July 2022 - anti-abuse-wg - mailman.ripe.net

postal address in IRT objects
by denis walker 23 Jul '22

23 Jul '22

Colleagues I have started a discussion on the DB-WG mailing list about the usefulness (or not) of a mandatory postal address in the IRT object. As there are perhaps more CSIRT people on this mailing list I thought I would bring it to your attention. The discussion starts here https://www.ripe.net/ripe/mail/archives/db-wg/2022-July/007537.html Your opinions would be appreciated. cheers denis proposal author

3 2

International survey on cyber skill gap in tertiary education
by Wout de Natris 15 Jul '22

15 Jul '22

Dear colleagues, We are currently researching the growing gap between the skills of young people graduating from tertiary studies and the expectations of employers in the tech and cybersecurity industry, and we're interested in hearing your views. We kindly invite you to fill out our survey in English<https://forms.gle/Dna6nSeiKMFY11cP9>, French<https://forms.gle/BzGZmmT2iJqkLRat8> or Polish<https://forms.gle/5cgeRjz29r1ZKTWE8>. The deadline is 15 August. The survey has been developed by the IGF's Internet Standards, Security and Safety Coalition (IS3C)<http://www.is3coalition.org>. It aims to establish where the gaps are and possible solutions, as well as to find out more about current good practice in this area around the world. To do this we need your views, knowledge and expertise. We hope you can assist us in getting a clear picture of the current playing field by filling in this questionnaire. An analysis of results will be made available at www.is3coalition.org<http://www.is3coalition.org/> in September 2022, in the lead up to a series of workshops bringing together academia and industry. If you know colleagues interested in this topic, then please share this survey with them. Best regards, Janice Richardson, Wout de Natris Chair of WG2 of the IS3C IS3C Cordinator https://forms.gle/5cgeRjz29r1ZKTWE8 - Polish version https://forms.gle/BzGZmmT2iJqkLRat8 - French version https://forms.gle/Dna6nSeiKMFY11cP9 - English version - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

Reclamation of Number Resources
by Ronald F. Guilmette 07 Jul '22

07 Jul '22

Greetings all, As many of you no doubt know, there has been quite an extraordinarily large brouhaha of late within the AFRINIC region relating to AFRINIC's efforts to reclaim certain large blocks of IPv4 addresses from one particular member organization. This effort has resulted in considerable litigation within Mauritius, the home country of AFRINIC. Partially as a result of this ongoing controversy, but also just for my own edification, I would like to ask a number of questions about any and all prior instances in which RIPE has reclaimed number resources from member organizations, based on policy. It seems safe to assume that there have historically been some instances in which RIPE memberships have been terminated, and any associated assigned number resources reclaimed, if and when a given member has simply failed to pay fess due to RIPE. My questions however have to do with situations where policy violations other than the non-payment of fees are involved. Specifically, I would like to know if any of you can recall past instances where number resources have been reclaimed, by RIPE, for any of the following reasons: *) Usage of the assigned number resources was no longer consistant with the original justification submitted to RIPE. *) Violation(s) of out-of-region usage policy. *) Any other policy violations. Thanks in advance for any and all responses. Regards, rfg

1 0

Adding a "Security Information" contact?
by Max Grobecker 06 Jul '22

06 Jul '22

Moin-Moin and hello, TL;DR: Should there be an optional contact for sending security information to (i.e. about vulnerable services), which can be different from the abuse contact? Background: We get a reasonable amount of security information sent to our abuse mailbox about things like "There's a vulnerable Confluence server on your network" and "This IP has contacted a botnet C&C server". Technically, this is not an abuse related issue, but still relevant to know and forward to the respective customer. Most of these e-mails originate from our local CERT (in my case CERT-BUND in Germany) but there are some other senders which are informing about these vulnerable services. I guess, most other providers know about these from their local CERTs or other organizations. Our abuse mailbox is not overflowing with these, of course, but it makes semi-automated handling a bit painful. For example, we would like to forward these information to our customers, but we wont need to take further action on this, because we refuse to break into the offices of our customers at night and patch their software. Also, sometimes these reports contain outdated data and the vulnerability has been removed in the time between collecting these information and sending the e-mail. On the other hand, for real abuse like sending spam or participating in DDoS, we also want to forward this information as quick as possible (automated), but also we want to know about and escalate so we can pull the plug if needed. So I wondered, if there (c|sh)ould be an optional contact/role for sending security related information to? This could be a different mailbox which does another automated handling of forwarding this notifications. What is your opinion on this? Greetings Max

10 22