- rssac-caucus - lists.icann.org

Incident Reporting WP Potential Scenario
by Russ Mundy Aug. 14, 2023

Aug. 14, 2023

Folks, During the last WP call we discussed the possibility that having a few ‘simple examples’ of potential security incidents might be useful for Work Party discussion. Following is a short write up of a DNSSEC validation failure identified by an open recursive operator such as 8.8.8.8 or 1.1.1.1. Russ ps this is certainly not complete but, hopefully, helps move things forward. --------------- RSS Potential Security Incident for Work Party Discussion Event Description: An open DNS Resolver operator observes DNSSEC validation failure. - What actions should the resolver operator 'normally' take? - How should the resolver operator respond? E.g. should the operator be expected to determine how broad the problem is? - When and how should the resolver operator contact the RSS and/or an RSO? When an RSO becomes aware of the resolver validation failure, what steps should they take? How would the determination be made about whether or not such an event would be considered an RSS Security Incident? E.g., does a DNSSEC validation failure qualify as such an event? - If it is a Security Incident, does this mean it is reported to "the public" or to some more 'restricted' group? - Are follow-up reports required?

1 0

Incident Reporting example/reference document
by Robert Story Aug. 14, 2023

Aug. 14, 2023

Hafiz forwarded a nice example of a security incident reporting document from the government of South Australia that might give us some good ideas for our document... https://www.security.sa.gov.au/documents/documents/SACSF-G4-0-Cyber-Securit… Regards, Robert -- Robert Story USC Information Sciences Institute <http://www.isi.edu/> Networking and Cybersecurity Division

1 0

REMINDER: RSSAC Caucus RSS Security Incident Reporting WP Teleconference | Every 2 weeks on Monday | 15:00-16:00 UTC
by Ozan Sahin Aug. 14, 2023

Aug. 14, 2023

***REMINDER*** Ozan Sahin - ICANN Org is inviting you to a scheduled Zoom meeting. Topic: RSSAC Caucus RSS Security Incident Reporting WP Call Work party wiki space: https://community.icann.org/x/5pWZDg Agenda: https://docs.google.com/document/d/1YD1v1KJ9Vfnd0Y-HEJ8-I-M5WmFFBDOU21d4qpm… Statement of work: https://docs.google.com/document/d/1qgzEAqmMHTwmZ23EH0vuE1SE-AWVK_NAddgv-3C… Time: Jul 17, 2023 03:00 PM Universal Time UTC Every 2 weeks on Mon, until Oct 9, 2023, 7 occurrence(s) Jul 17, 2023 03:00 PM Jul 31, 2023 03:00 PM Aug 14, 2023 03:00 PM Aug 28, 2023 03:00 PM Sep 11, 2023 03:00 PM Sep 25, 2023 03:00 PM Oct 9, 2023 03:00 PM Please download and import the following iCalendar (.ics) files to your calendar system. Weekly: https://icann.zoom.us/meeting/tJ0tceCqrDkvGt1eKR9XL2QYuMQa1Fp9w12P/ics?icsT… Join Zoom Meeting https://icann.zoom.us/j/99069222509?pwd=amFjLzNqT3lzc3huYk82UC84MmNKQT09 Meeting ID: 990 6922 2509 Passcode: 2fB58%2u5r --- One tap mobile +13017158592,,99069222509#,,,,*8061447080# US (Washington DC) +13126266799,,99069222509#,,,,*8061447080# US (Chicago) --- Dial by your location • +1 301 715 8592 US (Washington DC) • +1 312 626 6799 US (Chicago) • +1 346 248 7799 US (Houston) • +1 669 900 6833 US (San Jose) • +1 929 436 2866 US (New York) • +1 253 215 8782 US (Tacoma) • 888 788 0099 US Toll-free • 833 548 0276 US Toll-free • 833 548 0282 US Toll-free • 877 853 5247 US Toll-free • +61 3 7018 2005 Australia • +61 7 3185 3730 Australia • +61 8 6119 3900 Australia • +61 8 7150 1149 Australia • +61 2 8015 6011 Australia • 1800 893 423 Australia Toll-free • 1800 945 157 Australia Toll-free • 1800 317 562 Australia Toll-free • +1 438 809 7799 Canada • +1 587 328 1099 Canada • +1 647 374 4685 Canada • +1 647 558 0588 Canada • +1 778 907 2071 Canada • +1 204 272 7920 Canada • 855 703 8985 Canada Toll-free • +81 3 4579 0545 Japan • +81 363 628 317 Japan • +81 3 4578 1488 Japan • 0 800 100 5040 Japan Toll-free • 0 120 829 768 Japan Toll-free • 0 120 836 177 Japan Toll-free • 00 663 381 4092 Japan Toll-free • +31 20 794 0854 Netherlands • +31 20 794 6519 Netherlands • +31 20 794 6520 Netherlands • +31 20 794 7345 Netherlands • +31 707 006 526 Netherlands • +31 20 241 0288 Netherlands • 0 800 025 0113 Netherlands Toll-free • 0 800 220 0040 Netherlands Toll-free • 0 800 022 1954 Netherlands Toll-free • +46 8 5016 3827 Sweden • +46 8 5050 0828 Sweden • +46 8 5050 0829 Sweden • +46 8 5052 0017 Sweden • +46 850 539 728 Sweden • +46 8 4468 2488 Sweden • 0 200 123 720 Sweden Toll-free • 0 201 604 329 Sweden Toll-free • 0 200 123 514 Sweden Toll-free Meeting ID: 990 6922 2509 Passcode (for dial-ins only): 8061447080 Find your local number: https://icann.zoom.us/u/adoGhWDV9U

