Subject: [Tools-discuss] Plans for security audits and security auditors

From: Jay Daley <[email-masked]>
Date: Thu, 23 Sep 2021 11:16:48 +1200

As noted at the last tools call, Robert and I have been discussing a security review of Datatracker with a contract, which we have since signed a contract for.  As explained at the meeting, this did not go to RFP and I wanted to explain further our plans in this area.

Going forward, we are planning for an ongoing program of regular security audits of our IT systems.  We anticipate that each year we will have a couple of larger audits, such as a full code audit of a major tool, and multiple smaller audits, such as testing new Datatracker functionality

In 2020 we issued an RFP for a code review of the RPC code, awarded to ZX Security, and our original plan was to issue new security RFPs as and when required.  However, we have reconsidered this in light of the complexity of our systems and the time spent developing a working relationship, and we intend instead to appoint ZX Security as our standing security auditor for a three year term from the time they started with us until the end of 2022.  During this period all security reviews will be offered first to our standing security auditor and only go to RFP if they are unable to meet our need.  Towards the end of 2022 we will issue an RFP for a new security auditor for a three year term, which the incumbent will not be eligible to bid for and which will work in the same way.  

This form of fixed term appointment and forced rotation is consistent with good practice for financial auditors.

Please let me and Robert know if you have any concerns with this approach.

Jay

-- 
Jay Daley
IETF Executive Director
[email-masked]

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 23 Sep 2021 13:41:38 +0000

>    This form of fixed term appointment and forced rotation is consistent with good practice for financial auditors.

In my experience it is also common for security audits as well.

>    Please let me and Robert know if you have any concerns with this approach.

None.

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 23 Sep 2021 09:48:10 -0400

On Thu, Sep 23, 2021 at 9:41 AM Salz, Rich <rsalz=
[email-masked]> wrote:

> >    This form of fixed term appointment and forced rotation is consistent
> with good practice for financial auditors.
>
Strong proponent of this practice also.

tim