June 2017 - Ssr2-review - lists.icann.org

Work plan (draft) Sub Team 2 – ICANN Security
by Boban Krsic July 9, 2017

July 9, 2017

Dear All, Please find attached a first draft of a work plan for subteam 2 - ICANN Security. I propose, that the basis for further development should be a gap analysis (without any obligations to certify something) based on the following two industrial standards: ISO/IEC 27001:2013 Information Security Management Systems (ISMS) and ISO 22301:2012 Business Continuity Management Systems (BCMS). With the use of both standards, we should be able to address all relevant work items that we identified in Madrid. For the beginning, I have created a simple MS Excel that consists all relevant information for project planning and realization of the gap analysis. The file contains a total of four sheets: * Sheet1 (Workplan) contains the main key action steps, a description of the action, expected outcome, evaluation methodology, required skill set, responsible person, proposed timeline, and finally a reference to Madrid’s work item list. The list is not finished and needs to be completed. * Sheet2 (Checklist 27001) contains 32 questions to address all relevant requirements of the main part of a ISMS based on ISO/IEC 27001. With the checklist, we are able to evaluate the following category groups: * Scope, relevant parties (stakeholder) * Leadership, roles and responsibilities * Risk management and risk treatment * Resources, competence, awareness and communication * Performance evaluation, internal audit and management review * Improvement of the ISMS * Sheet3 (Checklist 27001 – Annex A) contains a list of 114 questions based on the Annex A of ISO/IEC 27001. It is a list of security controls (or safeguards) that are to be used to improve security of information. The controls are structured, and the purpose of each of the 14 sections from Annex A [1]: * Information security policies - controls how to write and review policies * Organization of information security – controls on how the responsibilities are assigned * Human resources security – controls affecting the employment * Asset management – controls related to inventory of assets and acceptable use, also for information classification and media handling * Access control – controls for Access control policy, user access management, system and application access control, and user responsibilities * Cryptography – controls related to encryption and key management * Physical and environmental security – controls defining secure areas, entry controls, protection against threats, equipment security, secure disposal, clear desk and clear screen policy, etc. * Operational security – lots of controls related to management of IT production: change management, capacity management, malware, backup, logging, monitoring, installation, vulnerabilities * Communications security – controls related to network security, segregation, network services, transfer of information, messaging, etc. * System acquisition, development and maintenance – controls defining security requirements and security in development and support processes * Supplier relationships – controls on what to include in agreements, and how to monitor the suppliers * Information security incident management – controls for reporting events and weaknesses, defining responsibilities, response procedures, and collection of evidence * Information security aspects of business continuity management – controls requiring the planning of business continuity, procedures, verification and reviewing, and IT redundancy * Compliance – controls requiring the identification of applicable laws and regulations, intellectual property protection, personal data protection, and reviews of information security * Sheet4 (Checklist 22301) similar to sheet1 but with a focus on Business Continuity Management. The checklist contains a list of 90 questions to address all relevant requirements of a BCMS based on ISO 22301. With the checklist, we are able to evaluate the following category groups: * Scope, supply chain, l&r requirements and assurance * Leadership, roles and responsibilities * Risks and opportunities * Business continuity objectives and plans to achieve them * Human resources, competence and training and awareness * Communication and documentation * Operational planning and control * Business Impact Analysis (BIA) and Risk Assessment * Business continuity strategy / Resource recovery strategy * Incident response structure * Business continuity plans * Monitoring, measurement, analysis and evaluation * Internal audit and management review * Improvement of the BCMS I am using a similar list for my annually internal audits at DENIC. Altogether I would expect a total effort of approx. 15-20 m/d to perform key action steps 1.0 and 2.0. External consultants are also possible and in my view a good option. Jennifer, it would be great if you could import the file to google docs and share the link for editing purposes. Any feedback on this would be great. Regards, - Boban. [1]https://advisera.com/27001academy/knowledgebase/overview-of-iso-270012013… -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main

