- ncc-services-wg - mailman.ripe.net

Enhancing the Security of RIPE NCC Access
by Felipe Victolla Silveira 10 Apr '24

10 Apr '24

Dear colleagues, Over the past few months, the RIPE NCC has been working on enhancing the security of RIPE NCC Access. In a new article on RIPE Labs, I explain the recent enhancements we've implemented and provide an overview of forthcoming developments you can anticipate from us: https://labs.ripe.net/author/felipe_victolla_silveira/enhancing-the-securit… Kind regards, Felipe Victolla Silveira Chief Technology Officer RIPE NCC

2 1

Using Google for RIPE NCC Email
by Felipe Victolla Silveira 04 Apr '24

04 Apr '24

Dear colleagues, We want to inform you that from today we will be using Google for some of our email infrastructure at the RIPE NCC - we use Gmail to host our mailboxes, filter mail for spam and malware, and send some of our outgoing mail through their mail servers. On some emails we send, the headers will show they passed through the Google servers, but it’s still the same RIPE NCC you’re talking with. We have been using Google Workspace for some time internally for other purposes, so this change allows us to reduce operational overhead at no extra cost. All of the external cloud providers that we use are published here for transparency: https://www.ripe.net/support/documentation/cloud-technology-status/ Regards, Felipe Victolla Silveira Chief Technology Officer RIPE NCC

1 0

RIPE NCC Quarterly Planning Q2 2024
by Adonis Stergiopoulos 02 Apr '24

02 Apr '24

Dear colleagues, We have now published the Q2 2024 quarterly plans for our development teams: https://www.ripe.net/support/documentation/quarterly-planning Our plans include the work that will be carried out in the next few months and give you the opportunity to comment on those plans and suggest items that the RIPE NCC should be working on going forward. The plans cover the following areas: - Learning & Development - RIPE Database - Business Applications, including the LIR Portal, Registry Services and other applications. - DNS and K-root - RIPE Atlas - RIPEstat - Resource Public Key Infrastructure (RPKI) - Routing Information Service (RIS) - Information Security, Risk, and Compliance We have also made some changes to our reporting process. First, following our website refresh, we made it easier to identify the completed work items of previous quarters. You can check this by clicking on the ‘Archived Plans’ sub-page for each area. Second, we have decided to discontinue reporting on our ‘Information Technology (IT)’ area as we could only provide limited details, and the information was mostly relevant to internal teams. The previous IT plans will remain active on our website until they expire as part of our archiving process. If you have any questions or any input on these plans, please reach out to us. Kind regards, Adonis Stergiopoulos Senior Marketing & Communications Officer RIPE NCC

1 0

Adding more than one 2FA authenticator to your account
by Povl Ole Haarlev Olsen 28 Mar '24

28 Mar '24

Hi. Now than 2FA is mandatory when logging in on the RIPE website, it would be nice if we could add more than one 2FA authenticator / TOTP generator to our account and use either when logging in. For example using either Authy on your phone or Yubico Authenticator on your computer. That way, if you lose your phone, you can still log in from your computer and revoke access from the Authy app, until you get a new phone and set up a new 2FA authenticator on it. On some other sites where you can use multiple 2FA authenticators, they even show which authenticator was used the last N times you logged in. It makes it very easy to spot, if someone has gained access to your 2FA authenticator secrets and is actively using that access. I hope, you'll consider the idea. Thanks in advance... -- Povl Ole

1 0

Secure login SSO idP
by David Ron 27 Mar '24

27 Mar '24

To whom it may concern at RIPE NCC, My name is David Ron, Administrator for Cellcom Israel, ASN1680, AS-NV. Following your notification from yesterday Mandatory 2FA on RIPE NCC Access Accounts<https://www.ripe.net/publications/news/mandatory-2fa-on-ripe-ncc-access-acc…> I am reaching out to propose enhancing information security and user experience. Specifically, we would like to suggest ripe support organizational users with the domain login to access your site via Single Sign-On (SSO) through our Identity Provider (IdP) We believe this integration will streamline the login process and bolster security measures. Best Regards, David Ron Network Engineer Cellcom This e-mail message may contain confidential, commercial and privileged information or data that constitute proprietary information of Cellcom Israel Ltd. Any review or distribution by others is strictly prohibited. If you are not the intended recipient you are hereby notified that any use of this information or data by any other person is absolutely prohibited. If you are not the intended recipient, please delete all copies. Thank You. https://cellcom.co.il

