A thorough analysis was made on the VeriSign Certification Practice Statement (CPS) document to identify the type of security services addressed and if the document enforces and support the FISMA security controls. The CPS presentation of the capabilities demonstrated on the security services were equated to the security controls and how the security services can reduce risk impact. The CPS details the authentication and identification, access controls and the audit VeriSign’s certificate policies mainly on the endurance of digital certificates and key management enforcing the CIA. The details of the findings that meets the standard of FISMA according to the NIST are:
Identification and Authentication for Rekey Requests: this security service addresses the IA-4 Identifier Management security control whereby it ensures user identifier to the intended party by distinctively verifying and identifying each user. The organization is enabled to manage these functionalities and in addition disabling users and enable decline to …show more content…
Furthermore, CPS explains the contingency plan in securing information against third party and how information is released based on legislative law. It also points out the Verisign Trust Network that caters the integrity of the CPS and reassures trustworthiness among its users and how trusted personnel have access to sensitive information in avoidances of mistrusted associates. The availability of the system 24/7 somewhat covers the availability part of CIA in the sense the system is readily accessible to the appropriate users. This analysis serves that the CPS does address the FISMA security control and covers the CIA in order to lessen the security service risk
Identification and Authentication for Rekey Requests: this security service addresses the IA-4 Identifier Management security control whereby it ensures user identifier to the intended party by distinctively verifying and identifying each user. The organization is enabled to manage these functionalities and in addition disabling users and enable decline to …show more content…
Furthermore, CPS explains the contingency plan in securing information against third party and how information is released based on legislative law. It also points out the Verisign Trust Network that caters the integrity of the CPS and reassures trustworthiness among its users and how trusted personnel have access to sensitive information in avoidances of mistrusted associates. The availability of the system 24/7 somewhat covers the availability part of CIA in the sense the system is readily accessible to the appropriate users. This analysis serves that the CPS does address the FISMA security control and covers the CIA in order to lessen the security service risk