Q-5 DU SOL CYBER CRIME
Electronic Signature Certificates
According to Sec. 2(1)(tb) ‘Electronic Signature Certificate’ means “an electronic signature certificate issued under section 35 and includes Digital Signature Certificate.”Digital Signature Certificates are the electronic equivalent of physical or paper certificates (e.g., drivers’ licence, passport, membership card etc.). There are basically 3 types of digital signature certificates : Class I, Class II and Class III and each
Digital signatures rely on public and private keys. Those keys have to be protected in order to ensure safety and to avoid forgery or malicious use. When you send or sign a document, you need assurance that the documents and the keys are created securely and that they are using valid keys. Certifying Authority, a type of Trust Service Provider, are third-party organizations that have been widely accepted as reliable for ensuring key security and that can provide the necessary digital certificates. Both the entity sending the document and the recipient signing it must agree to use a given Certifying Authority.
DocuSign is also a Certifying Authority when signers sign using the DocuSign Express Digital Signature. That means you can always send a document with a digital signature by using DocuSign as the Certificate Authority. Alternatively, you can securely establish your own Certifying Authority using the DocuSign Signature Appliance and still access the rich features of DocuSign cloud services for transaction management. Some organizations or regions rely on other prominent CAs, and the DocuSign platform supports them, as well. These include OpenTrust, which is widely used in European Union countries, and SAFE-BioPharma, which is an identity credential that life science organizations may elect to use
Duties of Certifying Authority (Secs. 30 – 34)
To follow certain procedures regarding security system (Sec. 30). The Act has laid down certain procedures relating to security system to be followed by the certifying authority in the performance of its services. It must :
1. make use of hardware, software, and procedures that are secure from intrusion and misuse ;
2. provide a reasonable level of reliable services ;
3. adhere to security procedures to ensure the secrecy and privacy of electronic signatures ;
4. be the repository of all Electronic Signature Certificates ;
5. publish information regarding its practices, Electronic Signature Certificates and current status of such certificates ; and
6. observe the specified standards.
The above stated security procedures must ensure the achievement of 4 objectives of a security system : Confidentiality, accessibility of information, consistency of information and authorized use of resources.
b. To ensure compliance of the Act (Sec. 31). The certifying authority must ensure that every person employed or engaged by it complies with the provisions of the Act, rules, regulations or order, made thereunder.
c. To display its licence (Sec. 32). The certifying authority must display its licence at a conspicuous place in the premises in which it carries on its business.
d. To surrender its licence (Sec. 33). The certifying authority must surrender its licence to the controller on its suspension or revocation.
e. To make certain disclosures (Sec. 34). The certifying authority is required to make the following disclosures :
1. Disclosure of Electronic Signature Certificate ;
2. Disclosure of Certification Practice Statement (CPS) ;“Certificate Practice Statement” means a statement issued by a certifying authority to specify the practices that the certifying authority employs in issuing electronic signature certificates [Sec. 2(1)(k)]
It also outlines the CA’s policies, practices and procedures for verifying keys and suspension, revocation and renewal of electronic signature certificates.
3. Disclosure of notice of revocation and suspension of Certificates of Certifying Authority ;
4. Disclosure of facts materially and adversely affecting the reliability of electronic signature certificate
5. Disclosure of adverse effects to affected person [Sec. 34(2)]. The authority is bound to disclose to affected person about any event which may materially and adversely affect the integrity of the computer system or the conditions under which electronic signature certificate was granted. The certifying authority is required to act in accordance with the procedure specified in its CPS to deal with such event or situation.
Comments
Post a Comment