June 2017 - Ssr2-review - lists.icann.org

Re: [Ssr2-review] [EXT] SSR2 Subtopic #2 - ICANN Security Discussion | 16:00 UT... @ Wed 2017-06-14 12:00 - 13:00
by Barrett, Kerry-Ann June 14, 2017

June 14, 2017

Sincerest apologies all. I was in a location without connectivity. Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist On Jun 14, 2017, at 12:13 PM, Bernard Turcotte <turcotte.bernard(a)gmail.com<mailto:turcotte.bernard@gmail.com>> wrote: All, Please note that the call was terminated after 5 minutes by Emily and Boban given they were the only participants. Bernard. On Wed, Jun 14, 2017 at 11:50 AM, Google Calendar <calendar-notification(a)google.com<mailto:calendar-notification@google.com>> wrote: more details »<https://www.google.com/calendar/event?action=VIEW&eid=XzYwcTMwYzFnNjBvMzBlM…> SSR2 Subtopic #2 - ICANN Security Discussion | 16:00 UTC | Wednesday, 14 June 2017 Please join the meeting via Adobe Connect via this link: https://participate.icann.org/ssrreview<https://www.google.com/url?q=https%3A%2F%2Fparticipate.icann.org%2Fssrrevie…> Dear SSR2 Review Team, Good day. You are invited to attend the meeting for Subtopic #2 – ICANN Security Discussion. Please see scheduling details and phone information below… DATE: Wednesday, 14 June 2017 TIME: 16:00 UTC – 17:00 UTC (1 hour) • For additional local times click here. **For Dial Out requests: if you would like to receive a dial-out for this meeting, please email your phone number of preference to mssi-secretariat(a)icann.org<mailto:mssi-secretariat@icann.org> at least 24 hours prior to the call and we’ll gladly dial you in.** [X] Please join the meeting via Adobe Connect via this link: https://participate.icann.org/ssrreview<https://www.google.com/url?q=https%3A%2F%2Fparticipate.icann.org%2Fssrrevie…> • Upon logging into Adobe Connect, a pop up window will provide you the option to Dial Out to your Phone. • Enter your Phone Number* (Remember to change the Country Code if needed). • After joining the call, as a courtesy to others and the presenters, please MUTE your phone. o This can be done by selecting *6 on your keypad. To UNMUTE select *6 again. [X] If you are unable to log into Adobe Connect and can only join via phone, You can join by dialing one of the access numbers below… Mobile: tel://1-605-475-5619<tel:(605)%20475-5619>,*,,3134284787<tel:(313)%20428-4787># Phone Only Controls: https://go.conferencinghub.com/2kfp9<https://www.google.com/url?q=https%3A%2F%2Fgo.conferencinghub.com%2F2kfp9&s…> Primary Access Number: 1-605-475-5619<tel:(605)%20475-5619> Guest Passcode: 313 428 4787<tel:(313)%20428-4787> Additional Access: USA 1-605-475-5619<tel:(605)%20475-5619> USA 1-712-770-4218<tel:(712)%20770-4218> Canada, Calgary +1 403 407 5801<tel:(403)%20407-5801> Canada, Montreal +1 514 669 5926<tel:(514)%20669-5926> Canada, Toronto +1 647 426 9175<tel:(647)%20426-9175> Canada, Vancouver +1 604 224 6903<tel:(604)%20224-6903> Argentina, Buenos Aires +54 (0) 11 5172 6020<tel:+54%2011%205172-6020> Argentina (toll free) 0800 800 1252 Australia, Sydney +61 (0) 2 8017 5796<tel:+61%202%208017%205796> Australia, Melbourne +61 (0) 3 8687 0554<tel:+61%203%208687%200554> Australia, Brisbane +61 (0) 7 3015 0544<tel:+61%207%203015%200544> Australia (toll free) 1 800 448 693 Austria, Vienna +43 (0) 1 25302 1786<tel:+43%201%20253021786> Austria (toll free) 0800 8866 3414 Bahrain, Manama +973 1619 8750<tel:+973%201619%208750> Bahrain (toll free) 800 81231 Belarus (toll free) 8 820 0011 0342 Belgium, Brussels +32 (0) 2 400 6929<tel:+32%202%20400%2069%2029> Belgium (toll free) 0800 39280 Brazil, Sao Paulo +55 11 4935 7170<tel:+55%2011%204935-7170> Brazil, Rio de Janeiro +55 21 4560 0071<tel:+55%2021%204560-0071> Brazil (toll free) 0800 887 0244 Bulgaria, Sofia +359 (0) 2 491 6054<tel:+359%202%20491%206054> Bulgaria (toll free) 00800 111 4951 Cambodia, Phnom Penh +855 23 962 580<tel:+855%2023%20962%20580> Canada (toll free) 1 855 950 3725<tel:(855)%20950-3725> Chile, Santiago +56 (0) 2 2666 0712<tel:+56%202%202666%200712> Chile (toll free) 171 800 835 945 China (national) +400 613 8105 China, Beijing +86 10 5667 0006<tel:+86%2010%205667%200006> China, Shanghai +86 21 2039 7083<tel:+86%2021%202039%207083> Colombia, Bogota +57 1 508 8125 Colombia (toll free) 01 800 755 0054 Costa Rica (toll free) 800 542 5351<tel:(800)%20542-5351> Croatia (toll free) 0800 222 836 Cyprus (toll free) 800 97429 Czech Republic, Prague +420 225 986 566<tel:+420%20225%20986%20566> Czech Republic (toll free) 800 701 533 Denmark, Copenhagen +45 32 72 78 11<tel:+45%2032%2072%2078%2011> Denmark (toll free) 80 70 35 87 Egypt (toll free) 0800 000 0541 Estonia, Tallinn +372 622 6569<tel:+372%20622%206569> Estonia (toll free) 800 011 1577 Fiji (toll free) 00800 3329 Finland, Helsinki +358 (0) 9 2310 1676 Finland (toll free) 0800 772 237 France, Paris +33 (0) 1 70 37 16 57<tel:+33%201%2070%2037%2016%2057> France (toll free) 0800 946 532 France (national) 0811 655 102 France (national) 0821 231 688 Germany, Frankfurt +49 (0) 69 2222 10613<tel:+49%2069%20222210613> Germany, Munich +49 (0) 89 2030 31208<tel:+49%2089%20203031208> Germany (national) 01801 000 891 Germany (toll free) 0800 588 9171 Greece, Athens +30 211 181 3825<tel:+30%2021%201181%203825> Greece (toll free) 00800 128 906 Hong Kong +852 3018 9119 Hong Kong (toll free) 800 901 914 Hungary, Budapest +36 1408 8968 Hungary (toll free) 068 001 9675 Iceland (toll free) 800 9004 India, Delhi +91 (0) 11 6641 1393<tel:+91%2011%206641%201393> India, Bangalore +91 (0) 80 6127 6713<tel:+91%2080%206127%206713> India, Mumbai +91 (0)22 6187 5029<tel:+91%2022%206187%205029> India, Chennai +91 (0)44 6688 6069<tel:+91%2044%206688%206069> India (toll free) 1800 200 9472<tel:(800)%20200-9472> Indonesia, Jakarta +62 21 2188 9094<tel:+62%2021%2021889094> Indonesia (toll free) 007 803 321 8918 Ireland, Dublin +353 (0) 1 526 9422<tel:+353%201%20526%209422> Ireland (national) 0818 270 288 Ireland (toll free) 1800 937 650 Ireland (national) 1890 907 631 Israel, Tel Aviv +972 (0)3 721 7954<tel:+972%203-721-7954> Israel (toll free) 1809 213 173 Italy, Milan +39 02 3600 8007<tel:+39%2002%203600%208007> Italy, Rome +39 06 8750 0677<tel:+39%2006%208750%200677> Italy (toll free) 800 146 095 Japan, Tokyo +81 (0) 3 4588 9606<tel:+81%203-4588-9606> Japan, Osaka +81 (0) 6 4560 2417<tel:+81%206-4560-2417> Japan (mobile) 0120 538 611 Japan (toll free) 0120 759 200 Japan (national) 0570 063 744 Kazakhstan (toll free) 8800 333 7556 Kenya, Nairobi +254 (0)20 529 3597 South Korea, Seoul +82 (0) 2 6007 0087<tel:+82%202-6007-0087> South Korea (toll free) 00798 6136 1526 Latvia, Riga +371 6601 3641 Latvia (toll free) 