[ncc-announce] [News] Security Breach: Investigation Update

Dear members,

We recently informed you about our investigation into the breach of a member’s RIPE NCC Access account. A more detailed post-mortem analysis, including root causes and mitigations, will be published once the incident has been closed. In the meantime, we would like to inform you about our actions so far and next steps:

- We have worked with the affected member to restore services to them.
- If we believe that an account is at risk, based on notification from our threat intelligence provider or other sources, we force a password reset and inform the account holders. We are currently looking into automating this process. On average, we reset around 10 passwords per week. 
- We are performing targeted research to identify leaked RIPE NCC Access accounts in public data breaches. As a precautionary measure, we have forced a password reset on 800 accounts identified as vulnerable and notified the account holders. 
- The plans for our engineering teams are being reviewed in light of this incident. We are evaluating suggestions for improvement received alongside our existing plans. Our roadmaps will be updated accordingly.
- We have decided to make two-factor authentication mandatory for RIPE NCC Access accounts and will prioritise the implementation. More details will be shared on the RIPE NCC Services WG mailing list once the timeline is finalised. 

-------------------------------
Two-Factor Authentication
-------------------------------
If you have not already done so, enable two-factor authentication on your RIPE NCC Access account. Using two-factor authentication across all of your accounts can reduce your exposure to attacks like these. 

The guide for setting up two-factor authentication on your Access account can be found at:
https://www.ripe.net/participate/member-support/ripe-ncc-access/two-step-verification

—--------------------------
Secure Your Account
—--------------------------
Please follow our recommendations to help secure your RIPE NCC Access account:
- Avoid reusing passwords for login credentials.
- Use a password manager to automatically create random passwords and store them.
- If you use a password management tool, we recommend that you enable data breach monitoring for your own credential or use https://haveibeenpwned.com/ or similar services.
- Please review the accounts associated with your LIR, restrict access to necessary personnel only and remove former employee accounts.

If you choose to create your own password: 
- Passwords are secret. Keep them so.
- Use long passwords of at least 14 characters.
- Do not reuse passwords. 
- Use a password manager to remember your password.
- If a random password is impractical, use a passphrase instead.

If you believe that your account might be vulnerable, please report this to security at ripe.net. Details about our technical emergency hotline are available at:
https://www.ripe.net/support/contact/technical-emergency-hotline.

Kind regards,
Hans Petter Holen
Managing Director and CEO,
RIPE NCC