3 7

SSR2 Johannesburg meeting recap
by Jennifer Bryce June 30, 2017

June 30, 2017

Hi all, Hope you had a comfortable trip home! Thank you all again for a great meeting. Here’s a recap: * The draft action items for both plenary and subtopic groups are attached, along with summary notes. As usual, please review and let us know if you have any edits. The actions will also be posted to the wiki Action Items<https://community.icann.org/display/SSR/Action+Items> page. * The relevant Google docs are linked from the action items but I’ve also included links below. * As a reminder, each of the subtopics now has a wiki page. You can access them here<https://community.icann.org/display/SSR/Subtopics>. * The recordings of and other resources from the meeting have been posted here<https://community.icann.org/pages/viewpage.action?pageId=64949767>. * The next plenary session is on Tuesday, July 11th @ 21:00 UTC. Google docs: * Questions asked during SSR1 briefing<https://docs.google.com/document/d/15g9bz4h57wC9LmNltKLarLRGhJdztnCBzDGtWmB…> * Questions for ICANN Chief Innovation & Information Officer<https://docs.google.com/document/d/1QmUaAufCfYtEs0cXS-fTxwtkxHZMrBj1IwGIe33…> * Subtopics list<https://docs.google.com/document/d/1DWoT4VoMlT5Dvcy78EXI-O5tQFqa9CblwsDEV6g…> * Outreach list<https://docs.google.com/document/d/1iqI-67Ir-EydmPPJzsEeBO98X4jucgpFX3HaL_9…> * Doodle poll<https://beta.doodle.com/poll/6k8at4f63wpv37c3> * Future challenges<https://docs.google.com/document/d/1nBZXvPNVIGsqDUaTZkm9aW5Rit0hR4YHf3wftU2…> brainstorming doc Other resources: * SSR1 Briefing slides<https://community.icann.org/pages/viewpage.action?pageId=64949767&preview=/…> June 25 2017 * SSR1 Review Implementation Final Report<https://community.icann.org/display/SSR/SSR1+Review+Implementation+Home> * WHOIS Knowledge Center<https://whois.icann.org/en/knowledge-center> * Universal Acceptance Steering Group<https://uasg.tech/> * SAC097 SSAC Advisory Regarding the Centralized Zone Data Service (CZDS) and Registry Operator Monthly Activity Reports<•%09https:/www.icann.org/en/system/files/files/sac-097-en.pdf> And finally, a note from the ICANN meetings team: Please fill out the ICANN59 survey to assist us in improving our community experience at ICANN meetings >> https://meetingapp.icann.org/icann59/ Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Apologies: 29 June to 15 July
by Emily Taylor June 28, 2017

June 28, 2017

Dear all Please note that I will be on annual leave from 29 June to 15 July inclusive. My apologies for all SSR2 meetings that take place during these dates. Kind regards Emily -- Emily Taylor CEO, Oxford Information Labs *Associate Fellow, Chatham House; Editor, Journal of Cyber Policy* *PLEASE NOTE MY NEW EMAIL ADDRESS AND CONTACTS AS OF 1 JANUARY 2017* Magdalen Centre, Oxford OX4 4GA | T: 01865 582885 E: emily.taylor(a)oxil.co.uk | D: 01865 582811 | M: +44 7540 049322 <http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017> Registered office: 37 Market Square, Witney, Oxfordshire OX28 6RE. Registered in England and Wales No. 4520925. VAT No. 799526263 .

1 0

Input Needed on Possible SSR2-RT Face-to-Face Meeting January 2018
by Karen Mulberry June 28, 2017

June 28, 2017

Dear SSR2 Review Team Members, The Co-Chair’s anticipate the need for a face-to-face meeting in January 2018 focused on writing and editing a draft report. Determining the dates and location now will enable you to plan your schedules and will enable ICANN Staff to make arrangements and assist with visa issues. The dates that have been proposed to be blocked for this face-to-face meeting for 2018 are: January 15, 15, 17 or January 22, 23, 24 (to be determined whether two or three days will be needed) Please indicate your availability to attend a face-to-face Review Team meeting on these dates. Please respond to the poll by 25 June 1900 UTC https://beta.doodle.com/poll/meb4yab79qwmuep2#table<https://urldefense.proofpoint.com/v2/url?u=https-3A__beta.doodle.com_poll_m…> We are exploring potentially holding this meeting either in Brussels or in Montreal. If you have a preference for location, please email staff directly (off-list) at MSSI Secretariat mssi-secretariat(a)icann.org<mailto:mssi-secretariat@icann.org> so that can be considered as arrangements are being explored for the SSR2-RT meeting. Sincerely, Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

9 9

New Tracking Mechanism for Tracking SSR2-RT Requests
by Karen Mulberry June 28, 2017

June 28, 2017

Attached is the slide that Charla Shambley shared with the SSR2-RT during its June 26th session in Johannesburg. This is a high-level overview of the improvements we are making to how we track requests from all Review Teams, including SSR2. These changes are geared toward creating a consolidated view, to help everyone make sure that there is a clear understanding of the request, the time needed to fulfill it, the party responsible for getting it done and the status of work. I am confident that this mechanism will be a useful tool to help manage requests and timely delivery. The Tracking Mechanism slide provides the highlights of our process. We will keep you apprised when the new tracking table will be posted on the SSR2 wiki. Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