1 0

RSSAC001v2 Published
by Andrew McConachie Aug. 11, 2023

Aug. 11, 2023

Dear RSSAC Caucus Members, The RSSAC has published RSSAC001v2: Advisory on Service Expectation of Root Servers. RSSAC001v2 can be found here. <https://www.icann.org/en/system/files/files/rssac-001-root-service-expectat…> Thanks, Andrew

1 0

Four Updates
by Ozan Sahin Aug. 3, 2023

Aug. 3, 2023

Dear RSSAC Caucus Members, I have three updates to share: 1. The meeting minutes from 11 July 2023 RSSAC meeting have been approved during the RSSAC Teleconference on Tuesday, 1 August 2023. The meeting minutes have been posted on the RSSAC meetings page: https://www.icann.org/resources/pages/rssac-meetings-2014-05-06-en. You may also find approved meeting minutes attached to this note. 2. Dr. Tarek Kamel Award for Capacity Building Nomination Period closes on Friday, 4 August. If you would like to submit a nomination, you may find the link here: https://www.icann.org/en/announcements/details/last-call-nominations-for-ic…. 3. A new course about the Root Server System is now available on ICANN Learn<https://learn.icann.org/#/>. See this blog for details: https://www.icann.org/en/blogs/details/new-icann-learn-course-about-the-roo…. 4. RSSAC recently adopted the recommendation of the RSSAC Caucus Membership Committee to appoint a new RSSAC Caucus member: • Peter Thomassen Peter has been subscribed to this mailing list and his statement of interest is available here: https://community.icann.org/display/RSI/RSSAC+Caucus+Statements+of+Interest. Please join me in welcoming Peter. Best, Ozan Sahin Policy Development Support Senior Specialist Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +90 533 641 0007 Skype: ozan.sahin.icann www.icann.org<applewebdata://021EB1F1-F6B6-443A-908F-419605BF3A61/www.icann.org>

1 0

RSSAC Caucus RSS Security Incident Reporting WP Teleconference | Every 2 weeks on Monday | 15:00-16:00 UTC
by Ozan Sahin July 31, 2023