8000 4412 Lithuania, Vilnius +370 5205 5486 Lithuania (toll free) 8800 31443 Luxembourg +352 2088 1910<tel:+352%2020%2088%2019%2010> Luxembourg (toll free) 800 28437 Malaysia,Kuala Lumpur +60 (0) 3 7724 8003<tel:+60%203-7724%208003> Malaysia (toll free) 1 800 816 165 Mexico, Guadalajara +52 33 4162 3995<tel:+52%2033%204162%203995> Mexico, Mexico City +52 55 8421 0858<tel:+52%2055%208421%200858> Mexico, Monterrey +52 81 4162 3851<tel:+52%2081%204162%203851> Mexico (toll free) 01 800 283 3131 Morocco, Casablanca +212 (0) 520 48 0023 Morocco (toll free) 0800 091 297 Netherlands, Amsterdam +31 (0) 20 716 8346<tel:+31%2020%20716%208346> Netherlands (toll free) 0800 020 2598 New Zealand, Christchurch +64 (0) 3 974 2592<tel:+64%203-974%202592> New Zealand, Wellington +64 (0) 4 909 4679<tel:+64%204-909%204679> New Zealand, Auckland +64 (0) 9 929 1832<tel:+64%209-929%201832> New Zealand (toll free) 0800 440 096 Nigeria, Lagos +234 1 277 3948<tel:+234%201%20277%203948> Norway, Oslo +47 21 00 48 16<tel:+47%2021%2000%2048%2016> Norway (toll free) 800 56082 Oman (toll free) 800 77243 Panama, Panama City +507 8 339 783 Panama (toll free) 00800 223 1431 Peru, Lima +51 (0) 1 700 9588 Peru (toll free) 0800 78127 Philippines, Manila +63 (0)2 395 3435<tel:+63%202%20395%203435> Philippines (toll free) 1 800 111 014 18 Poland, Warsaw +48 22 295 3584<tel:+48%2022%20295%2035%2084> Poland (toll free) 00 800 121 4357 Portugal, Lisbon +351 21 424 5134<tel:+351%2021%20424%205134> Portugal (toll free) 800 784 443 Qatar (toll free) 00 800 100 501 Romania, Bucharest +40 (0) 21 529 1307<tel:+40%2021%20529%201307> Romania (toll free) 0800 801 036 Russia, Moscow +7 495 705 9452<tel:+7%20495%20705-94-52> Russia (toll free) 8 800 500 9272 Saudi Arabia (toll free) 800 844 9140<tel:(800)%20844-9140> Saudi Arabia (toll free) 800 850 0228<tel:(800)%20850-0228> Serbia (toll free) 0800 190 700 Singapore +65 6622 1799<tel:+65%206622%201799> Singapore (toll free) 800 616 3193<tel:(800)%20616-3193> Slovakia, Bratislava +421 (0)2 3321 5508 Slovakia (toll free) 0800 002 003 Slovenia (toll free) 0800 80594 Slovenia, Ljubljana 1 888 8200 South Africa, Johannesburg +27 (0)11 589 8334<tel:+27%2011%20589%208334> South Africa (toll free) 0800 999 598 Spain, Madrid +34 91 114 6654<tel:+34%20911%2014%2066%2054> Spain, Barcelona +34 93 800 1947<tel:+34%20938%2000%2019%2047> Spain (toll free) 900 828 036 Sri Lanka, Sri Lanka +94 720 910 349<tel:+94%2072%20091%200349> Sweden, Stockholm +46 (0) 8 5065 3957 Sweden (toll free) 0200 125 589 Switzerland, Geneva +41 (0) 22 595 4796<tel:+41%2022%20595%2047%2096> Switzerland, Zurich +41 (0) 44 580 7208<tel:+41%2044%20580%2072%2008> Switzerland (toll free) 0800 740 361 Taiwan, Taipei +886 (0) 2 2650 7322<tel:+886%202%202650%207322> Taiwan (toll free) 00 801 615 190 Thailand, Bangkok +66 (0) 2104 0766<tel:+66%202%20104%200766> Thailand (toll free) 001 800 6136 1530 Turkey, Istanbul +90 212 375 5032<tel:+90%20212%20375%2050%2032> Turkey (toll free) 00 800 448829138 Ukraine (toll free) 0800 500 923 UAE (toll free) 8000 3570 2658 UK (03) +44 (0)330 336 6011<tel:+44%20330%20336%206011> UK (toll free) 0800 358 6387 UK (national) 0844 473 5018 UK (national) 0845 545 0016 USA /Canada (toll free) 1-866-546-3377<tel:(866)%20546-3377> Uruguay (toll free) 0004 019 0305 Venezuela, Caracas +58 212 720 