Hi Alessandro,
please find my comment below prefixed with [ML]
Il 05/08/2026 00:10, Alessandro Bertoldi BCS ha scritto:
Dear all,
Thank you for the discussion of
draft-bertoldi-regext-rdap-reliability-scoring-01 at IETF 126 in
Vienna. Several of the sharpest questions were raised in the meeting
chat and we did not get to them in the room, so we address them here,
identify the central unresolved question, and set out what we intend
to change.
This is an individual, Experimental draft. We are not requesting adoption.
1. What we heard
At the microphone: that the extension makes most sense when the
assessment is published by a party other than the registry or
registrar; that other RDAP extensions convey facts held in a
registration database while this one conveys a value judgment; that
the reliability of the score itself is unaddressed and that an
assessed party needs a way to contest a result; that evidence of real
interest would be needed before the working group considered taking on
the work; and that at this stage it may be a solution in search of a
problem.
Mario Loffredo raised the concern we most want help with: that a
security score risks being read as a rating, with reputational and
commercial damage and legal disputes for the assessed party; that such
a score can change quickly, so that a value today may be higher or
lower tomorrow; and that publishing information about domains with a
weak security posture may identify soft targets. He cited NIS2-related
national guidance against disseminating information that could be
useful to attackers. We think this is the hardest security and policy
concern the draft raises, and Section 4 below sets out how we intend
to reflect it in -02. We would also like to cite that guidance
accurately, and would appreciate a pointer to the specific authority
and document.
[ML] The NIS2 Directive does not explicitly prohibit the public
disclosure of a security or reliability score assigned to a domain name
or registrar. However, this does not necessarily mean that such
disclosure is consistent with the risk-based approach established by the
Directive.
In particular, Article 21(1) requires essential and important entities
to take “appropriate and proportionate technical, operational and
organisational measures to manage the risks posed to the security of
network and information systems”. Article 21(2) further specifies a
number of areas that such measures should address, including risk
analysis and information system security, vulnerability handling and
disclosure, and others..
The public disclosure through RDAP of a security score associated with a
registrar or domain may itself constitute a security risk. A score that
identifies an entity as having a relatively weak security posture can
provide potentially valuable reconnaissance information to malicious
actors. In particular, it can be used to identify and prioritise targets
for further investigation or attack. The risk may be further increased
where the score is provided along with information concerning the
scoring methodology, assessment date, evidence, or the specific security
dimensions that contributed to the score.
Therefore, while NIS2 does not establish an explicit prohibition on
publishing security scores, the systematic and unauthenticated public
disclosure of such scores may be difficult to reconcile with the
risk-based security obligations of Article 21when the disclosure
substantially increases the exposure of the assessed entity.
Best,
Mario
[snip]
Best regards,
Alessandro Bertoldi (Bertoldi Cybersecurity)
Simon Pietro Romano (University of Naples Federico II)
draft:
https://datatracker.ietf.org/doc/draft-bertoldi-regext-rdap-reliability-scoring/
*"Empowering your business with cutting-edge cybersecurity solutions,
safeguarding your digital assets and ensuring a seamless, secure
experience for your customers."*
*
*
*BertoldiCybersecurity*
*
*
*Alessandro Bertoldi
*
Owner
*T. +39 0185 799079
*
*M. +39 348 5130136*
*
*
*E-Mail [email protected]*
*
*
www.bertoldicybersecurity.com
https://bcsec.io
_______________________________________________
regext mailing list [email protected]
To unsubscribe send an email [email protected]
--
Dott. Mario Loffredo
Senior Technologist
Technological Unit “Digital Innovation”
Institute of Informatics and Telematics (IIT)
National Research Council (CNR)
Address: Via G. Moruzzi 1, I-56124 PISA, Italy
Phone: +39.0503153497
Web:http://www.iit.cnr.it/mario.loffredo
_______________________________________________
regext mailing list -- [email protected]
To unsubscribe send an email to [email protected]
