<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">+1 to the request for more
clarity; our members need to be informed, and I don't want to
share on social media a link to an article on some website. There
should be something at isoc.org, and in the news section there's
only one press release from 2022 - on February 4. <br>
<br>
Also, it's not a good thing to find out from a publication about
some of the details (I assume not all of them)...<br>
<br>
v/<br>
</font><br>
<div class="moz-cite-prefix">On 2/16/22 04:19, Roland Turner via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6f05327d-ef4d-3434-028b-3e68c248006d@rolandturner.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="moz-cite-prefix">Andrew,</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Could we have a little more clarity
on this please? Chapter members in multiple jurisdictions may
have notification obligations arising from this.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">The <a moz-do-not-send="true"
href="https://updates.internetsociety.org/">Jan 21</a> update
states:</div>
<div class="moz-cite-prefix">
<blockquote type="cite">Fortunately, we have still not seen any
instances of malicious access to member data as a result of
this issue.</blockquote>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">This appears a little unclear to me
on two important fronts:</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><b>"have not seen"</b></div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">An adversarial read of this is the
rather horrifying idea that access logging was not turned on, so
you (and MemberNet) haven't the faintest idea whether there were
any unauthorised accesses, which would certainly allow you say
that you hadn't seen any unauthorised accesses but wouldn't mean
that there weren't any, even at a reasonable level of
confidence. Hopefully this is not the case!</div>
<br>
<div class="moz-cite-prefix"><b>"malicious access"</b></div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">The relevant question is not whether
any accesses could be described as malicious, but simply whether
they were unauthorised. An adversarial read of this is that
there were unauthorised accesses, but because you don't have
much information about the unauthorised accessers you not in a
position to say that they were acting maliciously, however this
would tell us nothing about whether there had been unauthorised
access. Again, hopefully this is not the case!</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">To address both concerns, are you
able to confirm that:</div>
<div class="moz-cite-prefix">
<div class="moz-cite-prefix">
<ol>
<li>access logging was turned on and the logs were
successfully secured;<br>
</li>
<li>the logs appear to be complete (in this case "appear to"
is fine; the requirement is simply that there are no
unexplained gaps); and<br>
</li>
<li>all logged accesses are authorised (i.e. because they
were made by the application server, not random external
IP addresses)</li>
</ol>
?<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
</div>
<p><br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2"><br>
<div class="moz-cite-prefix">On 16/2/22 15:41, Hank Nussbacher via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite"
cite="mid:d3060f8a-4815-c9b5-7c09-8c1dc1e2e5f7@post.isoc.org.il">
<pre class="moz-quote-pre" wrap="">In case you missed it:
<a class="moz-txt-link-freetext" href="https://www.infosecurity-magazine.com/news/internet-society-data-leaked/" moz-do-not-send="true">https://www.infosecurity-magazine.com/news/internet-society-data-leaked/</a>
Regards,
Hank
_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a class="moz-txt-link-freetext" href="https://admin.internetsociety.org/622619/User/Login" moz-do-not-send="true">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a class="moz-txt-link-freetext" href="https://www.internetsociety.org/become-a-member/code-of-conduct/" moz-do-not-send="true">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
<p><br>
</p>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a class="moz-txt-link-freetext" href="https://admin.internetsociety.org/622619/User/Login">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a class="moz-txt-link-freetext" href="https://www.internetsociety.org/become-a-member/code-of-conduct/">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Best regards,
Veni
<a class="moz-txt-link-freetext" href="https://www.veni.com">https://www.veni.com</a>
pgp:5BA1366E <a class="moz-txt-link-abbreviated" href="mailto:veni@veni.com">veni@veni.com</a>
The opinions expressed above are those of the
author, not of any organizations, associated
with or related to him in any given way. </pre>
</body>
</html>