- ICANNSecurity-SSR2-RT - lists.icann.org

Re: [Icannsecurity-ssr2-rt] [Ext] Fwd: Questions for EBERO provider
by Jennifer Bryce Oct. 24, 2017

Oct. 24, 2017

Hi Boban, (copying ICANN SSR list) Thanks for preparing the list of questions. I will share these with GDD and follow up with meeting arrangements once I have heard back. Best, Jennifer From: Boban Krsic <krsic(a)denic.de> Date: Tuesday, October 24, 2017 at 7:43 AM To: Jennifer Bryce <jennifer.bryce(a)icann.org> Cc: "eosterweil(a)verisign.com" <eosterweil(a)verisign.com>, "James-1.gannon(a)novartis.com" <James-1.gannon(a)novartis.com> Subject: [Ext] Fwd: [Icannsecurity-ssr2-rt] Questions for EBERO provider Hi Jennifer, Please find some questions below. They should serve as a guide and point out the direction of the questions. Thanks - Boban. Begin forwarded message: From: "Boban Krsic" <krsic(a)denic.de<mailto:krsic@denic.de>> Date: 23. October 2017 at 00:59:31 GMT+4 To: "Osterweil, Eric" <eosterweil(a)verisign.com<mailto:eosterweil@verisign.com>>, "James Gannon" <james(a)cyberinvasion.net<mailto:james@cyberinvasion.net>> Cc: "Jennifer Bryce" <jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org>> Subject: Re: [Icannsecurity-ssr2-rt] Questions for EBERO provider Hey guys, Here is the first draft of some questions for EBERO's; please just add yours. We should try to consolidate them until Monday (eob) to provide them to Jennifer. --snip-- * Are there procedures for seamless transitions to an EBERO? Are the procedures regularly tested? * Who is participating in the tests and what are the given scenarios? * How often have tests been carried out (since the accreditation as an EBERO) with all parties involved in the transition process (ICANN, DEA, Registry Operator). * How the EBERO ensure that the existing infrastructure scales even with large amounts of data in a case of a transition? * Are there defined safety and operating standards that an EBERO has to meet? * Are there defined KPIs that are regularly made available to contractors? --snap-- Thanks. - Boban. Am 19.10.17 um 16:09 schrieb Osterweil, Eric: Hey guys, If it’s helpful, I’d be happy to help on this. Eric From: <icannsecurity-ssr2-rt-bounces(a)icann.org<mailto:icannsecurity-ssr2-rt-bounces@icann.org>> on behalf of Boban Krsic <krsic(a)denic.de<mailto:krsic@denic.de>> Date: Wednesday, October 18, 2017 at 6:22 PM To: Jennifer Bryce <jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org>> Cc: "ICANNsecurity-SSR2-RT(a)icann.org<mailto:ICANNsecurity-SSR2-RT@icann.org>" <ICANNsecurity-SSR2-RT(a)icann.org<mailto:ICANNsecurity-SSR2-RT@icann.org>> Subject: [EXTERNAL] Re: [Icannsecurity-ssr2-rt] Questions for EBERO provider Dear Jennifer, On 17. Oct 2017, at 18:56, Jennifer Bryce <jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org><mailto:jennifer.bryce@icann.org>> wrote: Per our discussion on Trello<https://trello.com/c/8WisLk0t/10-6-icanns-processes-around-vetting-registry…<https://urldefense.proofpoint.com/v2/url?u=https-3A__trello.com_c_8WisLk0t_…>>, would you be able to provide a list of questions you would like to ask? My GDD Ops colleagues have let me know that the provider will be in Abu Dhabi but would like to see the list of questions ahead of a meeting. Once we have the list, we can work to finalize a time slot suitable for everyone. James and I will prepare some questions until Monday (eob). - Boban. -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de<mailto:krsic@denic.de>, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de[denic.de]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.denic.de&d=DwMFaQ&…> X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main <smime.p7s>

1 0

Questions for EBERO provider
by Jennifer Bryce Oct. 18, 2017

Oct. 18, 2017

Hi ICANN SSR subteam, I hope you’re all well! Regarding the action item 147 for ICANN org to “identify an EBERO operator that the ICANN SSR subgroup can interview to speak to the experience of acting in a provider capacity.“ Per our discussion on Trello<https://trello.com/c/8WisLk0t/10-6-icanns-processes-around-vetting-registry…>, would you be able to provide a list of questions you would like to ask? My GDD Ops colleagues have let me know that the provider will be in Abu Dhabi but would like to see the list of questions ahead of a meeting. Once we have the list, we can work to finalize a time slot suitable for everyone. Thanks - let me know if you have questions. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