2580<tel:+58%20212-7202580> Venezuela (toll free) 0 800 100 8373 Vietnam, Hanoi +84 4 4458 3324<tel:+84%204%204458%203324> Vietnam, Ho Chi Minh +84 8 4458 1334<tel:+84%208%204458%201334> Vietnam (toll free) 1201 1444 Please join the meeting via Adobe Connect via this link: https://participate.icann.org/ssrreview<https://www.google.com/url?q=https%3A%2F%2Fparticipate.icann.org%2Fssrrevie…> Dear SSR2 Review Team, Good day. You are invited to attend the SSR2 – Meeting #9 Please see scheduling details and phone information below… DATE: Tuesday, 02 May 2017 TIME: 14:00 UTC – 15:00 UTC (1 hour) • For additional local times click here. • For UTC time converter, click here. **For Dial Out requests: if you would like to receive a dial-out for this meeting, please email your phone number of preference to mssi-secretariat(a)icann.org<mailto:mssi-secretariat@icann.org><mailto:mssi-secret<mailto:mssi-secret> When Wed 2017-06-14 12:00 – 13:00 Eastern Time - Toronto Where https://participate.icann.org/ssrreview | tel://1-605-475-5619<tel:(605)%20475-5619>,*,,3134284787# (map<https://maps.google.com/maps?q=https://participate.icann.org/ssrreview++%7C…>) Calendar Bernard Turcotte Who • MSSI Secretariat - organizer • Bernard Turcotte - creator • Jennifer Bryce • ameen(a)cert-in.org.in<mailto:ameen@cert-in.org.in> • Theresa Swinehart • james-1.gannon(a)novartis.com<mailto:james-1.gannon@novartis.com> • gih(a)apnic.net<mailto:gih@apnic.net> • jaberamatogoro(a)gmail.com<mailto:jaberamatogoro@gmail.com> • zarko.kecic(a)rnids.rs<mailto:zarko.kecic@rnids.rs> • aalain(a)trstech.net<mailto:aalain@trstech.net> • dmb(a)donblumenthal.com<mailto:dmb@donblumenthal.com> • amin.hasbini(a)kaspersky.com<mailto:amin.hasbini@kaspersky.com> • denisemichel(a)fb.com<mailto:denisemichel@fb.com> • Steve Conte • krsic(a)denic.de<mailto:krsic@denic.de> • eosterweil(a)verisign.com<mailto:eosterweil@verisign.com> • Karen Mulberry • ma(a)mahasbini.org<mailto:ma@mahasbini.org> • emily.taylor(a)oxil.co.uk<mailto:emily.taylor@oxil.co.uk> • kabarrett(a)oas.org<mailto:kabarrett@oas.org> • Larisa B. Gurnick • Yvette Guigneaux • Charla Shambley • kaveh.ranjbar(a)board.icann.org<mailto:kaveh.ranjbar@board.icann.org> • chandley(a)arin.net<mailto:chandley@arin.net> • james(a)cyberinvasion.net<mailto:james@cyberinvasion.net> • ramkrishna(a)isoc.org.np<mailto:ramkrishna@isoc.org.np> • Alice Jansen Going? Yes<https://www.google.com/calendar/event?action=RESPOND&eid=XzYwcTMwYzFnNjBvMz…> - Maybe<https://www.google.com/calendar/event?action=RESPOND&eid=XzYwcTMwYzFnNjBvMz…> - No<https://www.google.com/calendar/event?action=RESPOND&eid=XzYwcTMwYzFnNjBvMz…> more options »<https://www.google.com/calendar/event?action=VIEW&eid=XzYwcTMwYzFnNjBvMzBlM…> Invitation from Google Calendar<https://www.google.com/calendar/> You are receiving this email at the account turcotte.bernard(a)gmail.com<mailto:turcotte.bernard@gmail.com> because you are subscribed for notifications on calendar Bernard Turcotte. To stop receiving these emails, please log in to https://www.google.com/calendar/ and change your notification settings for this calendar. Forwarding this invitation could allow any recipient to modify your RSVP response. Learn More<https://support.google.com/calendar/answer/37135#forwarding>. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

