Mario, thank you for this. My comments below, prefixed with [AB]. Il 07/08/2026 14:13, Mario Loffredo ha scritto: > [ML] The NIS2 Directive does not explicitly prohibit the public > disclosure of a security or reliability score assigned to a domain > name or registrar. However, this does not necessarily mean that > such disclosure is consistent with the risk-based approach > established by the Directive. [snip] > Therefore, while NIS2 does not establish an explicit prohibition on > publishing security scores, the systematic and unauthenticated > public disclosure of such scores may be difficult to reconcile with > the risk-based security obligations of Article 21 when the > disclosure substantially increases the exposure of the assessed > entity. [AB] We should also make the case for this extension more clearly than -01 does, since it is the very reason the extension exists. A published assessment is not only exposure of the assessed party, it can also be a concrete incentive to remediate. Our research grew precisely out of observing operational weaknesses that can remain unresolved for years after responsible disclosure. A certification and an operational assessment of security posture address, in our view, different needs. A certification attests conformity against a defined scope at a point in time. An operational assessment can instead represent finer-grained technical and procedural properties that change over time, such as how credential recovery is handled or certain email authentication configurations. Our intent is not to replace certifications, but to complement them with a mechanism able to provide a more frequent and more current representation of security posture than a periodic certification can. We do accept the core of your point: the remediation incentive and the exposure of the assessed party operate on different timescales. We think this should be made more explicit in the next revision of the draft. In particular, a scoring scheme intended to publish its results should define a disclosure and remediation policy, providing a mechanism by which the assessed party is informed of the result and is given a window in which to remediate or to contest the assessment before it is published. We do not think, however, that the RDAP extension should prescribe the length of that window or define the associated governance process. Those aspects belong to the scoring scheme and its operational model, consistently with the separation between representation of the result and methodology that we have tried to maintain in the draft. In this way, a party that remediates promptly can be reassessed before publication, avoiding as far as possible the exposure of a result that no longer reflects its current posture. The same window also allows the assessed party to contest the result before it becomes public.
Best regards, Alessandro Da: Mario Loffredo <[email protected]> Inviato: venerdì 7 agosto 2026 14:13 A: Alessandro Bertoldi BCS <[email protected]>; 'regext' <[email protected]> Oggetto: [regext] Re: draft-bertoldi-regext-rdap-reliability-scoring-01: follow-up from IETF 126 Hi Alessandro, please find my comment below prefixed with [ML] Il 05/08/2026 00:10, Alessandro Bertoldi BCS ha scritto: Dear all, Thank you for the discussion of draft-bertoldi-regext-rdap-reliability-scoring-01 at IETF 126 in Vienna. Several of the sharpest questions were raised in the meeting chat and we did not get to them in the room, so we address them here, identify the central unresolved question, and set out what we intend to change. This is an individual, Experimental draft. We are not requesting adoption. 1. What we heard At the microphone: that the extension makes most sense when the assessment is published by a party other than the registry or registrar; that other RDAP extensions convey facts held in a registration database while this one conveys a value judgment; that the reliability of the score itself is unaddressed and that an assessed party needs a way to contest a result; that evidence of real interest would be needed before the working group considered taking on the work; and that at this stage it may be a solution in search of a problem. Mario Loffredo raised the concern we most want help with: that a security score risks being read as a rating, with reputational and commercial damage and legal disputes for the assessed party; that such a score can change quickly, so that a value today may be higher or lower tomorrow; and that publishing information about domains with a weak security posture may identify soft targets. He cited NIS2-related national guidance against disseminating information that could be useful to attackers. We think this is the hardest security and policy concern the draft raises, and Section 4 below sets out how we intend to reflect it in -02. We would also like to cite that guidance accurately, and would appreciate a pointer to the specific authority and document. [ML] The NIS2 Directive does not explicitly prohibit the public disclosure of a security or reliability score assigned to a domain name or registrar. However, this does not necessarily mean that such disclosure is consistent with the risk-based approach established by the Directive. In particular, Article 21(1) requires essential and important entities to take “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems”. Article 21(2) further specifies a number of areas that such measures should address, including risk analysis and information system security, vulnerability handling and disclosure, and others.. The public disclosure through RDAP of a security score associated with a registrar or domain may itself constitute a security risk. A score that identifies an entity as having a relatively weak security posture can provide potentially valuable reconnaissance information to malicious actors. In particular, it can be used to identify and prioritise targets for further investigation or attack. The risk may be further increased where the score is provided along with information concerning the scoring methodology, assessment date, evidence, or the specific security dimensions that contributed to the score. Therefore, while NIS2 does not establish an explicit prohibition on publishing security scores, the systematic and unauthenticated public disclosure of such scores may be difficult to reconcile with the risk-based security obligations of Article 21 when the disclosure substantially increases the exposure of the assessed entity. Best, Mario [snip] Best regards, Alessandro Bertoldi (Bertoldi Cybersecurity) Simon Pietro Romano (University of Naples Federico II) draft: https://datatracker.ietf.org/doc/draft-bertoldi-regext-rdap-reliability-scoring/ "Empowering your business with cutting-edge cybersecurity solutions, safeguarding your digital assets and ensuring a seamless, secure experience for your customers." BertoldiCybersecurity Alessandro Bertoldi Owner T. +39 0185 799079 M. +39 348 5130136 E-Mail mailto:[email protected] http://www.bertoldicybersecurity.com https://bcsec.io _______________________________________________ regext mailing list -- mailto:[email protected] To unsubscribe send an email to mailto:[email protected] -- Dott. Mario Loffredo Senior Technologist Technological Unit “Digital Innovation” Institute of Informatics and Telematics (IIT) National Research Council (CNR) Address: Via G. Moruzzi 1, I-56124 PISA, Italy Phone: +39.0503153497 Web: http://www.iit.cnr.it/mario.loffredo "Empowering your business with cutting-edge cybersecurity solutions, safeguarding your digital assets and ensuring a seamless, secure experience for your customers." BertoldiCybersecurity Alessandro Bertoldi Owner T. +39 0185 799079 M. +39 348 5130136 E-Mail [email protected] www.bertoldicybersecurity.comhttps://bcsec.io
_______________________________________________ regext mailing list -- [email protected] To unsubscribe send an email to [email protected]
