October 2020 - rssac-caucus

Initial implementation of RSSAC047
by Paul Hoffman Nov. 28, 2020

Nov. 28, 2020

Greetings again. As we discussed during the preparation of RSSAC047, ICANN org was going to create an initial implementation of the requirements in the document. The primary goal of this implementation is to help the RSSAC Caucus think more about metrics collecting. I have prepared a very early cut of the initial implementation: https://github.com/icann/root-metrics It is mostly (but not completely) functional, but could probably use a lot of help from the Caucus to make it more useful. If you have a GitHub account, please feel free to open issues or send pull requests. Note that I'm doing this as part of ICANN org, not as a formal part of the Caucus work. I'll add and fix things as a best-effort task among the rest of my work. One important note is that I have not set up the expected 20 vantage points, but am starting to do so now. I expect to have 20 up before the end of June so that the report at the end of July is representative (although it is likely to have flaws due to this being a very early implementation). I am having problems finding enough locations for vantage points in South America and Africa, but believe that I can have those regions filled in adequately in August. Let me know what you think, either in email or by opening issues. I'll send periodic progress reports to the Caucus mailing list. --Paul Hoffman

3 2

Rogue Operator Work Party Meeting Summary
by Renard, Kenneth D CTR USARMY CCDC C5ISR (USA) Nov. 2, 2020

Nov. 2, 2020

The Rogue Operator Work Party met on 13 October during the ICANN Community Days sessions. Topics discussed: Document re-organization, emphasizing actions of an RSO versus non-RSO activity Scenarios that demonstrate violations of the guiding principles that would cause an RSO to be considered rogue Re-wording of “unofficial responses” to non-RSO responses to more accurately describe pitfalls in detecting rogue activity We encourage all RSSAC Caucus members to review and provide input to the document via the RSSAC Caucus mail list, by commenting in the document, or by participating in the next work party meeting scheduled for 24 November 2020. Working Document is at: https://docs.google.com/document/d/1yI2uCtTOo_TkwxmFzfOLxz37EHay089lnBppp-v… Ken Renard S&TCD Contractor – ICF Sustaining Base Network Assurance Branch C5ISR Center, Space and Terrestrial Communications Directorate Office: 443-395-7809 kenneth.d.renard.ctr(a)mail.mil

4 5

RSSAC Caucus Local Perspective Tool Work Party next call on October 15th
by Andrew McConachie Oct. 15, 2020

Oct. 15, 2020

Dear RSSAC Caucus Members, Myself, Ozan, Abdulkarim and Ken had a call on Monday to discuss the RSSAC Caucus Local Perspective Tool Work Party. We discussed the narratives and agree to merge narratives #5 and #7 in the document, and to delete narrative #6 as it falls within the scope of the Rogue RSO Work Party. I’ve updated the narratives document to suggest these changes. User Narratives Google Document <https://docs.google.com/document/d/1enH6LjICyAbKVr7ssps_4KapecRAROK0nZrw2ih…> Another thing we provisionally decided was that it would be out of scope for the work party to define how data should be collected or stored, or where it should be collected or stored. The document could still specify how information should be presented, or output, by the tool in terms of format. But what should happen with that output is out of scope. We’ll be discussing these decisions on our next call on October 15th and the agenda has been posted on the work party wiki page. <https://community.icann.org/display/RSSAC/RSSAC+Caucus+Local+Perspective+To…> We’ll also be asking for volunteers to start turning what we have so far into an RSSAC publication. Thanks, Andrew

1 1

REMINDER: RSSAC Caucus Local Perspective Tool WP Teleconference #7 | Thursday, 15 October | 14:00-15:00 UTC
by Ozan Sahin Oct. 14, 2020