5 4

FYI: Link to SSR1 Remaining Implementation Briefings doc
by Jennifer Bryce June 14, 2017

June 14, 2017

Hi all, Regarding the action item ‘Schedule remainder of briefings related to SSR1’ assigned to ICANN.org: FYI, we’ve created a Google doc which lists the remaining requested briefings and will be updated accordingly: https://docs.google.com/document/d/1js3wT36bLI0BXaGdZ7RRAN4nWjK8k4vuluak4vq… The link has been added to the action item on the wiki Plenary action items<https://community.icann.org/display/SSR/Plenary+Action+Items> page. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Sessions that might be of interest at ICANN 59 for members of the SSR2 RT
by Karen Mulberry June 13, 2017

June 13, 2017

Sessions that might be of interest at ICANN 59 for members of the SSR2 RT that was pulled together by Bernie Turcotte. Monday, June 26 * 09:00 - DNSSEC Workshop * 11:30 - GAC Session on 2-Character Country Codes as Second Level Domains * 13:30 - GAC Public Safety Working Group Update to GAC Plenary Tuesday June 27 * 17:00 - GAC Public Safety Working Group meeting Wednesday June 28 Thursday June 29 * 09:00 - Joint Meeting: RSSAC and OCTO * 09:00 - GNSO – Internet Service Providers and Connectivity Providers Constituency (ISPCP) Open Meeting * 12:00 - GAC Session on the KSK Rollover The full agenda for all the ICANN59 sessions can be found at https://schedule.icann.org/ Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

