July 2017 - ICANNSecurity-SSR2-RT

Re: [Icannsecurity-ssr2-rt] [Ext] Re: [Ssr2-coordination] Doodle Poll Results - Action required - Please advise
by Osterweil, Eric July 26, 2017

July 26, 2017

Ahh, sorry. Eric From: MSSI Secretariat <mssi-secretariat(a)icann.org> Date: Tuesday, July 25, 2017 at 5:17 PM To: Eric Osterweil <eosterweil(a)verisign.com>, "ICANNsecurity-SSR2-RT(a)icann.org" <ICANNsecurity-SSR2-RT(a)icann.org> Cc: "ssr2-coordination(a)icann.org" <ssr2-coordination(a)icann.org> Subject: [EXTERNAL] RE: [Ext] Re: [Ssr2-coordination] Doodle Poll Results - Action required - Please advise Hi Eric – You have actually been removed from the SSR1 Review Subtopic mailing list – the doodle poll email was cc’d to the co-chairs, thus why it came to you. Thank you. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN – Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D305F2.9DF770A0] From: Osterweil, Eric [mailto:eosterweil@verisign.com] Sent: Tuesday, July 25, 2017 1:32 PM To: MSSI Secretariat <mssi-secretariat(a)icann.org>; ICANNsecurity-SSR2-RT(a)icann.org Cc: ssr2-coordination(a)icann.org Subject: [Ext] Re: [Ssr2-coordination] Doodle Poll Results - Action required - Please advise Hi All, I think I need to step back from this subgroup. Can someone please remove me from the list? Thank you, Eric From: <ssr2-coordination-bounces(a)icann.org<mailto:ssr2-coordination-bounces@icann.org>> on behalf of MSSI Secretariat <mssi-secretariat(a)icann.org<mailto:mssi-secretariat@icann.org>> Date: Tuesday, July 25, 2017 at 4:06 PM To: "ICANNsecurity-SSR2-RT(a)icann.org<mailto:ICANNsecurity-SSR2-RT@icann.org>" <ICANNsecurity-SSR2-RT(a)icann.org<mailto:ICANNsecurity-SSR2-RT@icann.org>> Cc: "ssr2-coordination(a)icann.org<mailto:ssr2-coordination@icann.org>" <ssr2-coordination(a)icann.org<mailto:ssr2-coordination@icann.org>> Subject: [EXTERNAL] [Ssr2-coordination] Doodle Poll Results - Action required - Please advise Hi All - Good day. The doodle poll for SSR2 subtopic of ICANN Security has closed and the results are below with Monday @1700 UTC being the most popular choice. Did you want to schedule recurring calls for this timeslot of Monday @ 1700 UTC? Please advise and thank you! [cid:image002.png@01D305F2.9DF770A0] Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN – Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org[icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_&d=DwMGaQ…> [cid:image003.png@01D305F2.9DF770A0]

1 0

Doodle Poll Results - Action required - Please advise
by MSSI Secretariat July 25, 2017

July 25, 2017

Hi All - Good day. The doodle poll for SSR2 subtopic of ICANN Security has closed and the results are below with Monday @1700 UTC being the most popular choice. Did you want to schedule recurring calls for this timeslot of Monday @ 1700 UTC? Please advise and thank you! [cid:image003.jpg@01D30546.E41705C0] Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D30545.D4C8AD40]

3 4

Re: [Icannsecurity-ssr2-rt] [Ssr2-review] Draft agenda: SSR2 Plenary #20
by Boban Krsic July 25, 2017

