GLEIF verifiable LEI (vLEI) Ecosystem Governance Framework 1.0 Risk Assessment Document Version 1.1 2023-04-03 Version Date: 2023-04-03 Status: Final DID URL for Risk Assessment: did:keri:EINmHd5g7iV-UldkkkKyBIHO52blyxZNBn9pg- zNrYoS?service=vlei- documents&relativeRef=/egf/docs/2023-04- 03_verifiable-LEI-(vLEl)-Ecosystem-Governance- Framework-Risk-Assessment_v1.1_Final.xlsx
ceir) verifiable LEI (VLEI) Ecosystem Governance Framework 1.0 Risk Assessment Document Version v1.1_Final 2023-04-03 RISK N RISK TOIP L. [RLSTARERS SEVERITY LIKELIHOOD RicK RISK CONSIDERATION ACTIONS RISK TREATMENT RISK TREATMENT ACTION RISIDUAL RISK o Ve ARFECTED IMPACT GOVERNING AUTHORITY (GLEIF) RISKS GLEIF - Global Legal Entity Identifier Foundation operates and manages the Global LEI System (GLEIS); Lack of competence to perform role Ecosystem Governance 4 1 peediiofexneticncedipersennelipiopertialneland Mitigation Mitigated by proper, regular training ResidallnsKiegardediolbelionand governance framework acceptable. Lack of sufficient policy and practices Ecosystem Governance 1 1 Low Need for complete governance framework and feedback Mitigation Mitigated by GLEIF workflows supported by KERI vLEI Residual risk regarded to be low and loop software acceptable. P " Y 5 Residual risk | Lack of consistency,inits ownloperating practices Eeosystemy] (Govemance 3 1 LoW Requlre§ independent oversight and trust assurance AGEEEER Covered l?y 1SO 20000 certification along with esidual risk regarded to be low and mechanisms systematic control acceptable. it Fi k, VLEI Lack of consistency in operating practices of Qualified vLEI Requires proper oversight and trust assurance o pleated b'y'Ecc'system GEUAHEIES AEES U Residual risk regarded to be low and Ecosystem Governance 3 3 A Mitigation Issuer Qualification Program and use of Key Event Issuers mechanisms N acceptable. Receipt Infrastructure (KERI) protocol " . . Mitgated by Ecosystem Governance Framework, and . ) R | risk | Lack of accountability of roles in network Ecosystem Governance 3 1 LOW (RIS (e su'perwsory aodicealicienlehuandiisr Mitigation specifically for Qualified vLEI Issuers, the VLEI Issuer aaleiee adeditclocionfand assurance mechanisms . acceptable. Qualification Agreement Lack of legal enforcability of Authentic Chained Data . o o GLEIF is researching and monitoring the legal Residual risk regarded to be low and Container (ACDC) credentials in jurisdictions eSS Coenance B B ESlicslmenitonnelciitRaliceallaceeptance Ritesue enforcability of ACDCs in jurisdictions. acceptable. Requires members of ecosystems to agree to use the Work with industries to support their use cases with Residual risk regarded to be low and Ecosystem lacks industry acceptance or insufficient demand Ecosystem Governance 4 3 q 4 8 Mitigation R . p;'n' . E VLEI VLEI for organizational identification needs acceptable. Qualif
ied vLEI Issuer — An organization qualified by Qualified vLEI Issuer Risks GLEIF to issue Legal Entity vLEI Credentials and Legal Entity Official Organizational Role vLEI Credentials Requires authorization by Legal Entity's Authorized " . . _— Representatives (LARs), Identificaton of the person and VLEI Legal Entity Credential or vLEI Legal Entity Official 'g . R s J . ty . . Processing Requires training, trust assurance practices, controlled S Official Organizational Role (OOR) of the OOR Person, Residual risk regarded to be low and Organizational Role Credential issued without appropriate Credential 3 5 3 A Mitigation P e Integrity practices and proper workflow verification of control of KERI DID. Include a acceptable. verification R e, Issuer/Approver workflow in Qualified vLEI Issuer operations . . L . . Requires appropriate monitoring of obligations of Legal o Monitoring of the status of the Legal Entity's LEI by Residual risk regarded to be low and Legal Entity vLEI Credential Becoming invalid Credential Security 5 3 . Entities holding vLEls Mitigation Qualified VLEI Issuers acceptable. Riskis not to GLEIF. Legal Entities will be solely Legal Entity Official Organizational Role VLEI Credentials Requires appropriate action by Legal Entities to manage responsible for the management of vLEI Role Residual risk regarded to be low and d A ty " = Credential Security 1 1 LOW q e ] v ¢ Acceptance b A ¢ ey . e becoming invalid their vLEI Role Credentials Credentials issued and the composition of their acceptable. organizational wallets. e . . . - " S " . Residual risk regarded to be low and Qualified VLEI Issuer operations unavailable Credential Availability 5 3 Requires network redundancy procedures Mitigation Requires contingency and systen redundancy .
