From info at arin.net Mon May 11 14:46:44 2020 From: info at arin.net (ARIN) Date: Mon, 11 May 2020 14:46:44 -0400 Subject: [ARIN-consult] Reminder - ACSP Consultation: Advanced Security Features for ARIN Online Message-ID: <9c33c3b5-106c-ac47-2b91-cb45dacf2ddc@arin.net> The following consultation, originally announced on 16 April, will remain open through 5:00 PM ET on Friday, 15 May 2020. https://www.arin.net/participate/community/acsp/consultations/2020-1/ If you have ideas about improvements to the security features for ARIN Online, we want to hear from you! Regards, The American Registry for Internet Numbers (ARIN) *** Security for ARIN Online accounts as it exists today is described on our website, and includes optional Two-factor Authentication, API keys, and Pretty Good Privacy (PGP) Authentication. More information about these security features can be found at: https://www.arin.net/reference/materials/security/ Over the last several years, we have received multiple ARIN Consultation and Suggestion Process (ACSP) requests and fielded many customer suggestions about ways ARIN might improve security for our online customer accounts. These suggestions include: ???? 2017.1: Two-factor functionality improvement: https://www.arin.net/participate/community/acsp/suggestions/2017-1/ ???? 2018.22: Align ARIN password policy with current NIST SP800-63 recommendations: https://www.arin.net/participate/community/acsp/suggestions/2018-22/ ???? 2019.14: Implement FIDO2 (WebAuthn) for ARIN Online: https://www.arin.net/participate/community/acsp/suggestions/2019-14/ Based on this community input as well as suggestions received through other channels, we are opening a consultation to solicit feedback on a number of potential security improvements that are under consideration. We are specifically interested in your thoughts on a number of specific suggestions, listed below: 1.??? ARIN uses challenge questions to verify users who are seeking to restore access to their ARIN Online user account and to complete other actions. It has been suggested that we eliminate the use of challenge questions for customer account verification in favor of other security measures. 2.??? Utilizing a personal passcode and/or SMS push codes to a mobile device for password resets and other account actions 3.??? Changing password length and entry requirements to better align with NIST SP800-63 recommendations 4.??? Requiring the use of Two-factor Authentication (2FA) on all accounts, or allowing Admin Points of Contact (POCs) to control permissions on access to their Organization Records to only allow access from associated POCs who have 2FA on their user accounts The feedback you provide during this consultation will help inform how we move forward with improvements to the security of ARIN Online and customer account access. We also are interested in hearing about other ideas to improve the security of ARIN Online interactions that are not listed above. Thank you for your participation in the ARIN Consultation and Suggestion Process. Please provide comments to arin-consult at arin.net. You can subscribe to this mailing list at: http://lists.arin.net/mailman/listinfo/arin-consult From matt at netfire.net Mon May 11 15:05:04 2020 From: matt at netfire.net (Matt Harris) Date: Mon, 11 May 2020 14:05:04 -0500 Subject: [ARIN-consult] Security considerations: forcing 2fa for other users Message-ID: Hey folks, I've been using ARIN's website with 2fa for some time and it's worked flawlessly. Bravo on getting that going and helping me be more secure about managing some of my organization's most critical resources. The fourth point on the document however is something I've brought up previously with ARIN and is something I'd very much like to see implemented. Many of us are in situations where less technical members of our organizations must have access to our ARIN resources and simply telling them to enable 2fa may or may not be enough. Being able to require that any account which has access to manage our resources would be a great security benefit for many organizations, and of course it should be an opt-in feature for resource managers within a given organization. One other issue I'd like to bring up is ARIN IRR management. If a web UI could be developed and subsequently locked behind 2factor, that would imho be preferable to the current system which as far as I'm aware, cannot be locked behind 2fa. Take care, Matt Matt Harris|Infrastructure Lead Engineer 816-256-5446|Direct Looking for something? Helpdesk Portal|Email Support|Billing Portal We build and deliver end-to-end IT solutions. -------------- next part -------------- An HTML attachment was scrubbed... URL: From athompso at athompso.net Mon May 11 15:31:29 2020 From: athompso at athompso.net (Adam Thompson) Date: Mon, 11 May 2020 14:31:29 -0500 Subject: [ARIN-consult] Security considerations: forcing 2fa for other users In-Reply-To: References: Message-ID: <323bce085e561a4012d5e6d3e626d893@athompso.net> The logical extension of Matt's comments mirror something I've said before... if there are people who are unable to manage 2FA for whatever reason (disability, technical, legal, who knows!) then there exists a subset of those people will also be responsible for IRR data. I am one of those unicorns. 