July 25, 2017

Hi all, Please note that I will be on two-day conference from Monday to Tuesday next week. My apologies for the next SSR2 online meeting. Just two small requests: In hopes of obtaining a higher participation level, the MSSI Secretariat has sent out a new doodle poll for ICANN Security - SSR2 Subtopic. Please review the new poll link and make your selection from the new choices, if you have not made it so far. I have also sent out an email on 09.07.17, 21:56 for some feedback on the new structure of Subtopic 2 - ICANN SSR [1]. Any feedback on this would be great. Looking forward to hearing from you soon. Regards, - Boban. [1] https://docs.google.com/document/d/1DWoT4VoMlT5Dvcy78EXI-O5tQFqa9CblwsDEV6g… Am 21.07.17 um 18:27 schrieb Jennifer Bryce: > Hi all, > > Below is the draft agenda for the SSR2 plenary call on Tuesday, July 25 at 14:00 UTC. Slides will follow on Monday. > > - Updated SOIs & note apologies/absences > - SSR1 implementation briefing: Risk Management (James Caulfield, ICANN Enterprise Risk Management, Xavier Calvez, ICANN Senior Vice President & Chief Financial Officer) > - Review & discussion on subtopic work plan template > - Updates from subtopic teams (SSR1 Implementation, ICANN SSR, DNS Security, Future Challenges, IANA Transition) > - Abu Dhabi face-to-face meeting: Discuss options for Review Team outreach to community. > - Confirm January face-to-face meeting dates > - AOB > > Have a great weekend, > > Jennifer > -- > Jennifer Bryce > Senior Reviews Coordinator > Internet Corporation for Assigned Names and Numbers (ICANN) > > Email: jennifer.bryce(a)icann.org > Skype: jennifer.bryce.icann > www.icann.org > > > > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review > -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main

2 1

Action Required - ICANN Security SSR2 Subtopic - new poll deadline extended
by MSSI Secretariat July 19, 2017

July 19, 2017

Hi All - In hopes of obtaining a higher participation level, we have sent out a new doodle poll for ICANN Security - SSR2 Subtopic. Please review the new poll link below and make your selection from the new choices. If you participated previously, you will find your name already listed with question marks in the selection boxes - simply click on which dates work for you and hit save. Doodle link - http://doodle.com/poll/ac263qetyhn97bf4 The poll will close on Tuesday, 25 July @ 13:30 UTC - thank you! Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D30078.2908E280]

1 0

Re: [Icannsecurity-ssr2-rt] ICANN Security - Doodle Poll - Please respond
by MSSI Secretariat July 18, 2017

July 18, 2017

Hi All - If you have done so already, please participate in the doodle poll below, I need to close this poll today and calculate results asap - thank you! Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FFC7.01F45410] From: icannsecurity-ssr2-rt-bounces(a)icann.org [mailto:icannsecurity-ssr2-rt-bounces@icann.org] On Behalf Of Yvette Guigneaux Sent: Monday, July 17, 2017 10:58 AM To: ICANNsecurity-SSR2-RT(a)icann.org Subject: [Icannsecurity-ssr2-rt] ICANN Security - Doodle Poll - Please respond Hi All - Good day - below is the doodle poll for ICANN Security Subtopic - day choices are for Wednesdays or Thursdays - please make your choice on the doodle poll below. The doodle poll will close Tuesday 18 July 2017 by 17:00 UTC. (10am PST). http://doodle.com/poll/ac263qetyhn97bf4[doodle.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__doodle.com_poll_ac263qe…> Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org[icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_&d=DwMFAg…> [cid:image001.png@01D2FFC7.01F45410]

1 0

ICANN Security - Doodle Poll - Please respond
by Yvette Guigneaux July 17, 2017

July 17, 2017

Hi All - Good day - below is the doodle poll for ICANN Security Subtopic - day choices are for Wednesdays or Thursdays - please make your choice on the doodle poll below. The doodle poll will close Tuesday 18 July 2017 by 17:00 UTC. (10am PST). http://doodle.com/poll/ac263qetyhn97bf4 Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FEEB.953369F0]

1 0

Re: [Icannsecurity-ssr2-rt] Next week
by Jennifer Bryce July 15, 2017

July 15, 2017

Hi ICANN SSR team, Per the note below, we’ll be happy to help set up a Doodle poll for a subteam meeting based on the staff availability schedule I provided in an earlier email. Note that Co-Chairs have asked that, for consistency, staff set up the Doodle polls. Please let us know if you’d like us to circulate a poll to the team. Thanks! From: <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Friday, July 14, 2017 at 5:41 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Next week Hi All. The co-chairs have canceled next week’s scheduled full Team call to focus on sub-topic group work. Staff will assist with scheduling sub-topic group calls to help advance our focused work agendas. As always, we ask members to also use our email lists to progress work. We’ll re-group the following week on our regularly scheduled call to address our workplan and sub-topic efforts, and receive a presentation. Best, Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

