The
Internet Corporation for Names and Numbers (ICANN) has resolved a potential
data exposure with JAGGAER (formerly SciQuest), the software as a service
(SaaS) tool used for sourcing suppliers via competitive bidding processes such as
Requests for Proposal (RFPs), reports ITRealms.
Affirming
to ITRealms, ICANN said that two suppliers made ICANN aware of the issue on 4
December 2017 and ever since, ICANN has logged a severity 1 problem with
JAGGAER immediately, and the vendor resolved the problem within 48 hours.
The
issue, ICANN said, occurred in a module called Sourcing Director, which is used
for administering RFPs and each RFP has a Question and Answer (Q&A) Board
where RFP participants can post questions for the ICANN RFP team.
“Only
the ICANN RFP team sees the questions while they are unanswered. ICANN posts
the answer publicly, but the identity of the asker is not revealed on the
website,” official disclosed to ITRealms.
The
exposure, ITRealms gathered, occurred if RFP participants downloaded the page
as a file extract.
“The
extract listed the names of the entities that asked questions. We recognize
that the problem undermined the expected confidentiality of those asking
questions and potentially gave RFP bidders the names of their some of their
competitors. As soon as ICANN learned of the problem, we reposted all questions
and answers as if they came from ICANN, so the names of those asking questions
no longer appeared in the file extract,” ICANN said.
This
problem, ITRealms also reported, was not limited to ICANN as JAGGAER has verified
that it was introduced on 10 November 2017 with the JAGGAER 17.3 upgrade that
contained an enhancement to the Q&A file format.
“Because
most people view the Q&A Board without file extraction, ICANN believes the
data exposure was minimal. Bidders in three RFPs may have been affected, and
they have already been informed of the issue.
Further,
ICANN said that making this information public is part of its commitment to
openness and transparency.
Chuks Egbune/GEE
No comments:
Post a Comment