<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted0">1. Would you support ARIN offering email as an additional 2FA method?<br>
</span></div>
<div class="elementToProof" style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted0 ContentPasted1 ContentPasted2">No. Email is an account you enable with 2FA, not the method of accomplishing
2FA.<br>
<a href="https://www.cisa.gov/mfa">https://www.cisa.gov/mfa</a><br>
<a href="https://www.hsph.harvard.edu/information-technology/2022/10/03/october-is-cybersecurity-month-week-1/">https://www.hsph.harvard.edu/information-technology/2022/10/03/october-is-cybersecurity-month-week-1/</a><br>
<br>
</span></div>
<div class="elementToProof" style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted0 ContentPasted4">
<div class="FluidPluginCopy ContentPasted0 ContentPasted3">2. Given that 13% of web user accounts list phone numbers outside the ARIN service region, should we widen the availability of SMS, or are the other offered 2FA options sufficient to meet the needs
of these users?<br>
</div>
<div class="FluidPluginCopy ContentPasted0 ContentPasted3">No, do not widen the availability of SMS. SMS is on a downward trend in the industry.</div>
<div class="FluidPluginCopy ContentPasted0 ContentPasted3"><a href="https://www.cisa.gov/blog/2022/10/18/next-level-mfa-fido-authentication">https://www.cisa.gov/blog/2022/10/18/next-level-mfa-fido-authentication</a></div>
<div class="FluidPluginCopy"><br class="ContentPasted0">
</div>
3. We agree that users should be allowed to register multiple hardware security keys. The question is: What is the optimal number of keys that should be allowed to be registered?<br>
</span></div>
<div class="elementToProof" style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted0 ContentPasted4">Anything more than one. Two is sufficient, but do not set that as the max value. The expectation
is the identity provider (IdP) product will define the max value. <a href="https://www.yubico.com/spare/">https://www.yubico.com/spare/</a></span></div>
<div class="elementToProof">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 0px 0in; font-size: 12pt; font-family: "Times New Roman", serif;">
<p style="margin:0in;font-size:12pt;mso-layout-grid-align:none;text-autospace:none">
<span style="font-family:Times"><o:p></o:p></span></p>
</div>
<p style="margin:0in;font-size:12pt;font-family:"Times New Roman", serif;mso-layout-grid-align:none;text-autospace:none">
</p>
<p style="text-align: start; background-color: rgb(255, 255, 255); margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="margin:0px;font-family:Times, serif"></span></p>
<div style="margin: 0px 0in; font-size: 12pt; font-family: "Times New Roman", serif;">
<p style="margin:0in;font-size:12pt;mso-layout-grid-align:none;text-autospace:none">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt;">Thank you,</span></p>
<p style="margin:0in;font-size:12pt;mso-layout-grid-align:none;text-autospace:none">
<br>
</p>
</div>
<p style="margin:0in; font-size:12pt; font-family:"Times New Roman",serif; text-autospace:none">
<b><span style="font-family: Arial, sans-serif; color: rgb(0, 96, 160);">Joey White</span></b></p>
<p style="margin:0in; font-size:12pt; font-family:"Times New Roman",serif; text-autospace:none">
<b><span style="font-size: 10pt; font-family: Arial, sans-serif; color: black;">Security Architect</span></b></p>
<p style="margin:0in; font-size:12pt; font-family:"Times New Roman",serif; text-autospace:none">
<b><span style="font-size: 10pt; font-family: Arial, sans-serif; color: black;"><br>
</span></b></p>
<p style="margin:0in; font-size:12pt; font-family:"Times New Roman",serif; text-autospace:none">
<span style="font-size: 10pt; font-family: Arial, sans-serif; color: gray;">Blue Cross and Blue Shield of Kansas</span></p>
<p style="margin:0in; font-size:12pt; font-family:"Times New Roman",serif; text-autospace:none">
<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(82, 145, 239);">p:</span><span style="font-size: 10pt; font-family: Arial, sans-serif; color: gray;"> 785-291-6471 |
</span><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(82, 145, 239);">w:</span><span style="font-size: 10pt; font-family: Arial, sans-serif; color: gray;"> bcbsks.com</span></p>
</div>
</div>
</div>
</div>
<DIV>
_______________________________________________<BR>
CONFIDENTIALITY NOTICE: This email message and any attachments are for the sole use of the intended recipient(s) and may contain proprietary, confidential, trade secret or privileged information. Any unauthorized review use, disclosure or distribution is prohibited and may be a violation of law. If you are not the intended recipient or a person responsible for delivering this message to an intended recipient, please contact the sender by reply email and destroy all copies of the original message.<BR>
</DIV></body>
</html>