- ncc-announce - mailman.ripe.net

[News] Security Breach: Investigation Update
by Hans Petter Holen 10 Jan '24

10 Jan '24

Dear members, We recently informed you about our investigation into the breach of a member’s RIPE NCC Access account. A more detailed post-mortem analysis, including root causes and mitigations, will be published once the incident has been closed. In the meantime, we would like to inform you about our actions so far and next steps: - We have worked with the affected member to restore services to them. - If we believe that an account is at risk, based on notification from our threat intelligence provider or other sources, we force a password reset and inform the account holders. We are currently looking into automating this process. On average, we reset around 10 passwords per week. - We are performing targeted research to identify leaked RIPE NCC Access accounts in public data breaches. As a precautionary measure, we have forced a password reset on 800 accounts identified as vulnerable and notified the account holders. - The plans for our engineering teams are being reviewed in light of this incident. We are evaluating suggestions for improvement received alongside our existing plans. Our roadmaps will be updated accordingly. - We have decided to make two-factor authentication mandatory for RIPE NCC Access accounts and will prioritise the implementation. More details will be shared on the RIPE NCC Services WG mailing list once the timeline is finalised. ------------------------------- Two-Factor Authentication ------------------------------- If you have not already done so, enable two-factor authentication on your RIPE NCC Access account. Using two-factor authentication across all of your accounts can reduce your exposure to attacks like these. The guide for setting up two-factor authentication on your Access account can be found at: https://www.ripe.net/participate/member-support/ripe-ncc-access/two-step-ve… —-------------------------- Secure Your Account —-------------------------- Please follow our recommendations to help secure your RIPE NCC Access account: - Avoid reusing passwords for login credentials. - Use a password manager to automatically create random passwords and store them. - If you use a password management tool, we recommend that you enable data breach monitoring for your own credential or use https://haveibeenpwned.com/ or similar services. - Please review the accounts associated with your LIR, restrict access to necessary personnel only and remove former employee accounts. If you choose to create your own password: - Passwords are secret. Keep them so. - Use long passwords of at least 14 characters. - Do not reuse passwords. - Use a password manager to remember your password. - If a random password is impractical, use a passphrase instead. If you believe that your account might be vulnerable, please report this to security(a)ripe.net. Details about our technical emergency hotline are available at: https://www.ripe.net/support/contact/technical-emergency-hotline. Kind regards, Hans Petter Holen Managing Director and CEO, RIPE NCC

1 0

Security Breach: Please Enable Two-Factor Authentication
by Hans Petter Holen 04 Jan '24

04 Jan '24

Dear colleagues, In light of the recent incident where a RIPE NCC Access account was compromised, we urge you to review your own account security. ------------------------------- Two-Factor Authentication ------------------------------- If you have not already done so, enable two-factor authentication on your RIPE NCC Access account. Using two-factor authentication across all of your accounts can reduce your exposure to attacks like these. The guide for setting up two-factor authentication on your Access account can be found at: https://www.ripe.net/participate/member-support/ripe-ncc-access/two-step-ve… ------------------------------- Password Recommendations ------------------------------- We also encourage account holders to change their Access account password and follow these recommendations: - Avoid reusing passwords for login credentials. - Use a password manager to automatically create random passwords and store them. - If you use a SaaS based password management tool, enable dark web monitoring for your own credentials. If you choose to create your own password: - Use at least 14 characters to create a password. - Using passphrases can be helpful such as a favourite quote, fictional character name or line of song to greatly increase the length of the password while also making it easier to remember. We are currently investigating the compromise of the RIPE NCC Access account and continue to work with the account holder in question. We would also like to share that we are routinely responding to notifications of possible public breaches containing RIPE NCC Access accounts and actively resetting account passwords while notifying the account holders. In line with the previous resolution by the Executive Board, we are reporting all cases of attempted fraud to the Dutch authorities: https://www.ripe.net/about-us/executive-board/minutes/2017/minutes-110th-ex… Rest assured that the RIPE NCC is committed to taking the necessary steps to ensure the security of our services. We are currently investigating how we can change our roadmaps to make two-step verification mandatory for all RIPE NCC Access accounts as soon as possible and, in the longer term, offer a wider variety of verification mechanisms. If you suspect that your account might be impacted, please report it to security(a)ripe.net. Kind regards, Hans Petter Holen Managing Director and CEO, RIPE NCC