2 1

Re: [Icannsecurity-ssr2-rt] [Ssr2-review] Work plan (draft) Sub Team 2 – ICANN Security
by Boban Krsic July 9, 2017

July 9, 2017

Dear sub-team, As mentioned on the last F2F workshop in Joburg, I would like to ask you for some feedback on the new structure of sub topic 2 - ICANN SSR [1]. Please review the re-organized work items (all 37 items merged in 8 groups) and send any feedback direct to the new sub-group mailing list (cc'd). Following Geoff’s approach – please bear in mind the following questions: (Thanks Geoff ;-)) * Is this a useful structure to use to organize this activity? * What is missing from this list? * Is there anything here that is perhaps out of scope? * Is this an achievable agenda? Best regards, Boban. [1] https://docs.google.com/document/d/1DWoT4VoMlT5Dvcy78EXI-O5tQFqa9CblwsDEV6g… Am 08.06.17 um 16:33 schrieb Boban Krsic: > Hi Alain, > > Am 07.06.17 um 18:43 schrieb ALAIN AINA: >> Hello, >> >> As discussed yesterday on the call, this is what i think sub-group(ICANN Security) should do: >> >> - Analyze the risks management framework in place at ICANN in general and for the SSR remit >> - Analyze the security management framework >> * Security efforts and effectiveness >> * Auditing : reports and recommendations implementation. > > this represents IMHO only a limited view and do not follow a holistic > approach on information security and especially on business continuity > management. Both standards ISO/IEC 27001 ISMS and ISO 22301 BCMS are > widely accepted and represented by a risk and process-based approach how > to deal with information security and business continuity issues in > general. In addition to that we get a list of security controls that are > to be used to improve security at the organization. I believe, that with > the use of both standards, we should be able to address all relevant > work items that we identified in Madrid - and that in a efficient way. > > Best, > Boban. > >> - Gab analysis >> - Recommendations >> >> Their works will be fed by the work of the sub-group 1(SSR1 implementation) which shall evaluate the effectiveness of implementation of >> recommendations 9, 26 and 27 below. >> >> >> Hope this helps >> >> —Alain >> >> >> >> ==================== >> 9 ICANN should assess certification options with commonly accepted international standards (e.g., ITIL, ISO and SAS-70) for >> its operational responsibilities. ICANN should publish a clear roadmap towards certification. >> >> 26 ICANN should prioritize the timely completion of a Risk Management Framework. >> >> 27 ICANN’s Risk Management Framework should be comprehensive within the scope of its SSR remit and limited missions. >> ======================== >> >> >>> On 5 Jun 2017, at 05:24, Boban Krsic <krsic(a)denic.de> wrote: >>> >>> Dear All, >>> >>> Please find attached a first draft of a work plan for subteam 2 - ICANN >>> Security. I propose, that the basis for further development should be a >>> gap analysis (without any obligations to certify something) based on the >>> following two industrial standards: ISO/IEC 27001:2013 Information >>> Security Management Systems (ISMS) and ISO 22301:2012 Business >>> Continuity Management Systems (BCMS). With the use of both standards, we >>> should be able to address all relevant work items that we identified in >>> Madrid. For the beginning, I have created a simple MS Excel that >>> consists all relevant information for project planning and realization >>> of the gap analysis. The file contains a total of four sheets: >>> >>> * Sheet1 (Workplan) contains the main key action steps, a description of >>> the action, expected outcome, evaluation methodology, required skill >>> set, responsible person, proposed timeline, and finally a reference to >>> Madrid’s work item list. The list is not finished and needs to be >>> completed. >>> >>> * Sheet2 (Checklist 27001) contains 32 questions to address all relevant >>> requirements of the main part of a ISMS based on ISO/IEC 27001. With the >>> checklist, we are able to evaluate the following category groups: >>> >>> * Scope, relevant parties (stakeholder) >>> * Leadership, roles and responsibilities >>> * Risk management and risk treatment >>> * Resources, competence, awareness and communication >>> * Performance evaluation, internal audit and management review >>> * Improvement of the ISMS >>> >>> * Sheet3 (Checklist 27001 – Annex A) contains a list of 114 questions >>> based on the Annex A of ISO/IEC 27001. It is a list of security controls >>> (or safeguards) that are to be used to improve security of information. >>> The controls are structured, and the purpose of each of the 14 sections >>> from Annex A [1]: >>> >>> * Information security policies - controls