23 ms·

To get an idea of how well our government organisations get along with implementing this (and a lot of other basic security requirements, like TLS, IPv6, DNSSEC

To get an idea of how well our government organisations get along with implementing this (and a lot of other basic security requirements, like TLS, IPv6, DNSSEC, etc) you can view these maps[0][1]. We maintain a set of open source tools to easily get you started[2]. If you would like help to have this for your country/government/organisation as well, feel free to contact us. [0] https://basisbeveiliging.nl/#/metric-progress/NL/municipality/internet_nl_wsm_web_appsecpriv_securitytxt https://basisbeveiliging.nl/#/metric-progress/NL/municipalit... [1] https://basisbeveiliging.nl/#/maps https://basisbeveiliging.nl/#/maps [2] https://gitlab.com/internet-cleanup-foundation/web-security-map https://gitlab.com/internet-cleanup-foundation/web-security-...

sybercecurity 3y ago
Is there an enforcement arm? As in, what if some agency decides not to do it for some reason - do they get sanctioned in any way? In the US Federal government, there are two I'm familiar with: budget and dragging agency heads in front of congress or the Executive Office and yelling at them. The first doesn't always work - cutting the budget of an important agency over what the press would call a "minor IT issue" doesn't look good (and counter productive). The second tends to work better.
- bux93 3y ago
  Central government can force any covered entity to publish which standards they (do not) support, to produce an audit, and in the last instance, instruct them to comply. This is a specific provision on top of generic rules and regulations, where central government can step in the place of a lower government if they are non-compliant. Also, citizens (or NGOs) can sue entities (including central government) for non-compliance. For example, in 2022, the NGO Urgenda won a case against the Dutch government for not doing enough about climate change (less than needed to comply with international treaties), and now the political landscape is in turmoil because there's no consensus which polluters should stop polluting quite as much. In practice, the list of standards is just tacked onto procurement procedures. Since governments and contractors love to bicker, a missing security.txt can be something to hit the vendor over the head with (and withhold payment for a month, to make this year's budget).
Dah00n 3y ago
>If you would like help to have this for your country/government/organisation as well, feel free to contact us. I was looking into what exactly is need for this but the last link has this in the guide: >For full installation with everything and anything, check: https://gitlab.com/internet-cleanup-foundation/server/ https://gitlab.com/internet-cleanup-foundation/server/ The link is broken.
- aequitas 3y ago
  I'm gonna look into that and come back to you. edit: W're a small team and we can't allocate the time needed to make that repo decently public atm. For now it's best to drop an email at the adres found here [0] and I'll help you get along. [0] https://internetcleanup.foundation/about-us/ https://internetcleanup.foundation/about-us/
captn3m0 3y ago
Ooh, I've been wanting to do this for India for a long time. Got around to domain lists [1], [2], but never got around to publishing my scan reports. Will reach out. [1]: https://gist.github.com/captn3m0/4f3da8f07fe884e62bfab3ac85616936 https://gist.github.com/captn3m0/4f3da8f07fe884e62bfab3ac856... [2]: https://git.captnemo.in/nemo/pulse https://git.captnemo.in/nemo/pulse

sybercecurity 3y ago

Is there an enforcement arm? As in, what if some agency decides not to do it for some reason - do they get sanctioned in any way? In the US Federal government, there are two I'm familiar with: budget and dragging agency heads in front of congress or the Executive Office and yelling at them. The first doesn't always work - cutting the budget of an important agency over what the press would call a "minor IT issue" doesn't look good (and counter productive). The second tends to work better.

bux93 3y ago
Central government can force any covered entity to publish which standards they (do not) support, to produce an audit, and in the last instance, instruct them to comply. This is a specific provision on top of generic rules and regulations, where central government can step in the place of a lower government if they are non-compliant. Also, citizens (or NGOs) can sue entities (including central government) for non-compliance. For example, in 2022, the NGO Urgenda won a case against the Dutch government for not doing enough about climate change (less than needed to comply with international treaties), and now the political landscape is in turmoil because there's no consensus which polluters should stop polluting quite as much. In practice, the list of standards is just tacked onto procurement procedures. Since governments and contractors love to bicker, a missing security.txt can be something to hit the vendor over the head with (and withhold payment for a month, to make this year's budget).

Dah00n 3y ago

>If you would like help to have this for your country/government/organisation as well, feel free to contact us. I was looking into what exactly is need for this but the last link has this in the guide: >For full installation with everything and anything, check: https://gitlab.com/internet-cleanup-foundation/server/ https://gitlab.com/internet-cleanup-foundation/server/ The link is broken.

aequitas 3y ago
I'm gonna look into that and come back to you. edit: W're a small team and we can't allocate the time needed to make that repo decently public atm. For now it's best to drop an email at the adres found here [0] and I'll help you get along. [0] https://internetcleanup.foundation/about-us/ https://internetcleanup.foundation/about-us/

captn3m0 3y ago

Ooh, I've been wanting to do this for India for a long time. Got around to domain lists [1], [2], but never got around to publishing my scan reports. Will reach out. [1]: https://gist.github.com/captn3m0/4f3da8f07fe884e62bfab3ac85616936 https://gist.github.com/captn3m0/4f3da8f07fe884e62bfab3ac856... [2]: https://git.captnemo.in/nemo/pulse https://git.captnemo.in/nemo/pulse