" ITREALMS: ICANN resolves potential data exposure in RFP system

pages

Monday, January 15, 2018

ICANN resolves potential data exposure in RFP system

The Internet Corporation for Names and Numbers (ICANN) has resolved a potential data exposure with JAGGAER (formerly SciQuest), the software as a service (SaaS) tool used for sourcing suppliers via competitive bidding processes such as Requests for Proposal (RFPs), reports ITRealms.

Affirming to ITRealms, ICANN said that two suppliers made ICANN aware of the issue on 4 December 2017 and ever since, ICANN has logged a severity 1 problem with JAGGAER immediately, and the vendor resolved the problem within 48 hours.

The issue, ICANN said, occurred in a module called Sourcing Director, which is used for administering RFPs and each RFP has a Question and Answer (Q&A) Board where RFP participants can post questions for the ICANN RFP team.

“Only the ICANN RFP team sees the questions while they are unanswered. ICANN posts the answer publicly, but the identity of the asker is not revealed on the website,” official disclosed to ITRealms.

The exposure, ITRealms gathered, occurred if RFP participants downloaded the page as a file extract.

“The extract listed the names of the entities that asked questions. We recognize that the problem undermined the expected confidentiality of those asking questions and potentially gave RFP bidders the names of their some of their competitors. As soon as ICANN learned of the problem, we reposted all questions and answers as if they came from ICANN, so the names of those asking questions no longer appeared in the file extract,” ICANN said.

This problem, ITRealms also reported, was not limited to ICANN as JAGGAER has verified that it was introduced on 10 November 2017 with the JAGGAER 17.3 upgrade that contained an enhancement to the Q&A file format.

“Because most people view the Q&A Board without file extraction, ICANN believes the data exposure was minimal. Bidders in three RFPs may have been affected, and they have already been informed of the issue.


Further, ICANN said that making this information public is part of its commitment to openness and transparency.

Chuks Egbune/GEE

ITREALMS ... everything news digitally! Short URLs: goo.gl, mcaf.ee, cli.gs

No comments:

Post a Comment