how to write and >>> review policies >>> * Organization of information security – controls on how the >>> responsibilities are assigned >>> * Human resources security – controls affecting the employment >>> * Asset management – controls related to inventory of assets and >>> acceptable use, also for information classification and media handling >>> * Access control – controls for Access control policy, user access >>> management, system and application access control, and user responsibilities >>> * Cryptography – controls related to encryption and key management >>> * Physical and environmental security – controls defining secure >>> areas, entry controls, protection against threats, equipment security, >>> secure disposal, clear desk and clear screen policy, etc. >>> * Operational security – lots of controls related to management of IT >>> production: change management, capacity management, malware, backup, >>> logging, monitoring, installation, vulnerabilities >>> * Communications security – controls related to network security, >>> segregation, network services, transfer of information, messaging, etc. >>> * System acquisition, development and maintenance – controls >>> defining security requirements and security in development and support >>> processes >>> * Supplier relationships – controls on what to include in >>> agreements, and how to monitor the suppliers >>> * Information security incident management – controls for >>> reporting events and weaknesses, defining responsibilities, response >>> procedures, and collection of evidence >>> * Information security aspects of business continuity management – >>> controls requiring the planning of business continuity, procedures, >>> verification and reviewing, and IT redundancy >>> * Compliance – controls requiring the identification of applicable laws >>> and regulations, intellectual property protection, personal data >>> protection, and reviews of information security >>> >>> * Sheet4 (Checklist 22301) similar to sheet1 but with a focus on >>> Business Continuity Management. The checklist contains a list of 90 >>> questions to address all relevant requirements of a BCMS based on ISO >>> 22301. With the checklist, we are able to evaluate the following >>> category groups: >>> >>> * Scope, supply chain, l&r requirements and assurance >>> * Leadership, roles and responsibilities >>> * Risks and opportunities >>> * Business continuity objectives and plans to achieve them >>> * Human resources, competence and training and awareness >>> * Communication and documentation >>> * Operational planning and control >>> * Business Impact Analysis (BIA) and Risk Assessment >>> * Business continuity strategy / Resource recovery strategy >>> * Incident response structure >>> * Business continuity plans >>> * Monitoring, measurement, analysis and evaluation >>> * Internal audit and management review >>> * Improvement of the BCMS >>> >>> I am using a similar list for my annually internal audits at DENIC. >>> Altogether I would expect a total effort of approx. 15-20 m/d to perform >>> key action steps 1.0 and 2.0. External consultants are also possible and >>> in my view a good option. >>> >>> Jennifer, it would be great if you could import the file to google docs >>> and share the link for editing purposes. >>> >>> Any feedback on this would be great. >>> >>> Regards, >>> >>> - Boban. >>> >>> >>> >>> [1]https://advisera.com/27001academy/knowledgebase/overview-of-iso-270012013… >>> >>> >>> >>> >>> -- >>> >>> Boban Kršić >>> Chief Information Security Officer >>> >>> DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY >>> >>> E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 >>> Mobil: +49 172 67 61 671 >>> https://www.denic.de >>> >>> X.509 Key-ID: 00A54FCB79884413A4 >>> Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 >>> >>> PGP Key-ID: 0x43C89BA9 >>> Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 >>> >>> Angaben nach § 25a Absatz 1 GenG: >>> DENIC eG (Sitz: Frankfurt am Main) >>> Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg >>> Schweiger >>> Vorsitzender des Aufsichtsrats: Thomas Keller >>> Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht >>> Frankfurt am Main >>> >>> >>> >>> <170531.Workplan_ICANN_Security_draft_0.91.xlsx>_______________________________________________ >>> Ssr2-review mailing list >>> Ssr2-review(a)icann.org >>> https://mm.icann.org/mailman/listinfo/ssr2-review >> >> >> >> _______________________________________________ >> Ssr2-review mailing list >> Ssr2-review(a)icann.org >> https://mm.icann.org/mailman/listinfo/ssr2-review >> > > > > > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review > -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main

1 0