13.3.4 / v5.0.be-14.8.3 - Clarify "key secrets"

[randomstuff]

We have:

13.3.4 Verify that key secrets have defined expiration dates and are rotated on a schedule based on the organization's threat model and business requirements.

"Key secrets" means "actually very important secrets"? It looks quite like we might be talking about "secret keys" but actually we want to cover private keys, passwords and tokens as well. Should we reword "key secrets"?

[elarlang]

Additionally, topics from #2952: Should the second part have matching documentation requirement?

[elarlang]

As I understand, the goal to achieve is:

• There must be documented what those really important credentials and keys are that need rotation, and for each, the schedule
• Implementation requirement to verify that everything is according to the documented decision

This schedule part feels like a process, and I'm not fully sure how well it fits into the scope. We can say that if it is described in the documentation and then we can check when it was last changed time?

[jmanico]

Regarding the OP I would suggest just dropping "key" and leave it as:

13.3.4 Verify that secrets have defined expiration dates and are rotated on a schedule based on the organization's threat model and business requirements.

[tghosth]

For future reference, this was added here:

89b14cc

[tghosth]

How about the following (new 13.1.4 and modified 13.3.4):

Proposal

V13.1 Configuration Documentation

This section provides documentation requirements around how the application communicates with internal and external services and the techniques to employ to prevent loss of availability due to these services not being accessible. It also considers documentation around secrets.

#	Description	Level	#v5.0.be
13.1.4	Verify that the application's documentation defines the secrets which are critical for the security of the application and a schedule for rotating them, based on the organization's threat model and business requirement.	3

V13.3 Secret Management

Secret management is a configuration task that is essential to ensure the protection of data being used in the application. Specific requirements on cryptography can be found in the "Cryptography" chapter but this section focuses on the management and handling aspects of secrets.

#	Description	Level	#v5.0.be
13.3.4	Verify that secrets are configured to expire and be rotated based on the application's documentation.	3	v5.0.be-14.8.3

[danielcuthbert]

Regarding the OP I would suggest just dropping "key" and leave it as:

13.3.4 Verify that secrets have defined expiration dates and are rotated on a schedule based on the organization's threat model and business requirements.

Actually this makes a lot more sense, i like this approach

[elarlang]

Should I PR it in based on #2971 (comment)? (it requires some changes into mapping files)

[jmanico]

I think there is enough consensus here to PR it, @elarlang.