1 0

Re: [ncc-services-wg] RIPE NCC Security Update
by Eleonora Petridou 25 Mar '24

25 Mar '24

Dear Aleksi, Peter, and all, Thank you for your emails, currently our efforts are focused on the first phase of deploying mandatory two-factor authentication (2FA). This first phase will include functionality to migrate 2FA to a new device. The second phase is scheduled for the following quarters, and this is where we will look at expanding the authentication choices for 2FA. We will definitely consider your suggestions as we evaluate the possible options we can provide. Regards, Eleonora, Chief Information Security Officer RIPE NCC > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 20 Mar 2024 19:09:23 +0200 > From: Aleksi Suhonen <ripe-ml-2024(a)ssd.axu.tm> > To: ncc-services-wg(a)ripe.net > Subject: Re: [ncc-services-wg] RIPE NCC Security Update > Message-ID: <9a980621-f64d-4d42-bac4-6a4e3109cf0e(a)ssd.axu.tm> > Content-Type: text/plain; charset=UTF-8; format=flowed > > Hi colleagues, > > On 3/19/24 9:59 AM, Eleonora Petridou wrote: >> We have also strengthened password requirements and added a reminder >> to enable 2FA when users log in to their RIPE NCC Access accounts. >> This is an interim measure until mandatory 2FA is rolled out. Our >> roadmaps have been updated to expedite the rollout of mandatory >> two-factor authentication: > > The current policy does not allow for having the same OTP code on two > different mobile phones at the same time, so the only way to migrate to > a new phone is to turn off 2FA completely and then turn it back on again > to get a QR code for the new phone. > > When 2FA becomes mandatory, it cannot be turned off, am I right? > > What is the plan to enable the moving to a new phone or other > authenticator device? > > Best Regards, > > -- > Aleksi Suhonen / Axu TM Oy > Internetworking Consulting > > > > ------------------------------ > > Message: 2 > Date: Wed, 20 Mar 2024 14:03:39 -0400 > From: Peter Potvin <peter(a)accuris.ca> > To: Aleksi Suhonen <ripe-ml-2024(a)ssd.axu.tm> > Cc: ncc-services-wg(a)ripe.net > Subject: Re: [ncc-services-wg] RIPE NCC Security Update > Message-ID: > <CAC0MiJpKwc6Bh+L-kLf+QjwBvDN9W-yhifsweYkgV6R03bUUUQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > This is a very good point, and I can see where the issue would occur when > the OTP application used doesn't support migration to a new device (which > some don;t in my experience). Another thing I (among other network > operators) would like to see is the implementation of support for WebAuthn > and multiple hardware keys. It's not solely sufficient in my opinion to > have only a single method of 2FA possible, so the support of different > types of 2FA would be great to have implemented prior to 2FA becoming > mandatory. > > Kind regards, > Peter Potvin > > > On Wed, Mar 20, 2024 at 1:09?PM Aleksi Suhonen <ripe-ml-2024(a)ssd.axu.tm> > wrote: > >> Hi colleagues, >> >> On 3/19/24 9:59 AM, Eleonora Petridou wrote: >>> We have also strengthened password requirements and added a reminder >>> to enable 2FA when users log in to their RIPE NCC Access accounts. >>> This is an interim measure until mandatory 2FA is rolled out. Our >>> roadmaps have been updated to expedite the rollout of mandatory >>> two-factor authentication: >> >> The current policy does not allow for having the same OTP code on two >> different mobile phones at the same time, so the only way to migrate to >> a new phone is to turn off 2FA completely and then turn it back on again >> to get a QR code for the new phone. >> >> When 2FA becomes mandatory, it cannot be turned off, am I right? >> >> What is the plan to enable the moving to a new phone or other >> authenticator device? >> >> Best Regards, >> >> -- >> Aleksi Suhonen / Axu TM Oy >> Internetworking Consulting >> >> -- >> >> To unsubscribe from this mailing list, get a password reminder, or change >> your subscription options, please visit: >> https://lists.ripe.net/mailman/listinfo/ncc-services-wg >> > > ***********************************************

