<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>On 17 Feb 2022 10:13 am, Joly MacFie wrote:<br>
</p>
<blockquote type="cite"
cite="mid:CAM9VJk0ve=nmX6NNqDGex_3eT7+EgL5YeP65DiumsaPSQu+2RA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">While I
concur with concerns about the transparency, I will just say
that there is a difference between a breach and a detected
vulnerability, so let's not get ahead of ourselves.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
</div>
</blockquote>
<p>If the vulnerability were unexploited that distinction may hold.
If, as reported by 3rd parties, there is ISOC member data out
there, then clearly there was a breach. In any case, i believe
notification requirements apply, here in our jurisdiction if not
in yours. <br>
<br>
</p>
<blockquote type="cite"
cite="mid:CAM9VJk0ve=nmX6NNqDGex_3eT7+EgL5YeP65DiumsaPSQu+2RA@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">What does
seem odd is the length of time between the discovery and the
reaction.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
</div>
</blockquote>
<p>ISOC HQ told us to expect more information (clarification,
details, etc.), we waited patiently as is proper. Should chapters
have done otherwise -- speak now or forever hold your peace? :) <br>
</p>
<p><br>
WYn<br>
</p>
<br>
<blockquote type="cite"
cite="mid:CAM9VJk0ve=nmX6NNqDGex_3eT7+EgL5YeP65DiumsaPSQu+2RA@mail.gmail.com">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, Feb 16, 2022 at 7:35
PM Winthrop Yu via Chapter-delegates <<a
href="mailto:chapter-delegates@elists.isoc.org"
moz-do-not-send="true" class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Olivier, we don't need press releases or "updates". <br>
</p>
<p>At the very least, we need: <br>
</p>
<p>a) a clear, comprehensive yet concise official statement
from ISOC HQ regarding the breach. <br>
</p>
<p>b) including whether ISOC HQ has notified <b>all</b>
its global members (which would include the individual
members of chapters).</p>
<p>That above is a bare minimum. Then we will have to check
that against any obligations the chapter itself may have
under local law. And we may subsequently need further
clarification / statements from ISOC HQ. <br>
</p>
<p>WYn<br>
</p>
<p><br>
</p>
<div>On 17 Feb 2022 1:45 am, Olivier MJ Crépin-Leblond via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite"> Am I the only one in Chapter
Delegates mailing list who received and read the email
from Christine Saegesser explaining the problem with
MemberNova and referring to:<br>
<br>
"As we noted in our prior email, after we learned of the
issue, we launched an investigation. The investigation
is continuing, and we will provide more details when we
have more information to share. Going forward, updates
will be posted at <a
href="http://updates.internetsociety.org"
target="_blank" moz-do-not-send="true">updates.internetsociety.org</a>,
and we encourage you to check there for additional
information. The membership password to access
this website is ISOC-AMS-Updates (case sensitive)."<br>
<br>
Or is the problem that there does not appear to have been
any updates since 21st January 2021?<br>
<br>
Kindest regards,<br>
<br>
Olivier<br>
<br>
<br>
<div>On 16/02/2022 14:54, Veni Markovski via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite"> <font face="Helvetica, Arial,
sans-serif">+1 to the request for more clarity; our
members need to be informed, and I don't want to share
on social media a link to an article on some website.
There should be something at <a
href="http://isoc.org" target="_blank"
moz-do-not-send="true">isoc.org</a>, and in the news
section there's only one press release from 2022 - on
February 4. <br>
<br>
Also, it's not a good thing to find out from a
publication about some of the details (I assume not
all of them)...<br>
<br>
v/<br>
</font><br>
<div>On 2/16/22 04:19, Roland Turner via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<div>Andrew,</div>
<div><br>
</div>
<div>Could we have a little more clarity on this
please? Chapter members in multiple jurisdictions
may have notification obligations arising from this.</div>
<div><br>
</div>
<div><br>
</div>
<div>The <a
href="https://updates.internetsociety.org/"
target="_blank" moz-do-not-send="true">Jan 21</a>
update states:</div>
<div>
<blockquote type="cite">Fortunately, we have still
not seen any instances of malicious access to
member data as a result of this issue.</blockquote>
</div>
<div><br>
</div>
<div>This appears a little unclear to me on two
important fronts:</div>
<div><br>
</div>
<div><b>"have not seen"</b></div>
<div><br>
</div>
<div>An adversarial read of this is the rather
horrifying idea that access logging was not turned
on, so you (and MemberNet) haven't the faintest idea
whether there were any unauthorised accesses, which
would certainly allow you say that you hadn't seen
any unauthorised accesses but wouldn't mean that
there weren't any, even at a reasonable level of
confidence. Hopefully this is not the case!</div>
<br>
<div><b>"malicious access"</b></div>
<div><br>
</div>
<div>The relevant question is not whether any accesses
could be described as malicious, but simply whether
they were unauthorised. An adversarial read of this
is that there were unauthorised accesses, but
because you don't have much information about the
unauthorised accessers you not in a position to say
that they were acting maliciously, however this
would tell us nothing about whether there had been
unauthorised access. Again, hopefully this is not
the case!</div>
<div><br>
</div>
<div><br>
</div>
<div>To address both concerns, are you able to confirm
that:</div>
<div>
<div>
<ol>
<li>access logging was turned on and the logs
were successfully secured;<br>
</li>
<li>the logs appear to be complete (in this case
"appear to" is fine; the requirement is simply
that there are no unexplained gaps); and<br>
</li>
<li>all logged accesses are authorised (i.e.
because they were made by the application
server, not random external IP addresses)</li>
</ol>
?<br>
</div>
<div><br>
</div>
</div>
<p><br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2"><br>
<div>On 16/2/22 15:41, Hank Nussbacher via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<pre>In case you missed it:
<a href="https://www.infosecurity-magazine.com/news/internet-society-data-leaked/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.infosecurity-magazine.com/news/internet-society-data-leaked/</a>
Regards,
Hank
_______________________________________________</pre>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
</body>
</html>