Security-critical instructions to data centre support should have integrity

[Sander Maijers]

Data integrity is critical for such instructions, which are now mostly sent over e-mail. I would say that there is a practical DoS attack against CLARIN today using social engineering to forge some e-mails, which could take much of the CLARIN infra down within day. (And worse attacks cannot be excluded.)

In case official support web control panels with multifactor auth are not available (as with most academic data centers), we should agree on clear rules of conduct with the affected support staff. One solution would be to cryptographically sign all such e-mails, but that's impractical to do in some webmail interfaces.