2FA (in its current state) is mostly a no-go for me, yet I maintain IRR data. Having 2FA as an option for all the people who CAN use it is great, but please don't force it on anyone. Ever. I believe an IRR webui is already under development and nearing release. -Adam On 2020-05-11 14:05, Matt Harris wrote: > Hey folks, > I've been using ARIN's website with 2fa for some time and it's worked flawlessly. Bravo on getting that going and helping me be more secure about managing some of my organization's most critical resources. > > The fourth point on the document however is something I've brought up previously with ARIN and is something I'd very much like to see implemented. Many of us are in situations where less technical members of our organizations must have access to our ARIN resources and simply telling them to enable 2fa may or may not be enough. Being able to require that any account which has access to manage our resources would be a great security benefit for many organizations, and of course it should be an opt-in feature for resource managers within a given organization. > > One other issue I'd like to bring up is ARIN IRR management. If a web UI could be developed and subsequently locked behind 2factor, that would imho be preferable to the current system which as far as I'm aware, cannot be locked behind 2fa. > > Take care, > Matt > > Matt Harris? > > | > > Infrastructure Lead Engineer > > 816?256?5446 > > | > > Direct > > Looking for something? > > Helpdesk Portal [1] > > | > > Email Support > > | > > Billing Portal [2] > > We build and deliver end?to?end IT solutions. > > _______________________________________________ > ARIN-Consult > You are receiving this message because you are subscribed to the ARIN Consult Mailing > List (ARIN-consult at arin.net). > Unsubscribe or manage your mailing list subscription at: > https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services > Help Desk at info at arin.net if you experience any issues. Links: ------ [1] https://help.netfire.net/ [2] https://my.netfire.net/ -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: blocked.gif Type: image/gif Size: 118 bytes Desc: not available URL: From rlaager at wiktel.com Mon May 11 15:38:20 2020 From: rlaager at wiktel.com (Richard Laager) Date: Mon, 11 May 2020 14:38:20 -0500 Subject: [ARIN-consult] Security considerations: forcing 2fa for other users In-Reply-To: <323bce085e561a4012d5e6d3e626d893@athompso.net> References: <323bce085e561a4012d5e6d3e626d893@athompso.net> Message-ID: On 5/11/20 2:31 PM, Adam Thompson wrote: > 2FA (in its current state) is mostly a no-go for me Why? -- Richard From bill at herrin.us Mon May 11 17:19:19 2020 From: bill at herrin.us (William Herrin) Date: Mon, 11 May 2020 14:19:19 -0700 Subject: [ARIN-consult] Security considerations: forcing 2fa for other users In-Reply-To: <323bce085e561a4012d5e6d3e626d893@athompso.net> References: <323bce085e561a4012d5e6d3e626d893@athompso.net> Message-ID: On Mon, May 11, 2020 at 12:31 PM Adam Thompson wrote: > Having 2FA as an option for all the people who CAN use it is great, but please don't force it on anyone. Ever. Hi Adam, I agree but... > 2FA (in its current state) is mostly a no-go for me, yet I maintain IRR data. I'm curious what beyond personal preference is stopping you? Regards, Bill Herrin -- William Herrin bill at herrin.us https://bill.herrin.us/ From info at arin.net Mon May 18 15:56:21 2020 From: info at arin.net (ARIN) Date: Mon, 18 May 2020 15:56:21 -0400 Subject: [ARIN-consult] Consultation on Advanced Security Features for ARIN Online Is Now Closed Message-ID: <38d7cfdb-dca2-6564-3b2c-c478f1932a37@arin.net> ARIN thanks those who provided valuable feedback during this consultation on potential security improvements for ARIN Online. This important feedback will help inform ARIN's path forward in this area. Regards, John Curran President and CEO American Registry for Internet Numbers (ARIN)