[afnog] Africacert opinion on cybersecurity threat Intelligence

[sm+afrinic at elandsys.com]

Hi Logan,
At 12:32 PM 27-09-2026, Loganaden Velvindron wrote:
>In a tightly regulated environment or "corporate" environment, 
>putting a linux or bsd box to parse a database file from an RIR is 
>very difficult.
>
>Auditors will come and ask: is the linux box certified, do we have a 
>support contract, has the script you wrote been tested and vetted 
>internally. Compliance can make some things "difficult."

The person could explain to the auditor why it would cost 
approximately EUR 5,000 for the first year to do the above if it's a 
corporate environment.  The cost would be different if the company is 
regulated.

>If the rir provides this as a csv or json file,
>There are less issues and the addition of the csv feed becomes a CAB 
>item which has a strong business justification. The rir is 
>considered the authoritative source which is trusted.

I assume that you are referring to FIPS, etc. as you mentioned "CAB 
item".  It's better to use an authoritative source for the bill of 
materials in that case.

Regards,
S. Moonesamy