new CPS documents in CCADB. | Corrective | 2025-02-06 |
| Review and improve processes for CCADB updates | Prevent | 2025-02-06 |
| Conduct periodic review of CCADB data | Prevent | 2025-02-08 |
Mitigation and Resolution
Upon identifying the discrepancy, immediate steps were taken to update the CCADB with the new CA repository URLs and CPS documents up to date. Additionally, a process has been implemented to ensure that any future updates, such as CP/CPS, are reflected simultaneously in the CCADB, preventing any inconsistencies between the two sources. The only time difference is the translation time. After the Mandarin version is released, the translation time of the English version may takes 2-3 weeks.
Next Steps:
- Process Alignment: We will ensure that updates to the policy documents will trigger immediate updates of related public repositories like CCADB to avoid any discrepancies, especially when relevant work is handed over when employees are on leave.
- Review and Audit: We are conducting a review of all publicly available records to ensure all documents and CA information are consistent and up to date.
- Training and Awareness: The team responsible for managing these updates will receive additional training to ensure that all changes are properly communicated across all platforms.
Appendix
Details of affected certificates
None.
Based on Incident Reporting Template v. 2.0
|
||
Updated•1 year ago
|
|
Assignee | |
Comment 1•1 year ago
|
||
We are continuing to monitor this issue.
|
|
Assignee | |
Comment 2•1 year ago
|
||
We are continuing to monitor this issue.
|
|
Assignee | |
Comment 7•1 year ago
|
||
We are continuing to monitor this issue.
|
|
Assignee | |
Comment 8•1 year ago
|
||
Report Closure Summary
-
Incident description: CHT submitted a request case to update the CA repository URLs and add 2 CPS documents in CCADB on 2025-01-03. But due to human negligence, the process didn't complete, leading to outdated and stale policy documents disclosed to the CCADB, as well as a violation of the Chrome Root Program Policy and CCADB Policy.
-
Incident Root Cause(s): The root cause of the incident was an oversight during the update of CA information. While the CPS documents was updated in our new repository, the processing staff took leave during the processing period for personal reason and did not complete the processing of CCADB update in parallel. And our CA team did not assign a proxy to take over as well, leading to outdated policy documents disclosed to the CCADB. The issue primarily reflected the efficiency of our internal processes rather than causing any direct harm to the integrity of the certificates.
-
Remediation description: The team responsible for managing these updates will receive additional training to ensure that all changes are properly communicated across all platforms. Upon identifying the discrepancy, immediate steps were taken to update the information in CCADB. Additionally, a process has been implemented to ensure that any future updates, such as CP/CPS, are reflected simultaneously in the CCADB, preventing any inconsistencies between the two sources.
-
Commitment summary: This incident highlighted the importance of ensuring all publicly accessible information is kept in sync with our repository updates. We review and improve processes for CCADB updates, including the work handover matter of the leave staff to ensure that updates, such as those in our CP/CPS, can promptly reflected in the CCADB. Moving forward, CHT conducts periodic checks of compliance and review our internal tracing mechanisms to ensure all information remains up to date. This incident also indicates the importance of continuous monitoring and internal tracing mechanisms.
All Action Items disclosed in this report have been completed as described, and we request its closure.
|
|
||
Comment 9•1 year ago
|
||
I will close this issue on or about Friday, 11-Apr-2025, unless there are questions or issues still to address.
|
|
||
Updated•1 year ago
|
Description
•