4 3

FW: Follow up to question from James Gannon during SSR2 WG session
by Karen Mulberry June 27, 2017

June 27, 2017

Please note the response to the question that was asked by James during the SSR1 Briefing. Karen Mulberry Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN From: Xavier Calvez <xavier.calvez(a)icann.org> Date: Tuesday, June 27, 2017 at 4:38 PM To: Karen Mulberry <karen.mulberry(a)icann.org> Cc: Becky Nash <becky.nash(a)icann.org>, James Gannon <james(a)cyberinvasion.net> Subject: Follow up to question from James Gannon during SSR2 WG session Karen, During the session “SSR1 Briefings to SSR2 Review Team” in Johannesburg on Sunday 25/6, James Gannon asked what composed the amount of Professional Services budget of $2.3m for FY17, which presented on 1 of the slides. Please see below the answer. The amount of FY17 Professional Services budget ($2.3m) comprises the following main items: - data escrow services: $930k - WHOIS studies (ARS design/analysis, parsing, accuracy testing, ARS phase 3): $638k - EBERO services: $353k - Background checks for registrar accreditation: $100k The above items add up to $2.0m. The remaining professional services included in the total are miscellaneous smaller items. Let me if there is any further question. Copying James here as I have his email address, but please make sure to publish the response for the entire SSR2 team to see. Thank you. Best, Xavier Xavier Calvez ICANN – SVP & CFO 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Phone: 310-301-5838 Mobile: 805-312-0052 Fax: 310-957-2348

1 0

Re: [Ssr2-review] Response to Action Item: ITHI
by Denise Michel June 27, 2017

June 27, 2017

Thanks for this, Steve. Could you please clarify when ITHI will start regularly publishing (or giving the public access to) data? It seems that the “schedule” below is about discussions rather than production, or am I misunderstanding? Best, Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> From: <ssr2-review-bounces(a)icann.org> on behalf of Steve Conte <steve.conte(a)icann.org> Date: Monday, June 26, 2017 at 1:23 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Response to Action Item: ITHI Hi All, In regards to the open action item: Provide the SSR2 RT a timeline of the ITHI project, when they have clarity on next steps and schedules. Please see the following response: The ITHI timeline at this point remains tentative. Much depends on where the community wants to go and on the availability of some of the registrar data (i.e. whois rate limiting issue). Here is what we expect to do this calendar year: 1) September/October time frame: - ITHI workshop with abuse community, tentatively a joint workshop with M3AAWG and/or a workshop at ICANN’s office in DC 2) ICANN 60 in Abu Dhabi: IHTI workshop - a) Study of whois inaccuracy complaints covering all registries and all registrars - b) Study of abuse tracking separately spam, phish, malware and botnets for all gTLDs, introduction of a graphical representation model tracking the data. - c) Potentially extending the same study to all registrars if whois data becomes available Presentation of candidate metrics and early measurements covering the other areas highlighted in the health definitions: - d) Study and measurement of “useful” vs “extra-omnerous” traffic at the root servers - e) Study and measurement of ICANN DNS registries, and how those parameters are actually used in observed traffic at the DNS root. - f) Study and measurement of leakage (i.e. TLDs that are not registered but tentative resolution is observed at the root) 3) Future work: - Start tracking (and publishing) the above data to build a time series, in particular for 2a) and 2b) - Work on a solution for 2c) - Refine 2d), 2e), 2f) The RIRs are working independently on the number track. I’ve reached out to them for a timeline but got no response so far. At some point, the ICANN track and the RIR track will have to converge. Further Information from the NRO We now have an RIR staff draft of ITHI metrics and my best estimate is that we will be proceeding as follows - - Q3 2017 Conduct Community Consultation on the ITHI draft and measurement matrix - Q3 2017 Incorporate community input into the paper - Q4 2017 Hand off to the RIR engineering teams for implementation in accordance with guidance from the NRO EC - H1 2018 tentative deployment ----- Steve Conte steve.conte(a)icann.org<mailto:steve.conte@icann.org>

