<div dir="ltr"><div class="gmail_default" style="font-size:small">While I concur with concerns about the transparency, I will just say that there is a difference between a breach and a detected vulnerability, so let's not get ahead of ourselves.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">What does seem odd is the length of time between the discovery and the reaction.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">joly</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 16, 2022 at 7:35 PM Winthrop Yu via Chapter-delegates <<a href="mailto:chapter-delegates@elists.isoc.org">chapter-delegates@elists.isoc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Olivier, we don't need press releases or "updates". <br>
</p>
<p>At the very least, we need: <br>
</p>
<p>a) a clear, comprehensive yet concise official statement from
ISOC HQ regarding the breach. <br>
</p>
<p>b) including whether ISOC HQ has notified <b>all</b> its global
members (which would include the individual members of chapters).</p>
<p>That above is a bare minimum. Then we will have to check that
against any obligations the chapter itself may have under local
law. And we may subsequently need further clarification /
statements from ISOC HQ. <br>
</p>
<p>WYn<br>
</p>
<p><br>
</p>
<div>On 17 Feb 2022 1:45 am, Olivier MJ
Crépin-Leblond via Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
Am I the only one in Chapter Delegates mailing list who received
and read the email from Christine Saegesser explaining the problem
with MemberNova and referring to:<br>
<br>
"As we noted in our prior email, after we learned of the issue, we
launched an investigation. The investigation is continuing, and we
will provide more details when we have more information to share.
Going forward, updates will be posted at <a href="http://updates.internetsociety.org" target="_blank">updates.internetsociety.org</a>, and we
encourage you to check there for additional information. The
membership password to access this website
is ISOC-AMS-Updates (case sensitive)."<br>
<br>
Or is the problem that there does not appear to have been any
updates since 21st January 2021?<br>
<br>
Kindest regards,<br>
<br>
Olivier<br>
<br>
<br>
<div>On 16/02/2022 14:54, Veni Markovski
via Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<font face="Helvetica, Arial, sans-serif">+1 to the request for
more clarity; our members need to be informed, and I don't
want to share on social media a link to an article on some
website. There should be something at <a href="http://isoc.org" target="_blank">isoc.org</a>, and in the
news section there's only one press release from 2022 - on
February 4. <br>
<br>
Also, it's not a good thing to find out from a publication
about some of the details (I assume not all of them)...<br>
<br>
v/<br>
</font><br>
<div>On 2/16/22 04:19, Roland Turner via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<div>Andrew,</div>
<div><br>
</div>
<div>Could we have a little more
clarity on this please? Chapter members in multiple
jurisdictions may have notification obligations arising from
this.</div>
<div><br>
</div>
<div><br>
</div>
<div>The <a href="https://updates.internetsociety.org/" target="_blank">Jan 21</a>
update states:</div>
<div>
<blockquote type="cite">Fortunately, we have still not seen
any instances of malicious access to member data as a
result of this issue.</blockquote>
</div>
<div><br>
</div>
<div>This appears a little unclear to
me on two important fronts:</div>
<div><br>
</div>
<div><b>"have not seen"</b></div>
<div><br>
</div>
<div>An adversarial read of this is
the rather horrifying idea that access logging was not
turned on, so you (and MemberNet) haven't the faintest idea
whether there were any unauthorised accesses, which would
certainly allow you say that you hadn't seen any
unauthorised accesses but wouldn't mean that there weren't
any, even at a reasonable level of confidence. Hopefully
this is not the case!</div>
<br>
<div><b>"malicious access"</b></div>
<div><br>
</div>
<div>The relevant question is not
whether any accesses could be described as malicious, but
simply whether they were unauthorised. An adversarial read
of this is that there were unauthorised accesses, but
because you don't have much information about the
unauthorised accessers you not in a position to say that
they were acting maliciously, however this would tell us
nothing about whether there had been unauthorised access.
Again, hopefully this is not the case!</div>
<div><br>
</div>
<div><br>
</div>
<div>To address both concerns, are you
able to confirm that:</div>
<div>
<div>
<ol>
<li>access logging was turned on and the logs were
successfully secured;<br>
</li>
<li>the logs appear to be complete (in this case "appear
to" is fine; the requirement is simply that there are
no unexplained gaps); and<br>
</li>
<li>all logged accesses are authorised (i.e. because
they were made by the application server, not random
external IP addresses)</li>
</ol>
?<br>
</div>
<div><br>
</div>
</div>
<p><br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2"><br>
<div>On 16/2/22 15:41, Hank Nussbacher
via Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<pre>In case you missed it:
<a href="https://www.infosecurity-magazine.com/news/internet-society-data-leaked/" target="_blank">https://www.infosecurity-magazine.com/news/internet-society-data-leaked/</a>
Regards,
Hank
_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
<p><br>
</p>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
<br>
<pre cols="72">--
Best regards,
Veni
<a href="https://www.veni.com" target="_blank">https://www.veni.com</a>
pgp:5BA1366E <a href="mailto:veni@veni.com" target="_blank">veni@veni.com</a>
The opinions expressed above are those of the
author, not of any organizations, associated
with or related to him in any given way. </pre>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
<br>
<pre cols="72">--
Olivier MJ Crépin-Leblond, PhD
<a href="http://www.gih.com/ocl.html" target="_blank">http://www.gih.com/ocl.html</a></pre>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
</div>
_______________________________________________<br>
As an Internet Society Chapter Officer you are automatically subscribed<br>
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):<br>
<a href="https://admin.internetsociety.org/622619/User/Login" rel="noreferrer" target="_blank">https://admin.internetsociety.org/622619/User/Login</a><br>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" rel="noreferrer" target="_blank">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div>--------------------------------------<br>Joly MacFie +1<span title="Call with Google Voice">2185659365</span> </div><div>--------------------------------------</div>-</div></div></div></div></div>