1 0

[news] 172nd RIPE NCC Executive Board Meeting - Summary Notes
by Hans Petter Holen 29 Dec '23

29 Dec '23

Dear RIPE NCC members, The RIPE NCC Executive Board held its 172nd Meeting on 13-14 December 2023. The minutes are now available. Minutes of the 172nd Meeting: https://www.ripe.net/about-us/executive-board/minutes/2023/minutes-172nd-ex… The Executive Board publishes the minutes of its meetings so that the workings of the Board and the decisions it makes are transparent to the membership it represents. The following is a summary of the main items from the meeting. Further details are available in the minutes. ------------------------------- Main Items ------------------------------- - Hisham Ibrahim, Chief Community Officer, presented on the Community and Engagement activities undertaken in 2023. He asked the Board to reconsider adding a budget to supplement national engagement efforts based on feedback heard from members at the General Meeting and at RIPE 87. The Board agreed to continue supporting these efforts and the Activity Plan and Budget 2024 was amended accordingly following a Board resolution. - James Kennedy, Chief Registry Officer, reported on the Registry service levels in 2023 and the sanctions compliance efforts. A community consultation will be held in 2024 to establish a general consensus on the RIPE NCC’s role in relation to the IPv4 market. - There were discussions on the budget, presented by Simon-Jan Haytink, Chief Financial Officer, including high-level estimates for the years 2025-27. - A discussion on the country code status for Kosovo was continued, and the RIPE NCC recommended maintaining the status quo and to continue to follow the ISO 3166-1 list for officially assigned country codes.The ISO 3166-1 Maintenance Agency only assigns codes after the UN recognition. Any interested party can engage with their national diplomatic services in order to establish a formal status for Kosovo in the UN. - The Board selected three new committee members for the selection committee of the RIPE NCC Community Projects Fund - Lidia Stępińska-Ustasiak, Sami Salih and Nuno Garcia, and thanked the outgoing members for volunteering their time. - Eleonora Petridou, Chief Information Security Officer, shared the new Risk Appetite Statements based on the redesigned Risk Management Framework. Rather than having a single risk appetite that would apply to the entire RIPE NCC, a more fine-grained solution with risk appetites applied for different areas such as financial, legal and organisational risk is proposed. - For Technology, the 2023 update and 2024 objectives were shared. This includes having a solid cloud strategy (offer on-premise and cloud solutions), modernising the Hadoop cluster by building a tiered storage solution, ensuring uptime of critical services, replacing SSO of the LIR Portal (KeyCloak), keeping costs within budget and increasing employee engagement. Some of the other topics under discussion included: - The HR status and benchmarking report for 2023 and plans for 2024 - A consultation with the Works Council (Ondernemingsraad) of the RIPE NCC - A review of the General Meeting November 2023 - An update from the RIPE Chair and a discussion on RIPE Meetings - Support for the Rob Blokzijl Foundation - The latest developments in AFRINIC - The joint board meeting between APNIC and the RIPE NCC ------------------------------- Resolutions Adopted ------------------------------- - The RIPE NCC Executive Board approves the minutes of EB#168, EB#169, EB#170 and EB#171. - The RIPE NCC Executive Board appoints Lidia Stępińska-Ustasiak, Sami Salih and Nuno Garcia to the available seats on the Community Projects Fund Selection Committee to serve a minimum term of one year and a maximum of three years. - The Board agrees to donate 50 kEUR to the Rob Blokzijl Foundation for the foundation to support its mission. - The RIPE NCC Executive Board approves the risk appetite statements as presented during EB#172. - The RIPE NCC Executive Board approves the publication of the RIPE NCC Activity Plan and Budget 2024, with the addition of 200 kEUR budget in External Engagement and Community. Kind regards, Hans Petter Holen Managing Director and Chief Executive Officer RIPE NCC