1 0

Re: [Ssr2-review] Response to Action Item: ITHI
by Denise Michel June 26, 2017

June 26, 2017

Thanks, Steve Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> From: <ssr2-review-bounces(a)icann.org> on behalf of Steve Conte <steve.conte(a)icann.org> Date: Monday, June 26, 2017 at 1:23 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Response to Action Item: ITHI Hi All, In regards to the open action item: Provide the SSR2 RT a timeline of the ITHI project, when they have clarity on next steps and schedules. Please see the following response: The ITHI timeline at this point remains tentative. Much depends on where the community wants to go and on the availability of some of the registrar data (i.e. whois rate limiting issue). Here is what we expect to do this calendar year: 1) September/October time frame: - ITHI workshop with abuse community, tentatively a joint workshop with M3AAWG and/or a workshop at ICANN’s office in DC 2) ICANN 60 in Abu Dhabi: IHTI workshop - a) Study of whois inaccuracy complaints covering all registries and all registrars - b) Study of abuse tracking separately spam, phish, malware and botnets for all gTLDs, introduction of a graphical representation model tracking the data. - c) Potentially extending the same study to all registrars if whois data becomes available Presentation of candidate metrics and early measurements covering the other areas highlighted in the health definitions: - d) Study and measurement of “useful” vs “extra-omnerous” traffic at the root servers - e) Study and measurement of ICANN DNS registries, and how those parameters are actually used in observed traffic at the DNS root. - f) Study and measurement of leakage (i.e. TLDs that are not registered but tentative resolution is observed at the root) 3) Future work: - Start tracking (and publishing) the above data to build a time series, in particular for 2a) and 2b) - Work on a solution for 2c) - Refine 2d), 2e), 2f) The RIRs are working independently on the number track. I’ve reached out to them for a timeline but got no response so far. At some point, the ICANN track and the RIR track will have to converge. Further Information from the NRO We now have an RIR staff draft of ITHI metrics and my best estimate is that we will be proceeding as follows - - Q3 2017 Conduct Community Consultation on the ITHI draft and measurement matrix - Q3 2017 Incorporate community input into the paper - Q4 2017 Hand off to the RIR engineering teams for implementation in accordance with guidance from the NRO EC - H1 2018 tentative deployment ----- Steve Conte steve.conte(a)icann.org<mailto:steve.conte@icann.org>

1 0

Response to Action Item: ITHI
by Steve Conte June 26, 2017

June 26, 2017

Hi All, In regards to the open action item: Provide the SSR2 RT a timeline of the ITHI project, when they have clarity on next steps and schedules. Please see the following response: The ITHI timeline at this point remains tentative. Much depends on where the community wants to go and on the availability of some of the registrar data (i.e. whois rate limiting issue). Here is what we expect to do this calendar year: 1) September/October time frame: - ITHI workshop with abuse community, tentatively a joint workshop with M3AAWG and/or a workshop at ICANN’s office in DC 2) ICANN 60 in Abu Dhabi: IHTI workshop - a) Study of whois inaccuracy complaints covering all registries and all registrars - b) Study of abuse tracking separately spam, phish, malware and botnets for all gTLDs, introduction of a graphical representation model tracking the data. - c) Potentially extending the same study to all registrars if whois data becomes available Presentation of candidate metrics and early measurements covering the other areas highlighted in the health definitions: - d) Study and measurement of “useful” vs “extra-omnerous” traffic at the root servers - e) Study and measurement of ICANN DNS registries, and how those parameters are actually used in observed traffic at the DNS root. - f) Study and measurement of leakage (i.e. TLDs that are not registered but tentative resolution is observed at the root) 3) Future work: - Start tracking (and publishing) the above data to build a time series, in particular for 2a) and 2b) - Work on a solution for 2c) - Refine 2d), 2e), 2f) The RIRs are working independently on the number track. I’ve reached out to them for a timeline but got no response so far. At some point, the ICANN track and the RIR track will have to converge. Further Information from the NRO We now have an RIR staff draft of ITHI metrics and my best estimate is that we will be proceeding as follows - - Q3 2017 Conduct Community Consultation on the ITHI draft and measurement matrix - Q3 2017 Incorporate community input into the paper - Q4 2017 Hand off to the RIR engineering teams for implementation in accordance with guidance from the NRO EC - H1 2018 tentative deployment ----- Steve Conte steve.conte(a)icann.org<mailto:steve.conte@icann.org>

1 0

Johannesburg Meeting Details - afternoon session
by Yvette Guigneaux June 26, 2017

June 26, 2017

Hi All - We're getting ready to start the meeting for the afternoon session - here is the adobe room link - https://participate.icann.org/ssrreview. Thank you. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2EE7E.F0C70330]

1 0