Microsoft PKI Services: 3-Month Access Review Process Failure
Microsoft PKI Services reported a self-identified process failure in its 3-month access review process. During investigation of another issue, it became clear on 2023-08-10 that the 3-Month Access Review Process failed to identify a user account that had been provisioned for an employee not assigned to a Trusted Role, contrary to Network Security Requirements Section 2.j. Microsoft stated that certificates were not impacted by this process failure and that certificate issuance was not stopped. Microsoft described actions taken in response, including deleting the non-Trusted Role user account on 2023-08-09 and updating the manual 3-month access review process on 2023-08-17 to include an explicit check for Trusted Role group membership. Microsoft later reported automation work to collect and verify user accounts for 3-month access reviews and to automate verification that Secure Zone users are in the Trusted Role group, with implementation reported as completed by 2023-10-13. Microsoft then requested closure after completing centralized management of the Trusted Role group list to replace manual processes. Mozilla indicated it intended to close the bug on 11-Oct-2023, and the bug is resolved as FIXED.
- A user account was created for a Non-Trusted Role user.
- A Trusted Role Engineer performed a random audit and discovered a Non-Trusted Role user account in the High Security Zone, then opened an internal incident and deleted the account.
- Microsoft determined that the 3-Month Access Review Process failed to identify the access issue.
- Microsoft updated the manual 3-month access review process to explicitly check Trusted Role group membership.
- Microsoft completed centralized management of the Trusted Role group list and added automation to verify Secure Zone users are in the Trusted Role group.
- Disabled representative — Submitted a preliminary report describing a self-identified failure of the 3-month access review process to identify a non-Trusted Role user account and citing Network Security Requirements Section 2.j.
- Microsoft Corporation — Posted an incident report with the same self-identified issue, including a timeline and the statement that certificates were not impacted.
- Disabled representative — Reported updates to the manual 3-month review process (at least every 90 days) and progress on automation for collecting user accounts for 3-month access reviews.
- Disabled representative — Reported verification of automation data collection on 2023-08-29 and stated automation to verify Secure Zone users against the Trusted Role group would be implemented by 2023-10-13.
- Disabled representative — Reported completion of centralized management of the Trusted Role group list and requested closure of the bug.
- Mozilla representative — Stated intent to close the bug on Wed 11-Oct-2023.