Correct, the violations are minor and should be trivial to deal with.
The problem in this case is that Entrust displayed a complete disinterest into actually solving the underlying issues. Doing an oopsie is one thing. Doing an oopsie, lying about it, refusing to take precautions, and failing to take measures to prevent a repeat despite promising to do so? Completely different story.
If they can't be trusted to respond properly to minor administrative issues, why should they be trusted to respond adequately during a real security incident?
Indeed one of the things that got raised is that they do not appear to have adequate resources to conduct a mass revocation if signing key material were lost, because they rely on slow manual processes. If they are too constrained to do even minor things, then they REALLY cannot respond to emergencies.
Comments
Correct, the violations are minor and should be trivial to deal with.
The problem in this case is that Entrust displayed a complete disinterest into actually solving the underlying issues. Doing an oopsie is one thing. Doing an oopsie, lying about it, refusing to take precautions, and failing to take measures to prevent a repeat despite promising to do so? Completely different story.
If they can't be trusted to respond properly to minor administrative issues, why should they be trusted to respond adequately during a real security incident?
Indeed one of the things that got raised is that they do not appear to have adequate resources to conduct a mass revocation if signing key material were lost, because they rely on slow manual processes. If they are too constrained to do even minor things, then they REALLY cannot respond to emergencies.