Re: ISC will likely be shutting down FTP access to ftp.isc.org soon (https will remain)

On Sat, 28 Sep 2024 10:12:23 +0000, Julien ÉLIE wrote:

Hi Wolfgang,
>

However, as ISC also offers support contracts for BIND and Kea, and
those customers have their own due diligence policies, we are often
subject to scrutiny and audits about how our network runs, and even for
a venerable URL like ftp.isc.org, we get questions from auditors like
"did you know you have a public FTP server on your network!  Why!?"

>
I've been working for several large companies that are legally required
to carry out annual audits of their IT infrastucture, both internal and
outsourced, and had to deal with external auditors from PWC, KPMG and
E&Y, to name just a few, and I know that it's absolutely impossible to
argue with external auditors and your customers' management if you care
about your mental health. They will drag you down to their level and
beat you with experience, so ISC is not to blame, IMHO.

>
You are doing well to remind that.  I also regularly see external audits
on some critical systems used for the public transport in Paris where I
work, and we are just asked to follow the recommendations, not to
counter-argument them.
>
For the most vital systems, a certification is needed by the ANSSI in
France.  I think it is a bit like the NSA in the USA or the BSI in
Germany.

<snip>

>
So I totally understand Dan's position.

100% agree. I may be retired, but I spent many years dealing with such
agencies and issues. As Ray stated, "it's absolutely impossible to
argue with external auditors and your customers' management if you care
about your mental health."
ISC does a lot for Usenet, I think we can understand that it's not the
only thing they do :)
--
Retro Guy