summary 1st draft
by Denise Michel Oct. 12, 2017

Oct. 12, 2017

Hi. Here’s the draft text I have before take-off ;) Let me know if this is what you had in mind – if you want more or less – if you want to highlight in more detail some of the issues we’re recommending purusuing. No pride of authorship – feel free to change or give direction. Best, Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> The ICANN SSR Subgroup had a very productive two-day, fact-finding meeting at ICANN headquarters. The subgroup met with a number of ICANN staff subject matter experts and discussed a range of issues relating to the completeness and effectiveness of ICANN’s security processes and the effectiveness of the ICANN security framework (including activities connected to the SSR2 ToR and implementation of SSR1 recommendations). The subgroup will update its contribution to the SSR2 workplan and post more fulsome documentation of how the subgroup’s work has advanced and issues that we’re preparing to bring to the full SSR2 Team for consideration. Meanwhile, here’s a high-level summary of the fact-finding meeting. The subgroup reviewed, submitted questions & information requests about, and discussed early observations about: * ICANN’s Security Framework and emerging threats. * ICANN’s Risk Management Framework. * ICANN’s Business Continuity strategies, objectives, plans and procedures. * ICANN’s operational planning and controls, and prioritized activity recovery strategy. * ICANN’s Incident Response Structure * ICANN’s root server operations * ICANN’s Domain Division activities that relate to SSR objectives, including new gTLD program safeguards, new gTLD Registry Agreement (Registry Operator) * Back-End Registry Operator (BERO) * Emergency Back-End Registry Operator (EBERO) * Registry Data Escrow (RyDE) - Data Escrow Agent (DEA) * Abuse reports, including SADAG and DAAR (Statistical Analysis of DNS Abuse & Domain Abuse Activity Reporting) * EBERO data, processes, smoke-testing, providers * Registry Data Escrow (RyDE) - Data Escrow Agent (DEA) * Centralied Zone Data Service (CZDS) data, compliance, failures, plans * SLA Monitoring System (SLAM) * Vetting of registrar and registry operators as relates to SSR, and measurement & impact of malicious conduct by contracted parties, data escrow breaches, etc. * SSR objectives in ICANN’S standard operating procedures (SOP). * Root server system SSR

3 2

Re: [Icannsecurity-ssr2-rt] [EXT] Re: summary 1st draft
by Barrett, Kerry-Ann Oct. 11, 2017

Oct. 11, 2017

Thanks for the update team. Where possible and if it was observed during the consultation, was there any cross referencing observed for these three areas for the future threats sub team: * ICANN’s Security Framework and emerging threats. * ICANN’s Risk Management Framework. * ICANN’s Business Continuity strategies, objectives, plans and procedures. If so could a note for referral on these be captured? I’m thinking that where we already have documents disclosed for one subteam we should try to minimize duplication of requests if the same material may be relevant for another sub team. Any thoughts welcomed. Sincerely, Kerry-Ann On Oct 10, 2017, at 10:10 PM, norm <norm(a)webcatcher.ca<mailto:norm@webcatcher.ca>> wrote: * CANN’s Security Framework and emerging threats. * ICANN’s Risk Management Framework. * ICANN’s Business Continuity strategies, objectives, plans and procedures.

