This document recommends measures to mitigate the impact of security incidents on trust service providers (TSP) by proposing suitable technical and organisational means to handle the security risks posed to the TSP. This is done using a certification service provider (CSP) as representative example. The document focuses on the concepts and entities of hierarchical public key infrastructures (PKI), leaving other concepts, such as web of trust, out of scope.
December 20, 2013
Iñigo Barreira, Izenpe, Tomas Gustavsson, Primekey, Alexander Wiesmaier, AGT International, Clara Galan Manso, Ministry of Defense, Spain (Seconded National Expert at ENISA during the time of the study), Sławomir Górniak, ENISA