July 31, 2023

Ozan Sahin - ICANN Org is inviting you to a scheduled Zoom meeting. Topic: RSSAC Caucus RSS Security Incident Reporting WP Call Work party wiki space: https://community.icann.org/x/5pWZDg Statement of work: https://docs.google.com/document/d/1qgzEAqmMHTwmZ23EH0vuE1SE-AWVK_NAddgv-3C… Time: Jul 17, 2023 03:00 PM Universal Time UTC Every 2 weeks on Mon, until Oct 9, 2023, 7 occurrence(s) Jul 17, 2023 03:00 PM Jul 31, 2023 03:00 PM Aug 14, 2023 03:00 PM Aug 28, 2023 03:00 PM Sep 11, 2023 03:00 PM Sep 25, 2023 03:00 PM Oct 9, 2023 03:00 PM Please download and import the following iCalendar (.ics) files to your calendar system. Weekly: https://icann.zoom.us/meeting/tJ0tceCqrDkvGt1eKR9XL2QYuMQa1Fp9w12P/ics?icsT… Join Zoom Meeting https://icann.zoom.us/j/99069222509?pwd=amFjLzNqT3lzc3huYk82UC84MmNKQT09 Meeting ID: 990 6922 2509 Passcode: 2fB58%2u5r --- One tap mobile +13017158592,,99069222509#,,,,*8061447080# US (Washington DC) +13126266799,,99069222509#,,,,*8061447080# US (Chicago) --- Dial by your location • +1 301 715 8592 US (Washington DC) • +1 312 626 6799 US (Chicago) • +1 346 248 7799 US (Houston) • +1 669 900 6833 US (San Jose) • +1 929 436 2866 US (New York) • +1 253 215 8782 US (Tacoma) • 888 788 0099 US Toll-free • 833 548 0276 US Toll-free • 833 548 0282 US Toll-free • 877 853 5247 US Toll-free • +61 3 7018 2005 Australia • +61 7 3185 3730 Australia • +61 8 6119 3900 Australia • +61 8 7150 1149 Australia • +61 2 8015 6011 Australia • 1800 893 423 Australia Toll-free • 1800 945 157 Australia Toll-free • 1800 317 562 Australia Toll-free • +1 438 809 7799 Canada • +1 587 328 1099 Canada • +1 647 374 4685 Canada • +1 647 558 0588 Canada • +1 778 907 2071 Canada • +1 204 272 7920 Canada • 855 703 8985 Canada Toll-free • +81 3 4579 0545 Japan • +81 363 628 317 Japan • +81 3 4578 1488 Japan • 0 800 100 5040 Japan Toll-free • 0 120 829 768 Japan Toll-free • 0 120 836 177 Japan Toll-free • 00 663 381 4092 Japan Toll-free • +31 20 794 0854 Netherlands • +31 20 794 6519 Netherlands • +31 20 794 6520 Netherlands • +31 20 794 7345 Netherlands • +31 707 006 526 Netherlands • +31 20 241 0288 Netherlands • 0 800 025 0113 Netherlands Toll-free • 0 800 220 0040 Netherlands Toll-free • 0 800 022 1954 Netherlands Toll-free • +46 8 5016 3827 Sweden • +46 8 5050 0828 Sweden • +46 8 5050 0829 Sweden • +46 8 5052 0017 Sweden • +46 850 539 728 Sweden • +46 8 4468 2488 Sweden • 0 200 123 720 Sweden Toll-free • 0 201 604 329 Sweden Toll-free • 0 200 123 514 Sweden Toll-free Meeting ID: 990 6922 2509 Passcode (for dial-ins only): 8061447080 Find your local number: https://icann.zoom.us/u/adoGhWDV9U

2 1

604 Root Server System (RSS) Essentials ICANN Learn Course
by Andrew McConachie July 19, 2023

July 19, 2023

Dear RSSAC Caucus Members, ICANN Learn has launched a new course on the RSS called, "604 Root Server System (RSS) Essentials”. You can take it by logging into learn.icann.org <http://learn.icann.org/> with your ICANN account. Then search for “RSS”. Both this course and "602.1 DNS Fundamentals” are intended to introduce technical topics to a non-technical audience. Thanks, Andrew

1 0

Re: [RSSAC Caucus] Doodle: Standing Call Time for RSS Security Incident Reporting Work Party
by Ozan Sahin July 14, 2023