1 0

Re: [Icannsecurity-ssr2-rt] summary 1st draft
by norm Oct. 11, 2017

Oct. 11, 2017

Looks ggod. We should note that topics were covered to varying degrees of detail as warranted. Some topics were covered sufficiently albeit superficially and some may require follow on discussions. -------- Original message --------From: "Osterweil, Eric via ICANNSecurity-SSR2-RT" <icannsecurity-ssr2-rt(a)icann.org> Date: 2017-10-10 8:45 PM (GMT-08:00) To: James Gannon <james(a)cyberinvasion.net>, Denise Michel <denisemichel(a)fb.com> Cc: ICANNsecurity-SSR2-RT(a)icann.org Subject: Re: [Icannsecurity-ssr2-rt] summary 1st draft wfm2 From: <icannsecurity-ssr2-rt-bounces(a)icann.org> on behalf of James Gannon <james(a)cyberinvasion.net> Date: Tuesday, October 10, 2017 at 7:18 PM To: Denise Michel <denisemichel(a)fb.com> Cc: "ICANNsecurity-SSR2-RT(a)icann.org" <ICANNsecurity-SSR2-RT(a)icann.org> Subject: [EXTERNAL] Re: [Icannsecurity-ssr2-rt] summary 1st draft Works for me (also about to take off, I made it with 8mins to spare!) Sent from my iPhone On 10 Oct 2017, at 19:08, Denise Michel <denisemichel(a)fb.com> wrote: Hi. Here’s the draft text I have before take-off ;) Let me know if this is what you had in mind – if you want more or less – if you want to highlight in more detail some of the issues we’re recommending purusuing. No pride of authorship – feel free to change or give direction. Best, Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com The ICANN SSR Subgroup had a very productive two-day, fact-finding meeting at ICANN headquarters. The subgroup met with a number of ICANN staff subject matter experts and discussed a range of issues relating to the completeness and effectiveness of ICANN’s security processes and the effectiveness of the ICANN security framework (including activities connected to the SSR2 ToR and implementation of SSR1 recommendations). The subgroup will update its contribution to the SSR2 workplan and post more fulsome documentation of how the subgroup’s work has advanced and issues that we’re preparing to bring to the full SSR2 Team for consideration. Meanwhile, here’s a high-level summary of the fact-finding meeting. The subgroup reviewed, submitted questions & information requests about, and discussed early observations about: ICANN’s Security Framework and emerging threats.ICANN’s Risk Management Framework. ICANN’s Business Continuity strategies, objectives, plans and procedures.ICANN’s operational planning and controls, and prioritized activity recovery strategy.ICANN’s Incident Response StructureICANN’s root server operationsICANN’s Domain Division activities that relate to SSR objectives, including new gTLD program safeguards, new gTLD Registry Agreement (Registry Operator)Back-End Registry Operator (BERO)Emergency Back-End Registry Operator (EBERO)Registry Data Escrow (RyDE) - Data Escrow Agent (DEA)Abuse reports, including SADAG and DAAR (Statistical Analysis of DNS Abuse & Domain Abuse Activity Reporting)EBERO data, processes, smoke-testing, providersRegistry Data Escrow (RyDE) - Data Escrow Agent (DEA)Centralied Zone Data Service (CZDS) data, compliance, failures, plansSLA Monitoring System (SLAM)Vetting of registrar and registry operators as relates to SSR, and measurement & impact of malicious conduct by contracted parties, data escrow breaches, etc.SSR objectives in ICANN’S standard operating procedures (SOP).Root server system SSR _______________________________________________ ICANNSecurity-SSR2-RT mailing list ICANNSecurity-SSR2-RT(a)icann.org https://mm.icann.org/mailman/listinfo/icannsecurity-ssr2-rt

1 0

Re: [Icannsecurity-ssr2-rt] summary 1st draft
by Osterweil, Eric Oct. 11, 2017

Oct. 11, 2017

wfm2 From: <icannsecurity-ssr2-rt-bounces(a)icann.org> on behalf of James Gannon <james(a)cyberinvasion.net> Date: Tuesday, October 10, 2017 at 7:18 PM To: Denise Michel <denisemichel(a)fb.com> Cc: "ICANNsecurity-SSR2-RT(a)icann.org" <ICANNsecurity-SSR2-RT(a)icann.org> Subject: [EXTERNAL] Re: [Icannsecurity-ssr2-rt] summary 1st draft Works for me (also about to take off, I made it with 8mins to spare!) Sent from my iPhone On 10 Oct 2017, at 19:08, Denise Michel <denisemichel(a)fb.com<mailto:denisemichel@fb.com>> wrote: Hi. Here’s the draft text I have before take-off ;) Let me know if this is what you had in mind – if you want more or less – if you want to highlight in more detail some of the issues we’re recommending purusuing. No pride of authorship – feel free to change or give direction. Best, Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> The ICANN SSR Subgroup had a very productive two-day, fact-finding meeting at ICANN headquarters. The subgroup met with a number of ICANN staff subject matter experts and discussed a range of issues relating to the completeness and effectiveness of ICANN’s security processes and the effectiveness of the ICANN security framework (including activities connected to the SSR2 ToR and implementation of SSR1 recommendations). The subgroup will update its contribution to the SSR2 workplan and post more fulsome documentation of how the subgroup’s work has advanced and issues that we’re preparing to bring to the full SSR2 Team for consideration. Meanwhile, here’s a high-level summary of the fact-finding meeting. The subgroup reviewed, submitted questions & information requests about, and discussed early observations about: * ICANN’s Security Framework and emerging threats. * ICANN’s Risk Management Framework. * ICANN’s Business Continuity strategies, objectives, plans and procedures. * ICANN’s operational planning and controls, and prioritized activity recovery strategy. * ICANN’s Incident Response Structure * ICANN’s root server operations * ICANN’s Domain Division activities that relate to SSR objectives, including new gTLD program safeguards, new gTLD Registry Agreement (Registry Operator) * Back-End Registry Operator (BERO) * Emergency Back-End Registry Operator (EBERO) * Registry Data Escrow (RyDE) - Data Escrow Agent (DEA) * Abuse reports, including SADAG and DAAR (Statistical Analysis of DNS Abuse & Domain Abuse Activity Reporting) * EBERO data, processes, smoke-testing, providers * Registry Data Escrow (RyDE) - Data Escrow Agent (DEA) * Centralied Zone Data Service (CZDS) data, compliance, failures, plans * SLA Monitoring System (SLAM) * Vetting of registrar and registry operators as relates to SSR, and measurement & impact of malicious conduct by contracted parties, data escrow breaches, etc. * SSR objectives in ICANN’S standard operating procedures (SOP). * Root server system SSR _______________________________________________ ICANNSecurity-SSR2-RT mailing list ICANNSecurity-SSR2-RT(a)icann.org<mailto:ICANNSecurity-SSR2-RT@icann.org> https://mm.icann.org/mailman/listinfo/icannsecurity-ssr2-rt