1 0

RIPE NCC Security Update
by Eleonora Petridou 20 Mar '24

20 Mar '24

Dear colleagues, We would like to share some updates regarding security measures available to RIPE NCC members. We have now introduced a feature that shows LIR administrators whether or not two-factor authentication (2FA) has been enabled by users on their LIR account. This feature allows LIR administrators greater insight into the security measures being implemented within their teams. Please note that only admins have access to this feature. We have also strengthened password requirements and added a reminder to enable 2FA when users log in to their RIPE NCC Access accounts. This is an interim measure until mandatory 2FA is rolled out. Our roadmaps have been updated to expedite the rollout of mandatory two-factor authentication: https://www.ripe.net/support/documentation/quarterly-planning/business-appl… The rollout is currently planned to take place towards the end of Q1 2024. Additionally, we have increased our efforts to actively identify leaked credentials available online and to reset those passwords. The password reset process for any credentials identified as leaked through our monitoring system has been automated. We urge all members to be mindful of their password security and to enable two-factor authentication. Please follow our security recommendations: - Review your LIR account(s), restrict access to necessary personnel only and remove former employee accounts. - Make use of our new feature and ensure that all users on your account enable two-factor authentication. - If you use a password management tool, we recommend that you enable data breach monitoring for your own credentials. Kind regards, Eleonora Petridou Chief Information Security Officer RIPE NCC

3 2

NCC Services WG at RIPE 88
by Rob Evans 19 Mar '24

19 Mar '24

Hello dear WG participants, We are just a day over nine weeks until the RIPE NCC Services working group will meet at RIPE 88 in Krakow, Poland. If you have any topics you wish to present, or discussions you think we should have, please let the chairs know via <ncc-services-wg-chairs(a)ripe.net>. See you in Poland! Cheers, Rob, Bijal, Janos

1 0

Email Delivery from the RIPE NCC
by Fergal Cunningham 14 Mar '24

14 Mar '24

Dear all, We're working to improve email delivery from the RIPE NCC, especially in light of new requirements from the big email providers. I just published an article about this on RIPE Labs: https://labs.ripe.net/author/fergalc/enhancing-email-delivery-at-the-ripe-n… Any thoughts or comments are of course welcome. Kind regards, Fergal Cunningham Head of Membership Engagement RIPE NCC

1 0

Re: [ncc-services-wg] The redesigned www.ripe.net is now live
by Petrit Hasani 22 Jan '24

22 Jan '24

Dear Randy, Thank you for your report. We have investigated the reported issue. The issue is not as a result of the recent work carried out on the new ripe.net <http://ripe.net/> website. Your AS number submission receives an error due to the “AS-“ prefix which is not allowed to be used in an as-name. The “AS-“ prefix is is a reserved prefix for AS SET in accordance with RFC 2622: Routing Policy Specification Language (RPSL): https://datatracker.ietf.org/doc/html/rfc2622#section-2 RFC 2622: Routing Policy Specification Language (RPSL) datatracker.ietf.org The error message received in the request form does not properly clarify it, creating confusion, so we will look to fix it as soon as possible. Please do not hesitate to contact us if you have any questions or concerns. Kind regards, Petrit Hasani RIPE NCC > On 22 Jan 2024, at 16:12, Petrit Hasani <phasani(a)ripe.net> wrote: > > Dear Randy, > > Thank you for reporting the bug. > > We will look into it and hope to resolve it as soon as possible. > > I will contact you once a fix has been deployed. > > Please do not hesitate to contact us if you have any other questions or concerns. > > Kind regards, > > Petrit Hasani > RIPE NCC > >> On 20 Jan 2024, at 21:28, Randy Bush <randy(a)psg.com <mailto:randy@psg.com>> wrote: >> >>> Date: Fri, 19 Jan 2024 13:16:42 +0100 >>> If you visit www.ripe.net today, you might notice some changes. >> >> deploy on friday afternoon and go home for the weekend. i think that is >> covered pretty early in the textbook. >> >> <ripe-asn.jpg> >> which i can fudge past by skipping the hyphens, but then i submit the AS >> allocation form and get >> >> <ripe-ouch.jpg> >> was a show stopper. and it reproduces. with safari and firefox. and >> when i go to re-do, it has not saved the data i entered. >> >> randy-- >> >> To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/ncc-services-wg

2 2