136
edits
CA/Visa Issues: Difference between revisions
→Issue E: Inadequate Organization Validation Procedures (2016): PITRA --> PIT audit
(→Issue D: Inadequate Domain Validation Procedures (2016 - Present): PITRA --> PIT audit) |
(→Issue E: Inadequate Organization Validation Procedures (2016): PITRA --> PIT audit) |
||
| Line 70: | Line 70: | ||
==Issue E: Inadequate Organization Validation Procedures (2016)== | ==Issue E: Inadequate Organization Validation Procedures (2016)== | ||
Visa’s original BR | Visa’s original BR point-in-time audit describes the following deficiency: | ||
"Visa has a detailed corporate onboarding process for new clients who may ultimately require publicly trusted SSL certificates to do business with VISA. However, it was noted that the VISA CA’s vetting procedures do not specifically address the referenced WTBR criteria at the time of certificate issuance for verification of the O, OU, L, C attributes. It was also noted that the VISA CA uses an internal system (VISA Profiler) to verify client organization and individual information, but there is no process in place to validate that information by using a third-party database considered a Reliable Data Source or attestation letters." | "Visa has a detailed corporate onboarding process for new clients who may ultimately require publicly trusted SSL certificates to do business with VISA. However, it was noted that the VISA CA’s vetting procedures do not specifically address the referenced WTBR criteria at the time of certificate issuance for verification of the O, OU, L, C attributes. It was also noted that the VISA CA uses an internal system (VISA Profiler) to verify client organization and individual information, but there is no process in place to validate that information by using a third-party database considered a Reliable Data Source or attestation letters." | ||