1 0

Updated Questions -- Re: ICANN contractual compliance questions
by Denise Michel Oct. 10, 2017

Oct. 10, 2017

Please replace previous request with the following questions. Thanks Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> WHOIS * For the new gTLDs and registrars that have the highest inaccuracy rates – what processes do you follow, what actions do you take to address? (See SADAG, DARA) * For example ,does Compliance treat registrars with higher accuracy rates to greater scrutiny & compliance activity? If not, why? * What trends is Compliance seeing in the Periodic Reporting-- are accuracy rates going up or down? * If the rates are going down-- how does Compliance change its activities to determine the root cause? * What contract changes would Compliance like to see to enhance its ability to respond to complaints of inaccurate WHOIS * Does ICANN Compliance treat WHOIS complaints differently if the complaint is coupled with allegations of DNS abuse. Why not? * Could ICANN Compliance have a different process for responding to WHOIS complaints when coupled with DNS abuse and cybercrime allegations? * How does ICANN Compliance interpret 3.18: Registrar shall take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse. * What are "reasonable steps" and have there been any instances where Compliance has found that the Registrar did not take reasonable steps * Did Compliance seek community input into how to interpret 3.18? * What changes would Complaince suggest to enhance its ability to take action under 3.18 * Is Compliance auditing the requirement under the RAA to: Validate that all postal address fields are consistent across fields (for example: street exists in city, city exists in state/province, city matches postal code) where such information is technically and commercially feasible for the applicable country or territory. * Is ICANN Compliance auditing the escrow deposits to confirm that the submission matches the total registrations of that registrar, and spot checking for accuracy or that it matches what appears in WHOIS * Has ICANN Compliance considered having an "emergency response" submission for eggregious instances of DNS Abuse? * Is ICANN experiencing "rate limiting" in accessing WHOIS for either compliance purposes or for the WHOIS ARS? * Does ICANN need unrestricted access to WHOIS to be able to do its compliance activities, WHOIS lookups, and WHOIS ARS * Does ICANN audit the SLAs for WHOIS availability? How often? * Which entities can submit bulk WHOIS compliance complaints? Please explain the requirements/restrictions involved in being able to submit bulk complaints. CZDS * Please provide data on CZDS performance and information on compliance actions regarding CZDS, including Rgy failures to provide daily data, rate limiting, denial of access by Registries, compliance actions/results from actions, pending improvements EBERO * Please provide information on compliance action relating to EBERO * Please provide information on data escrow providers” contractual obligations/requirements and actions taken by ICANN Org. to monitor and ensure compliance with these obligations Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