Qualified vLEI Issuer using obsolete and/or untested vLEI . Processing Requires change management process for Qualified vLEI . Eirng ma‘n‘agernent reeess el I i el Residual risk regarded to be low and Credential s 5 3 Mitigation Issuer Qualification Agreement. GLEIF to manage the software or APls Integrity Issuers o acceptable. change management process for Qualified vLEI Issuers Verifier Risks Verifier - An entity that is verifying the components and provenance of a vLEI credential for a use case Lack of consistent verification practices Credential Security 2 1 LOW- Requires tralnlng, trust assurance practices and Mitigation Mitigated by educatlhg Verlfler? of the existence of Residual risk regarded to be low and MEDIUM controlled practices proof requests to verify credentials acceptable. Evidence of verification incomplete or in incorrect format of Credential Processing 5 2 Requires standard formats and formatting controls for Mitigation Develop standard formats and formatting controls for ~ Residual risk regarded to be low and proof requests Integrity proof requests £ proof requests acceptable. Residual risk will be the time " - . e . between request to revoke is made Requires adequate VLEI status and validity checkin, Mitigated by KERI VLEI software that automaticall Revoked VLEI being accepted Credential Security 5 2 q q v 8 Mitigation 8 v . N V. by the Legal Entity and actual procedures checksrevocation status before accepting a credential A . revocation at the Qualified vLEI Issuer. n . . . e . . " e . . S e . - Residual risk regarded to be low and Man-in-the_middle attack during legitimate verification Credential Security 5 3 Requires Verifier vulnerability practices Mitigation Mitigate with security in KERI vLEI software —— Verifier network unavailable Credential Availability 5 3 Requires network redundancy procedures Mitigation Mltlgate paiapercpriateiEtenledundaneyond Raliskicesiediclbelowlend contingency acceptable. GLEIF Credential Registry Risks GLEIF manages its own Credential Registry. These are risks associated with that repository. Lack of competence to perform role Credential Governance 5 1 A REGMIES tralnlng, [Setasstiancelpiact cesland Mitigation Mitigated by proper, regular training Residalliekecardediiolbelionand MEDIUM controlled practices acceptable. Unavailable registry Credential Availability 5 3 Requires availability controls Mitigation Mltlgate ihlaporeniaiciyetenliedindancyiang Residalliekecardediiolbelionand contingenc
y acceptable. A n . . " . S e . . Residual risk regarded to be low and Lack of appropriate access to registry Credential Security 5 3 Requires appropriate access controls Mitigation Mitigate with effective access controls . " . . . . " . S e . - Residual risk regarded to be low and Inapproriate access writes to registry Credential Security 5 2 Requires appropriate access management controls Mitigation Mitigate with security in KERI vLEI software L Breach of registry Credential Security 5 2 Requlr‘es approprlna‘te s.ecunty EermecrbEach Mitigation Mitigate with security in KERI vLEI software R aliERceeediiobeliowland detection and notification controls acceptable. Exploited use of stolen vLEls Credential Security 5 2 Requires adequate breach notification processes Mitigation Mltlga?ed iy ¥ 63 () ) s wiidn (e i Residalliekecardediiolbelionand Reporting API acceptable. GLEIF VLEl Issuer Qualification Program Risks GLEIF operates its own VLEI Issuer Qualification program. These are the risks associated with that program. Lack of competence to perform role Ecosystem Governance 1 1 LOW RegEs tralr.ung, suff|.C|ent exbetiencelandeenerall Mitigation Mitigated by proper, regular training Residalliekecardediiolbelionand accepted auditor practices acceptable. Inconsistent or biased qualification process Eeosystemy] (Govemance 2 1 LoW ReqL‘ures we!l-documented requirements and process, Mitigation Mltlgated by comprehensive program, applied Residual risk regarded to be low and applied consistently consistently acceptable. Legal Entity Risks Legal Entity — a legal person or structure that is organized under the laws of any jurisdiction that meets the eligibility criteria for registering for a LEI. Mitigated, since an invalid LEI would never appear and Counterfeit credentials (not based on valid LEIs) being issued Credential Privacy 5 1 Lo Requires adequate credential non-repudiation practices Mitigation et nst e cheatztlin tie ClEB el cc?unterfelt e ol krseaiedicbeloniond MEDIUM never would be able to connect to the chain of trust of acceptable. the VLEI system. This risk must be tackled at the issuance stage. First, the QVI only can issue on receipt of a QVI Authorization VLEI sent by the Legal Entity Authorized Representatives (LARs). Then,as part of the Identity Verification process, the QVI will verify that the OOR Requires adequate VLEI Role Credential issuance Person is in control of their DID. OOR VLEI Role Residual risk regarded to be low and Lack of binding
between Legal Entity and VLEls issued Credential Confidentiality 5 2 q q Mitigation . . . . 8 measures Credentials will have role lists that can act as a guide acceptable. for the types of OORs expected for the entity legal form of the Legal Enity, preventing OOR Credential issuance for bogus official roles. Assigning roles for Engagement Context Role Credentials entirely will be the responsibiity of the Legal Entity.
