NDIS - Salesforce Security Vulnerability Assurance (Log4j2) post 13 Dec 21
Dear National Disability Insurance Agency,
Please provide a copy of all Salesforce communication to the NDIA related to the security vulnerability Apache Log4j2, post 13 Dec 21. Including any formal statement/declaration that all NDIA data is secure and protected within Salesforce, since 13 Dec 21. Preferably not more marketing holding statements.
Yours faithfully,
Lesley
Dear Lesley
Freedom of Information Request: Acknowledgement
Thank you for your request of 23 March 2022, made under the Freedom of
Information Act 1982 (FOI Act), for copies of documents held by the
National Disability Insurance Agency (NDIA).
Scope of your request
You have requested access to the following documents:
…a copy of all Salesforce communication to the NDIA related to the
security vulnerability Apache Log4j2, post 13 Dec 21. Including any formal
statement/declaration that all NDIA data is secure and protected within
Salesforce, since 13 Dec 21. Preferably not more marketing holding
statements.
Unless you advise otherwise, we will take it that you agree to the names
and contact details of NDIA staff being excluded from the scope of your
request (that is, the information will be treated as irrelevant).
Processing timeframes
A 30-day statutory period for processing your request commenced from 24
March 2022, in accordance with section 15(2A)(c) of the FOI Act. You
should, therefore, expect a decision from us by 24 April 2022.
This period may be extended if we need to consult with third parties or
for other reasons. We will advise you if this happens.
Charges
We may apply a processing charge to your request and will advise you as
soon as practicable if a charge is payable.
Disclosure Log
Information released under the FOI Act may be published on the NDIA’s
disclosure log located on our website, subject to certain exceptions.
If you have any concerns about the publication of information you have
requested, please contact us.
Further help
Please contact us at [1][NDIA request email] if you have any questions or need
help.
We will contact you using the email address you provided. Please advise if
you would prefer us to use an alternative means of contact.
Kind regards
Freedom of Information Officer
Parliamentary, Ministerial and FOI Branch
Government Division
National Disability Insurance Agency
E: [2][NDIA request email]
[3]Title: NDIS delivered by the National Disability Insurance Agency
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
References
Visible links
1. mailto:[NDIA request email]
2. mailto:[NDIA request email]
Dear Lesley
Thank you for your request for information.
Please find attached correspondence in relation to your request. If you
require the attachment in a different format, please let us know.
Please contact us at [1][NDIA request email] if you have any questions or
require help.
Kind regards
Freedom of Information Officer
Parliamentary, Ministerial and FOI Branch
Government Division
National Disability Insurance Agency
E: [2][NDIA request email]
[3]Title: NDIS delivered by the National Disability Insurance Agency
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
References
Visible links
1. mailto:[NDIA request email]
2. mailto:[NDIA request email]
Dear foi,
You have permission to disclose my name to the relevant person/organisation, as requested.
Yours sincerely,
Lesley
Thank you for your email to the National Disability Insurance Agency
(NDIA) Freedom of Information (FOI) team.
If your email relates to an FOI application made under the Commonwealth
Freedom of Information Act 1982 (FOI Act), the Agency will respond to you
as soon as practicable.
This email address is for applications under the FOI Act only. The Agency
is unable to respond to non-FOI related enquiries sent to this email
address. Any correspondence received that is not an information access
request will not be responded to or forwarded.
If you are seeking to access your personal documents, please consider
submitting your request through our [1]Participant Information Access
(PIA) web-form, which will allow the matter to be processed
administratively.
Should you have a query unrelated to FOI, please contact us by emailing at
[2][email address] or via webchat at [3]NDIA Web Chat (ndis.gov.au).
Alternatively you can also contact us by phoning 1800 800 110.
If you have any questions about making an FOI request, or to enquire about
a current FOI request, please email us with your phone number and a
preferred time for us to call you, and an FOI Decision Maker will call you
back.
Kind regards
Freedom of Information team
Parliamentary, Ministerial & FOI Branch
Government
National Disability Insurance Agency
Email: [4][NDIA request email]
References
Visible links
1. https://aus01.safelinks.protection.outlo...
2. mailto:[email address]
3. https://aus01.safelinks.protection.outlo...
4. mailto:[NDIA request email]
Dear Lesley
Thank you for your request for information.
Please find attached correspondence and documents in relation to your
request. If you require these in a different format, please let us know.
Please contact us at [1][NDIA request email] if you have any questions or
require help.
Thank you.
Kind regards
Freedom of Information Officer
Parliamentary, Ministerial and FOI Branch
Government Division
National Disability Insurance Agency
E: [2][NDIA request email]
[3]7BABD6DB
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
References
Visible links
1. mailto:[NDIA request email]
2. mailto:[NDIA request email]
Lesley left an annotation ()
Salesforce's "Service Cloud" also implies "Health Cloud", which shares the same underlying CRM platform
Lesley left an annotation ()
The NDIA seem to have investigated this considerable vulnerability and threat to public data, no further than assurances of "trust" from Salesforce's Customer Service representative
Lesley left an annotation ()
Mulesoft (a Salesforce company) was also affected, meaning API's between all connecting services to/from Salesforce, where Mulesoft is used, is also included in this ongoing vulnerability/risk. Seemingly ignored by the NDIA also, with no additional action or update since Dec 21
Lesley left an annotation ()
Despite the ongoing vulnerability and threat, the NDIA and Salesforce have not investigated nor resolved precisely how they are impacted (at risk) since 16 Dec 2021. It is now the end of May 2022.