July 14, 2023

Dear all, Thank you for participating in the doodle poll. Based on the poll results work party calls will take place every two weeks on Mondays at 15:00-16:00 UTC. I have just circulated a recurring calendar invitation and the next work party meeting is on Monday, 17 July 2023. Best, Ozan Sahin Policy Development Support Senior Specialist Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +90 533 641 0007 Skype: ozan.sahin.icann www.icann.org<applewebdata://021EB1F1-F6B6-443A-908F-419605BF3A61/www.icann.org> From: rssac-caucus <rssac-caucus-bounces(a)icann.org> on behalf of Ozan Sahin <ozan.sahin(a)icann.org> Date: 11 July 2023 Tuesday 22:35 To: "rssac-caucus(a)icann.org" <rssac-caucus(a)icann.org> Subject: [RSSAC Caucus] Doodle: Standing Call Time for RSS Security Incident Reporting Work Party Dear RSSAC Caucus members, Based on the feedback I received, I am circulating a doodle poll to find a standing call time for the RSS Security Incident Reporting Work Party teleconferences. The work party agreed to have a call every other week starting the week of 17 July 2023. Please indicate your availability by completing this doodle poll before 14:00 UTC on Friday, 14 July 2023: https://doodle.com/meeting/participate/id/e7XYNxra [doodle.com]<https://urldefense.com/v3/__https:/doodle.com/meeting/participate/id/e7XYNx…> Best, Ozan Sahin Policy Development Support Senior Specialist Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +90 533 641 0007 Skype: ozan.sahin.icann www.icann.org<applewebdata://021EB1F1-F6B6-443A-908F-419605BF3A61/www.icann.org> From: rssac-caucus <rssac-caucus-bounces(a)icann.org> on behalf of Ozan Sahin <ozan.sahin(a)icann.org> Date: 6 July 2023 Thursday 20:31 To: "rssac-caucus(a)icann.org" <rssac-caucus(a)icann.org> Subject: [RSSAC Caucus] RSSAC Caucus RSS Security Incident Reporting Work Party Kickoff Call Dear RSSAC Caucus members, RSSAC Caucus RSS Security Incident Reporting Work Party Kickoff Call was held earlier today. You can find the recording from the call on the work party’s wiki space: https://community.icann.org/x/5pWZDg. With respect to the cadence of the upcoming work party calls, we received a suggestion to hold a work party meeting on every other Thursday at 15:00 UTC starting 20 July 2023. The suggestion was well received by the participants in attendance. If you could not attend today’s teleconference but intend to attend the future RSS Security Incident Reporting Work Party meetings and you would like another doodle poll to be circulated to determine the work party standing call time, rather than having a call once every two weeks on Thursday at 15:00 UTC, please let me know by the end of business in your time zone on Monday, 10 July 2023. Otherwise I will circulate a standing call invitation on the RSSAC Caucus mailing list for the agreed upon time slot. Best, Ozan Sahin Policy Development Support Senior Specialist Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +90 533 641 0007 Skype: ozan.sahin.icann www.icann.org<applewebdata://021EB1F1-F6B6-443A-908F-419605BF3A61/www.icann.org>

1 0

RSSAC Meeting Minutes | 15 June 2023
by Ozan Sahin July 13, 2023

July 13, 2023

Dear RSSAC Caucus Members, The meeting minutes from 15 June 2023 RSSAC Teleconference have been approved during the RSSAC Meeting on Tuesday, 11 July 2023. The meeting minutes have been posted on the RSSAC Meetings page https://www.icann.org/resources/pages/rssac-meetings-2014-05-06-en. You may also find the meeting minutes attached to this note. Best, Ozan Sahin Policy Development Support Senior Specialist Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +90 533 641 0007 Skype: ozan.sahin.icann www.icann.org<applewebdata://021EB1F1-F6B6-443A-908F-419605BF3A61/www.icann.org>

1 0

Doodle: Standing Call Time for RSS Security Incident Reporting Work Party
by Ozan Sahin July 11, 2023

July 11, 2023

Dear RSSAC Caucus members, Based on the feedback I received, I am circulating a doodle poll to find a standing call time for the RSS Security Incident Reporting Work Party teleconferences. The work party agreed to have a call every other week starting the week of 17 July 2023. Please indicate your availability by completing this doodle poll before 14:00 UTC on Friday, 14 July 2023: https://doodle.com/meeting/participate/id/e7XYNxra Best, Ozan Sahin Policy Development Support Senior Specialist Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +90 533 641 0007 Skype: ozan.sahin.icann www.icann.org<applewebdata://021EB1F1-F6B6-443A-908F-419605BF3A61/www.icann.org> From: rssac-caucus <rssac-caucus-bounces(a)icann.org> on behalf of Ozan Sahin <ozan.sahin(a)icann.org> Date: 6 July 2023 Thursday 20:31 To: "rssac-caucus(a)icann.org" <rssac-caucus(a)icann.org> Subject: [RSSAC Caucus] RSSAC Caucus RSS Security Incident Reporting Work Party Kickoff Call Dear RSSAC Caucus members, RSSAC Caucus RSS Security Incident Reporting Work Party Kickoff Call was held earlier today. You can find the recording from the call on the work party’s wiki space: https://community.icann.org/x/5pWZDg. With respect to the cadence of the upcoming work party calls, we received a suggestion to hold a work party meeting on every other Thursday at 15:00 UTC starting 20 July 2023. The suggestion was well received by the participants in attendance. If you could not attend today’s teleconference but intend to attend the future RSS Security Incident Reporting Work Party meetings and you would like another doodle poll to be circulated to determine the work party standing call time, rather than having a call once every two weeks on Thursday at 15:00 UTC, please let me know by the end of business in your time zone on Monday, 10 July 2023. Otherwise I will circulate a standing call invitation on the RSSAC Caucus mailing list for the agreed upon time slot. Best, Ozan Sahin Policy Development Support Senior Specialist Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +90 533 641 0007 Skype: ozan.sahin.icann www.icann.org<applewebdata://021EB1F1-F6B6-443A-908F-419605BF3A61/www.icann.org>

1 0