1 0

[news] RIPE NCC Activity Plan and Budget 2024 Published
by Hans Petter Holen 28 Dec '23

28 Dec '23

Dear RIPE NCC members, The RIPE NCC Activity Plan and Budget 2024 is now available. This document has been approved by the RIPE NCC Executive Board with input from our membership. It outlines the work we will undertake in the coming year and the associated costs for each activity. The document is available at: https://www.ripe.net/publications/docs/ripe-814/ The top five areas for cost savings compared to the 2023 budget are: - 1.9 M EUR (36%) Consultancy - 0.8 M EUR (18%) Information Technology - 0.2 M EUR (6%) Outreach & Public Relations - 0.3 M EUR (20%) Contributions - 0.2 M EUR (21%) Travel Key points in the 2024 Activity Plan and Budget: - 1.8M EUR decrease compared to the 2023 Budget - We expect to start 2024 with 21,500 LIR accounts - The Membership fee remains unchanged in 2024 at EUR 1,550 - Cost per LIR expected to be EUR 1,777 (1% increase) A section at the end of the document notes changes since the draft was published in October. During its December meeting, the Executive Board decided to allocate an additional 200 kEUR to fund national outreach efforts after hearing feedback from members during the RIPE Meeting and at the November 2023 General Meeting on the negative impact removing this funding could have on the community. All budget figures have been updated accordingly. Other changes include minor editorial changes, minor rounding changes and additional information on the following topics: - Decommissioning of the IPv4 Transfer Listing Service - Planned consultation on retiring the Secondary DNS service to LIRs - RIPEstat UI - Planned consultation on establishing a Mastodon instance - Clarified our share of the NRO ICANN contribution for IANA number functions Kind regards, Hans Petter Holen Managing Director and Chief Executive Officer RIPE NCC

1 0

[news] RIPE NCC Billing Procedure 2024 Published
by Simon-Jan Haytink 22 Dec '23

22 Dec '23

Dear RIPE NCC members, We are currently preparing our invoices for next year and expect to send them to all members towards the end of January 2024. If you want to see how your annual contribution will be calculated or find payment information, please refer to the RIPE NCC Billing Procedure 2024, which is now published: https://www.ripe.net/participate/member-support/payment/ripe-ncc-billing-pr… Kind regards Simon-Jan Haytink Chief Financial Officer RIPE NCC

1 0

[news] RIPE NCC Member Update: December 2023
by Boris Duval 22 Dec '23

22 Dec '23

Dear RIPE NCC members, The December 2023 Member Update is now available on our website. You can access it at: https://www.ripe.net/publications/news/member-update-december-2023 Best regards, Boris Duval Communications Officer RIPE NCC

1 0

[news] The RIPE NCC General Meeting November 2023
by Hans Petter Holen 01 Dec '23

01 Dec '23

Dear colleagues, The RIPE NCC General Meeting November 2023 took place from 29 November - 1 December 2023. A total of 1,204 votes were cast. The following resolutions were approved at the General Meeting: Resolution 1 “The General Meeting approves the redistribution of the excess contribution/deficit paid in 2023 by redistributing the RIPE NCC 2023 surplus/deficit to the membership in 2024.” Resolution 2* "The General Meeting, in accordance with Article 21 of the Articles of Association, adopts the amendments to the Articles of Association as proposed and announced by the Executive Board on 1 November 2023. Furthermore, the General Meeting instructs and authorises the Executive Board to perform or to have performed all that is required to have the amendments executed before a Dutch civil law notary." The voting report is available at: https://www.ripe.net/participate/meetings/gm/meetings/november-2023/voting-… My appreciation to everyone who took the time to vote and contributed to the important discussions at the GM. *There was a typo in resolution 2. The resolution text contained an incorrect reference to Articles 10 and 11.5 which should not have been included. An email was sent to all voters on the morning of 30 November to inform them. Kind regards, Hans Petter Holen Managing Director and Chief Executive Officer RIPE NCC

