Buypass: Findings in 2023 audit
This case documents findings from a 2023 audit for Buypass. The audit report identified two main issues: (1) physical security reviews were not effectively performed because an internal control for physical access rights was accidentally deleted and not included in periodic reviews, and (2) Buypass did not effectively implement a certificate profile configuration change for Subject Attribute Encoding, resulting in subject attributes not being encoded in the order specified in the CABF BR table. Buypass reported that the physical access control was missing from April to October 2023, and that it was performed immediately after discovery with no findings for that period. Buypass’s action items included adding the internal control for physical access rights back into the schedule and ensuring it is included in quarterly reviews, and improving the certificate configuration change process with file-level verification. Buypass also stated it included digicert/pkilint in the certificate issuance process (slightly delayed) and marked the action items as done. The bug was resolved as FIXED and the reporter requested closure after confirming all action items were completed.
- Buypass’s physical access rights control was missing from the schedule for a period starting in April 2023.
- The physical access rights control remained missing until discovery later in 2023.
- Buypass reported 2023 audit findings and listed root causes and action items for physical security review and certificate profile configuration.
- Buypass updated that digicert/pkilint was included in the certificate issuance process and provided an action-items status update.
- Buypass requested closure after confirming all action items were done.
- Mozilla indicated it would close the bug on or about 15-Mar-2024.
- Buypass — Opened the bug with an audit incident report describing two findings, their root causes, and action items (including restoring a physical access control and improving certificate profile configuration verification).
- Daknob representative — Asked for clarification on the physical security deletion root cause, whether other missing controls were identified, and the period when the control was not checked.
- Buypass — Responded that the deletion was due to human error during a schedule update, no other missing controls were identified, and the control was missing from April to October 2023 with no findings after immediate discovery follow-up.
- Daknob representative — Suggested looking into versioning/automation and asked whether there was a change management process involving review of diffs for control changes.
- Buypass — Acknowledged the suggestions and said they would be taken into consideration.
- Buypass — Reported that digicert/pkilint was included in the certificate issuance process and updated the action items as DONE.
- Buypass — Stated there was no new information in the bug.
- Buypass — Stated there was no new information in the bug.
- Buypass — Confirmed all action items were done and requested the bug be closed if no further comments or questions.
- Mozilla representative — Indicated it would close the bug on or about Friday, 15-Mar-2024 unless further discussion was needed.