Oct. 14, 2020

***REMINDER*** ICANN69 Schedule page: https://69.schedule.icann.org/meetings/W5mobZvsR595JurZy Agenda: https://docs.google.com/document/d/10DkWU8_r9OlBPw_ULuGeBDcqBP4vKMDybgm-t2b… Participation Information: Zoom Link: https://icann.zoom.us/j/98254282050?pwd=NzhuaTB0WDhYMjJZNkhUVXVndXFzQT09 Zoom Session ID: 982 5428 2050 Zoom Session Passcode: EZD06Q=77y Zoom International Dial-In Numbers: https://icann.zoom.us/u/ab72YhCiF5 Zoom Phone Passcode: 772 010 3719 Work party wiki space: https://community.icann.org/x/gInsBw

1 0

Rogue Operator Work Party: New scenarios and text added for discussion
by Renard, Kenneth D CTR USARMY CCDC C5ISR (USA) Oct. 13, 2020

Oct. 13, 2020

My mail client seems to have sent this email in to the ether, so I am resending now. References to the meeting “tomorrow” are actually for “today”, in just a short time from now. Sorry for the delay. -Ken ============================================================================================ I have added some scenarios to the Rogue Operator Work Party document for discussion tomorrow. I encourage you to take a look at them and discuss in our work party call tomorrow (commenting in the document as well as discussion on the caucus email list are good as well). We are looking for volunteers to write text for scenarios 5 and 6 (some ideas are included in the document). We are also looking for volunteers to write text for the section on “Detecting and Mitigating Rogue RSO Behavior” (initial thoughts are provided). Link to the working document: https://docs.google.com/document/d/1yI2uCtTOo_TkwxmFzfOLxz37EHay089lnBppp-v…

1 0

RSSAC Caucus Rogue RSO WP Teleconference #7 | Tuesday, 13 October | 14:00-15:00 UTC
by Ozan Sahin Oct. 12, 2020

Oct. 12, 2020

ICANN69 Schedule page: https://69.schedule.icann.org/meetings/jYsMTZngAhRthts5h#/?limit=10&sortByF… Agenda: https://docs.google.com/document/d/1dvSO9CWoJV2Dqzjv4_qDtNCds_U7IkdMbfpogez… Participation Information: ICANN69 Page: https://69.schedule.icann.org/meetings/jYsMTZngAhRthts5h Zoom Link: https://icann.zoom.us/j/98204553385?pwd=T0NhNlNEdTQvOFd3b2dSZFB2TVNFZz09 Zoom Session ID: 982 0455 3385 Zoom Session Passcode: 0z788mWh?^ Zoom International Dial-In Numbers: https://icann.zoom.us/u/ac3Mk8mweQ Zoom Phone Passcode: 378 962 7463 Work party wiki space: https://community.icann.org/x/IonsBw

1 0

RSSAC Caucus Meeting | Tuesday, 13 October 2020 | 12:00-13:30 UTC
by Ozan Sahin Oct. 12, 2020

Oct. 12, 2020

ICANN69 Schedule page: https://69.schedule.icann.org/meetings/rY2CbwMRhxjJ2mSND#/?limit=10&sortByF… Agenda: https://docs.google.com/document/d/11kUzC_4Mr5XeenQ4Y5iYBGsUB14gjtkku_1S5Tp… Participation Information: ICANN69 Page: https://69.schedule.icann.org/meetings/rY2CbwMRhxjJ2mSND Zoom Link: https://icann.zoom.us/j/97995418862?pwd=Y0ZWSVpyNk1iM0xEQUpEUDNvQ1Vsdz09 Zoom Session ID: 979 9541 8862 Zoom Session Passcode: xT+K5dcqn^ Zoom International Dial-In Numbers: https://icann.zoom.us/u/abpFVtYJAa Zoom Phone Passcode: 476 492 5880

1 0

Re: [RSSAC Caucus] Rogue Operator Work Party: Source of zone data
by Fred Baker Oct. 12, 2020