1 0

[GM] The RIPE NCC General Meeting Takes Place Tomorrow, 29 November
by Boris Duval 28 Nov '23

28 Nov '23

Dear RIPE NCC members, The RIPE NCC General Meeting 2023 (GM) will take place tomorrow at 16:00 (UTC+1). The GM is an opportunity for members to discuss the activities of the RIPE NCC. At this GM, members will vote on two resolutions. REGISTER BY 14:00 (UTC+1) TOMORROW Registration for the GM will close at 14:00 (UTC+1) tomorrow. If you would like to participate in the GM, please register at: https://my.ripe.net/#/meetings/active HOW TO VOTE The GM will use a third-party online voting platform, Assembly Voting. Electronic voting now requires two-factor authentication and voters will receive two emails - one with Voting Code 2 (identical to the GM registration number) and one with Voting Code 1 (pre-filled) and a link to the voting platform. Once voting is open, all eligible voters with a link can access the voting pages and cast their vote. Read the step-by-step how to vote guide: https://www.ripe.net/participate/meetings/gm/meetings/november-2023/voting-… RESOLUTIONS TO BE VOTED ON There is one resolution on the redistribution of the RIPE NCC surplus and one resolution on amendments to the Articles of Association. The Executive Board is recommending that members vote No to resolution 1 so that the surplus is added to the RIPE NCC reserves, and Yes to the Articles of Association amendments. All resolutions can be found at: https://www.ripe.net/participate/meetings/gm/meetings/november-2023/agenda PARTICIPATING IN THE GM You need to register to participate in the GM. If you are attending in person, don't forget to check in and pick up your GM badge at the registration desk after you are registered. You will need this to be able to enter the GM. You can already do this, and we advise you to pick up your GM badge as early as possible. All registered attendees will receive an email before the GM with the link to the virtual meeting platform. The link to vote in the GM will be sent during the GM and voting will become active after the Chair declares voting open. The agenda and supporting documents for the GM are available at: https://www.ripe.net/gm/nov2023 RIPE 87 Relevant presentations for the GM also take place in the RIPE NCC Services Working Group session at RIPE 87. You can watch the livestream of this session: https://ripe87.ripe.net/live/main/ For any GM-related questions, please email: agm(a)ripe.net. We welcome your participation in this important membership meeting. Kind regards, Boris Duval General Meeting Organisation Team RIPE NCC

1 0

[news] RIPE NCC Survey 2023: Key Findings Published
by Fergal Cunningham 24 Nov '23

24 Nov '23

Dear RIPE NCC members, The RIPE NCC Survey was conducted in May and June this year and 3,899 people took the time to participate and let us know their views on how the RIPE NCC is performing and the direction it should be taking in the years ahead. We are extremely grateful to all those who took the time to give their input. Survey Matters analysed the data and published a detailed report with the findings from the survey. We examined these and we now propose a number of our own key findings and areas where we need to address the issues raised in the survey. A list of all 40 key findings is available here: https://www.ripe.net/participate/member-support/surveys/ripe-ncc-survey-202… The list provides areas for investigation and consideration, and we will add any outcomes or work carried out in those areas as we move forward. We will also periodically review the list and make adjustments if necessary. In 2024, we will update the webpage with relevant information in each area. If you would like to comment on the key findings, please let us know at <survey(a)ripe.net>. There will also be a presentation on the survey results from Survey Matters at the RIPE 87 Meeting next week in the RIPE NCC Services Working Group (Wednesday, 14:00 UTC+1). You can still register to participate - online attendance is free of charge. https://ripe87.ripe.net/attend/register/ Kind regards, Fergal Cunningham Head of Membership Engagement RIPE NCC

1 0

[news] RIPE NCC Member Update: November 2023
by Kjerstin Burdiek 23 Nov '23

23 Nov '23

Dear RIPE NCC members, The November 2023 Member Update is now available on our website. You can access it at: https://www.ripe.net/publications/news/member-update-november-2023 Best regards, Kjerstin Burdiek Communications Officer RIPE NCC

1 0