Re: Chairman of Senate Intelligence Committee calls salt typhoon "worst telecom hack in our nation's history"

[Mel Beckman <mel () beckman org>]

This is probably a good idea. Such audits and attestations are already required for medical, commerce, and government 
data systems, to guard against data breaches. For example, I just completed a PCI audit of a department store chain, 
which handles lots of sensitive financial information belonging to its customers and employees. These audits routinely 
identify vulnerabliities before they get exploited.

It's amazing that telcos and ISPs have managed to escape formal governance this long!

  -mel
________________________________
From: NANOG <nanog-bounces+mel=beckman.org () nanog org> on behalf of John Curran <jcurran () arin net>
Sent: Tuesday, December 10, 2024 2:29 PM
To: nanog <nanog () nanog org>
Subject: Re: Chairman of Senate Intelligence Committee calls salt typhoon "worst telecom hack in our nation's history"

NANOGers -

As followup on the Salt Typhoon matter, it’s worth noting that in response to the hack there are now proposals at the 
FCC and at the US Senate that would require attestation, certification, and/or audits of telecommunications providers 
cybersecurity practices –

FCC - 
https://www.reuters.com/technology/cybersecurity/fcc-chair-proposes-cybersecurity-rules-response-chinas-salt-typhoon-telecom-hack-2024-12-05/

US Senate - 
https://www.bleepingcomputer.com/news/security/wyden-proposes-bill-to-secure-us-telecoms-after-salt-typhoon-hacks/

FYI,
/John

John Curran
President and CEO
American Registry for Internet Numbers

On Nov 25, 2024, at 4:58 PM, Eric Kuhnke <eric.kuhnke () gmail com> wrote:

Re: compromise of lawful intercept / CALEA related features:

https://archive.is/jZt59

Original URL: https://www.washingtonpost.com/national-security/2024/11/21/salt-typhoon-china-hack-telecom/

The hackers, part of a group dubbed Salt Typhoon, have been able to listen in on audio calls in real time and have in 
some cases moved from one telecom network to another, exploiting relationships of “trust,” said Sen. Mark R. Warner 
(D-Virginia), chairman of the Senate Intelligence Committee and a former telecom venture capitalist. Warner added that 
intruders are still in the networks.