Oct. 12, 2020

Sending again, this time with the right “from” address... Speaking strictly for myself, I would argue, as you did in your email, that getting the root zone from another party has a safety issue in it - how do we know it has the right data? I could imagine an RSO downloading the relevant files to somewhere in its own cloud, and then distributing from there to its constellation. Doing so would offload the RZM source. But I would consider getting the first copy from anywhere else as unsafe. > On Oct 6, 2020, at 10:19 AM, Renard, Kenneth D CTR USARMY CCDC C5ISR (USA) via rssac-caucus <rssac-caucus(a)icann.org> wrote: > > A discussion topic brought up at the last Rogue Operator Work Party call was on where [technically] an RSO fetches their root zone information from. Typically, an RSO will fetch zone data directly from the RZM’s servers [distribution of the zone files among the RSO’s instances is not considered here, just the initial fetch(es) from a source]. What if an RSO obtained their copy of the zone data from an intermediate source? #RootZone > > The RSO is responsible for publishing the correct IANA zone, as made available by the RZM. Whether they get it directly from the RZM or via some other party should(?) be irrelevant. An intermediate source certainly does introduce additional risk that the zone could have been modified, but it is still the responsibility of the RSO to publish true IANA data. I would not consider it _wise_ to obtain the zone from an intermediate source, but would we go so far as to say that this is a _rogue_ operation? Historically (1998?), fetching from an intermediate was seen as a pre-cursor to rogue operations, where new source may have had intentions of changing the zone, but there seem to be different interpretations of those events. > > The question to the group is: “Would using an intermediate source of root zone data, by itself, be considered a ROGUE operation?” Regardless of who the intermediate is…, regardless of the authenticity of the zone data… > > Thoughts? > > > Ken Renard > S&TCD Contractor – ICF > Sustaining Base Network Assurance Branch > C5ISR Center, Space and Terrestrial Communications Directorate > Office: 443-395-7809 > kenneth.d.renard.ctr(a)mail.mil > > _______________________________________________ > rssac-caucus mailing list > rssac-caucus(a)icann.org > https://mm.icann.org/mailman/listinfo/rssac-caucus > > _______________________________________________ > By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

2 1

Rogue Operator Work Party: Source of zone data
by Renard, Kenneth D CTR USARMY CCDC C5ISR (USA) Oct. 11, 2020

Oct. 11, 2020

A discussion topic brought up at the last Rogue Operator Work Party call was on where [technically] an RSO fetches their root zone information from. Typically, an RSO will fetch zone data directly from the RZM’s servers [distribution of the zone files among the RSO’s instances is not considered here, just the initial fetch(es) from a source]. What if an RSO obtained their copy of the zone data from an intermediate source? #RootZone The RSO is responsible for publishing the correct IANA zone, as made available by the RZM. Whether they get it directly from the RZM or via some other party should(?) be irrelevant. An intermediate source certainly does introduce additional risk that the zone could have been modified, but it is still the responsibility of the RSO to publish true IANA data. I would not consider it _wise_ to obtain the zone from an intermediate source, but would we go so far as to say that this is a _rogue_ operation? Historically (1998?), fetching from an intermediate was seen as a pre-cursor to rogue operations, where new source may have had intentions of changing the zone, but there seem to be different interpretations of those events. The question to the group is: “Would using an intermediate source of root zone data, by itself, be considered a ROGUE operation?” Regardless of who the intermediate is…, regardless of the authenticity of the zone data… Thoughts? Ken Renard S&TCD Contractor – ICF Sustaining Base Network Assurance Branch C5ISR Center, Space and Terrestrial Communications Directorate Office: 443-395-7809 kenneth.d.renard.ctr(a)mail.mil

9 14

Re: [RSSAC Caucus] [Non-DoD Source] Re: [Ext] Re: Rogue Operator Work Party: Source of zone data
by Renard, Kenneth D CTR USARMY CCDC C5ISR (USA) Oct. 11, 2020

Oct. 11, 2020

> So may be it’s worth for the Caucus draft to also consider those scenarios even if we do not like them. The work party is addressing "unofficial" responses, which could be anything from route hijacks to hyperlocal/8806. The relevance is that indicators of a rogue RSO, such as incorrect responses, could come from unofficial responders just as well as from an RSO. -Ken

2 1