Residual risk is that Holders do not adequately protect their wallets and There will be a list of requirements/features for re\?ent cot:fsion despite the Imposter using valid Legal Entity vLEI Credential Credential Security 5 2 Requires adequate wallet protection measures Mitigation wallets holding credentials and that will be relied upon h . . & . guidance and requirements in the by VvLEI Holders. VLEI Ecosystem Governance Framework. Mitigated by KERI prerotation and effective wallet management. The best mitigation for a wallet's access key is to use Residual risk resarded to be low and Private signing key is compromised Credential Security 5 5 HIGH Requires adequate protection measures for private keys Mitigation multi-signatures for the identfier which means that tabl 8 multiple wallets must be compromised. Thus acceptable. compromise of one wallet private key does not result in loss of control of the identifier. Lack of portability of vLEIs Credential Availability 5 2 - Requires adequate VLEI interoperability practices Mitigation KERI will provide vLEI portability. ::cst-lz‘:’:aaLIZSk [cesdediiobelionand The vLEl is designed as an Ecosystem Governance Residual risk ded to be | d Lack of credential federation across ecosystems Ecosystem Availability 5 3 Requires adequate credential interoperability practices ~ Mitigation Framework to be able to interoperate within other esl :ablns regarded to be low an ecosystems. acceptable. Social engineering attacks sucessfully gather credentials b Credentials will be cryptographically bound to wallets Residual risk regarded to be low and 8 8 ve Y Credential Security 5 2 Requires adequate wallet protection measures Mitigation . _ryp 8rap Y 8 perpetrators and can be biometrically bound to Holders acceptable. Utility Risks Risks associated with KERI infrastructure (Part 1) and vLEI Credentials (Part 2) All VLEI software will be publicly available open source o code that will be conformance tested prior to Residual risk regarded to be low and 5 2 Mitigation distribution. ATVA (Topological Vulnerability Analysis) acceptable. VLE software contains undetected bugs or defects that can VLEI software should be tested and/or reviewed or scan can be requested to be performed for new be exploited by attackers. * Utility Security audited for bugs and defects, internally and externally applications. o Can be tested us_lngathlrd-partysecuntyrlsk Residual risk regarded to be low and 5 1 Mitigation assessment against KERI Key M
anagement acceptable Inadequate protection of pre-rotated sets of keys* Utility Security Training and monitoring of key management practices Requirements ' 5 a A Can be tested using a third-party security risk Residual risk regarded to be low and Best practices for code delivery and library usage not g assessment against KERI Key Management acceptable. followed for signature verification infrastructure* Utility Security Training and monitoring of best practices implemented Requirements Can be tested using a third-party security risk . . The specific holders of cryptographic keys have not been kept 3 2 Mitigation assessment against KERI Key Management ReS|d:aL|r|sk [cesdediiobelionand confidential.* Utility Security Training and monitoring of key management practices Requirements acceptable. The time and place of key rotation have not been kept Can be tested using a third-party security risk . . confidential among the key holders until after the rotation 3 2 Mitigation assessment against KERI Key Management ReS|d:aL|r|sk [cesdediiobelionand has been completed.* Utility Security Training and monitoring of key management practices Requirements acceptable. lified VLEI | h t itored their publi Qlfa fHed v ssue‘rs ave not moni ore. elr‘pu ¢ S Residual risk regarded to be low and Witnesses for vLEI issuance and revocation registry for 5 1 Mitigation tabl erroneous or malicious issuances and revocations. Utility Security Secondary monitoring by GLEIF GLEIF secondary Witness monitoring program acceptable. *Note: Utility layer risks also can affect the higher layers.
COLUMN HEADER EXPLANATION Potential Values [ RiskF |Auniaue dentiler of o ik for ierence purposes [ Risk Description Description of a unique risk TolP Layer The Governance Stack Layer the risk operates based on the TolP Governance Stack Eredzntlal Utility Availability Trust Area Affected Information trust component affected by the risk Availability Processing Integrity Negligible Severity Judgmental evaluation of impact the risk would have on the entity if realized Highly Unlikely Judgmental evaluation of the potential that the risk will occur risk without controls or other circumstances to prevent it. Low Judgmental scoring of risk's effect based on severity and and likelihood. Risk Consideration Actions Factors to consider regarding risk treatment Mitigation Risk Treatment Recommended action category to take to handle the risk Risk Treatment Action High level action identified to treat risk Residual Risk Judgmental level or state of risk after applying risk treatment Text or Impact Level
--
8 -- o -
o
=
]
w
=
-
w
o
w
I
8 - - o - - MEDIUM MEDIUM MEDIUM-HIGH HIGH - MEDIUM MEDIUM-HIGH HIGH HIGH