ICANN contractual compliance questions
by Denise Michel Oct. 10, 2017

Oct. 10, 2017

WHOIS * Which registrars have the highest inaccuracy rates? = There are new gTLDs and registrars where there are greater than 50% abusive registrations, including one registrar where 90% of the domains are reported as abusive. * Does Compliance treat registrars with higher accuracy rates to greater scrutiny & compliance activity? If not, why? * What trends is Compliance seeing in the Periodic Reporting-- is accuracy rates going up or down? * If the rates are going down-- how does Compliance change its activities to determine the root cause? * What contract changes would Compliance like to see to enhance its ability to respond to complaints of inaccurate WHOIS * Does ICANN Compliance treat WHOIS complaints differently if the complaint is coupled with allegations of DNS abuse. Why not? * Could ICANN Compliance have a different process for responding to WHOIS complaints when coupled with DNS abuse and cybercrime allegations? * How does ICANN Compliance interpret 3.18: Registrar shall take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse. * What are "reasonable steps" and have there been any instances where Compliance has found that the Registrar did not take reasonable steps * Did Compliance seek community input into how to interpret 3.18? * What changes would Complaince suggest to enhance its ability to take action under 3.18 * Is Compliance auditing the requirement under the RAA to: Validate that all postal address fields are consistent across fields (for example: street exists in city, city exists in state/province, city matches postal code) where such information is technically and commercially feasible for the applicable country or territory. * Is ICANN Compliance auditing the escrow deposits to confirm that the submission matches the total registrations of that registrar, and spot checking for accuracy or that it matches what appears in WHOIS * Has ICANN Compliance considered having an "emergency response" submission for eggregious instances of DNS Abuse? * Is ICANN experiencing "rate limiting" in accessing WHOIS for either compliance purposes or for the WHOIS ARS? * Does ICANN need unrestricted access to WHOIS to be able to do its compliance activities, WHOIS lookups, and WHOIS ARS * Does ICANN audit the SLAs for WHOIS availability? How often? * Which entities can submit bulk WHOIS compliance complaints? Please explain the requirements/restrictions involved in being able to submit bulk complaints. CZDS * Please provide data on CZDS performance and information on compliance actions regarding CZDS, including Rgy failures to provide daily data, rate limiting, denial of access by Registries, compliance actions/results from actions, pending improvements EBERO * Please provide information on compliance action relating to EBERO Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

google doc link (blank)
by Yvette Guigneaux Oct. 10, 2017

Oct. 10, 2017

Hi All - blank google doc link - https://docs.google.com/document/d/1QsvBp4GNW_TILEos29YQxTb4ZH7qcQFAh_4e0Xg… Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D341AF.E2F9F2B0]

1 0

additional focus
by Denise Michel Oct. 9, 2017

Oct. 9, 2017

Dear All, As discussed, in addition to refining our focus within information security management system arena, I suggest we also consider fleshing out our fact finding relating to these areas: · ICANN compliance, · Scope of ICANN’s SSR responsibilities, · Business continuity management For your consideration/discussion, some initial questions are included below that exemplify this inquiry. Best, Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> ICANN Compliance * DNS Abuse  * What level of ICANN compliance workload is related to complaints of DNS abuse by contracted parties?  * To what extent does ICANN measure the incidence and impact of registration abuse and/or malicious conduct by contracted parties?  * Please provideinformation on enforcement actions relating to DNS abuse (including, in relation to breaches of data escrow obligations and (for the RA) unauthorized disclosure, alteration, insertion or destruction of registry data, lack of compliance with RFCs, and (for the RAA) endangerment of Registrar Services, Registry Services or the DNS or the Internet. * What are ICANN standard processes around vetting registry and registrar operators? * Standard contracts  * Is ICANN planning to review and/or revise its standard contracts (RA, RAA) (e.g. in light of the coming into force of data protection regulations?).If so, please provide evidence of ICANN’s roadmap and implementation and SSR/OCTO’s assessment/role regarding SSR implications. * What measurements exist for the effectiveness of mechanisms to mitigate domain name abuse, as required in SSR1 recommendation 11? * Please provide details of the measures of success relating to new gTLDs and IDN that expressly address SSR related program objectives. (The link in the staff report did not resolve.) * Please provide details of how SSR objectives are explicitly referenced in ICANN’s standard operating procedures, Service Level Agreements and monitoring, emergency back- end registry operators and data escrow, Trademark Clearinghouse, root zone scaling management, DNSSEC-related activities, and Compliance Dept. activities Scope of ICANN’s SSR Responsibilities * This needs careful attention because it was one of the central subjects of SSR1’s recommendations and many of those recommendations have yet to be fully executed.  * This is an area where it seems good work is being done, but it’s not clear whether the work flows from strategic decisions/plans and not a lot of public information is available on this. * The subteam’s work in this area might be to help ICANN’s SSR team better focus and report on its work (it is difficult to find information and reporting/public information posting are not regularly done) Business Continuity Management * The subteam should consider focusing on how business continuity affects operational, compliance, and root zone security.  * There is significant work within ICANN but not much reporting on disaster preparedness and operational recovery planning. More information is needed.  * Is there a need for adoption of a formal framework for security contingency planning (for instance, from NIST or ISO)? I think fact-finding is needed with a particular focus on disaster management and recovery for those systems that have a clear impact on the Internet’s public identifiers. Information Security Management * Will ICANN commit to an accepted Framework for information security management related to those systems that support, and have a direct effect on, the Internet’s public identifier systems? Such a Framework could contribute to a community understanding of how the systems that are used as the foundation for the Internet’s public identifier systems are protected.

1 0