1 0

SSR2 Subtopic email addresses
by Jennifer Bryce June 13, 2017

June 13, 2017

Hi all, We have created email addresses for each of the subtopics. As with the SSR2 email address these are publicly archived here<https://community.icann.org/display/SSR/Email+Archives> (links pending). Along with support staff, we’ve added the volunteers for each subtopic to the distribution lists. We’d encourage you to use these email addresses for subtopic discussions. Please let us know if you want to be added to any of the lists. We’d also be happy to set up calls for each subtopic. We can share some suggested time slots if volunteer groups decide to schedule regular calls. Please let us know if you have any questions. Subtopic 1: SSR1 Review Volunteers: Denise, Alain, Ram Krishna, Eric Email: SSR1implementation-SSR2-RT(a)icann.org<mailto:SSR1implementation-SSR2-RT@icann.org> Subtopic 2: ICANN Security Volunteers: James, Denise, Boban, Noorul Ameen, Kerry-Ann, Žarko, Eric Email: ICANNsecurity-SSR2-RT(a)icann.org<mailto:ICANNsecurity-SSR2-RT@icann.org> Subtopic 3: DNS Security Volunteers: Emily, Alain, Cathy, Matogoro, Ram Krishna, Geoff, Amin Hasbini, Žarko, Eric, Don Email: DNSsecurity-SSR2-RT(a)icann.org<mailto:DNSsecurity-SSR2-RT@icann.org> Subtopic 4: Future Threats Volunteers: Emily, Kerry-Ann, Matogoro, Amin Hasbini, Noorul Ameen, Eric Email: Futurethreats-SSR2-RT(a)icann.org<mailto:Futurethreats-SSR2-RT@icann.org> Subtopic 5: IANA Transition Volunteers: Cathy, James, Geoff, Eric Email: IANAtransition-SSR2-RT(a)icann.org<mailto:IANAtransition-SSR2-RT@icann.org> Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Connectivity Concerns for SSR2 Meeting Call - Tuesday, 13 June 2017 @ 06:00 UTC
by MSSI Secretariat June 12, 2017

June 12, 2017

Hello SSR2 Review Team - Good day. I just wanted to touch base regarding connectivity concerns for our next SSR2 Meeting Call scheduled for Tuesday, 06 2017 @ 06:00 UTC. We have conquered many of the noise disturbances previously present and would like to ensure continued connectivity on future calls. For the best results in regions with connectivity concerns, we suggest doing the following... * Connect to the Adobe Connect (https://participate.icann.org/ssrreview) 20-30 minutes before the scheduled call - the Adobe Connect room will be open and I will be available to assist you - in addition we can resolve any microphone/static/connection issues ahead of time - including connecting with international operators if need be. The goal is to have all connection concerns resolved by the top of the hour for the benefit of the team. * Be located (if possible) in an area that has proper broadband connection and is quiet - thus creating a strong signal connection, making it possible to see and hear in the Adobe Connect Room. * Feel free to Skype me either before, during or after the call - my skype address is yvette.guigneaux.icann - this way I can respond to you almost immediately for whatever you may need - including having the Adobe Connect Room dial out to you if need be. We will also have Tech Support on this call to trouble shoot any AC Room issues should they arise. As your SSR2 Review Team Secretariat, I am determined to create an atmosphere where you can clearly participate in the Adobe Connect Room. Thank you everyone and I look forward to seeing you all on our upcoming call. :) Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2E360.B4657800]

1 0

Proposed agenda for SSR2 conference call - Tuesday 13 June, 06:00 UTC
by Denise Michel June 12, 2017

June 12, 2017

Hello, All. Here’s the proposed agenda for our Tuesday, 13 June conference call: * Note updated SOIs & apologies/absences * Continue discussion on sub-topic workplans (see discussion on email list), including next steps to address scope, work plan and timeline, etc. * Review open action items list (please be prepared to address your items) * Johannesburg meetings * AOB As always, comments are welcome. Staff will provide supporting slides shortly. Thanks. Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

3 2

Role of observers and ways of participating
by Emily Taylor June 10, 2017

June 10, 2017

Dear all As mentioned by me on the last call, I have received some feedback that participating as an observer to this Team is not particularly straightforward. There is a sense that observers are fairly firewalled from the discussions on calls (I understand that they are not able to see the adobe room for example), and this can make it difficult to follow the discussions. There is also no direct way for them to raise input in real time, either in our calls or through remote participation in the face to face calls. Here are a few questions from me, to stimulate discussions on the list: - Shall we keep arrangements as they are, with regard to observer participations? If you are open to changing the current arrangements, consider the following options. - Able to see Adobe Room during calls - Able to participate in Adobe Room chat - Able to speak on calls by raising hand Adobe Room - Able to join in list discussions (perhaps with some designation as 'observer') Please let me know your thoughts, and of course any other options I may have missed. Personally, I feel that we have a small group of Team Members and a small group who wish to be Observers. In my opinion we should make our processes transparent and encourage active participation from interested parties. If we start to feel swamped or overwhelmed by Observer input, that will be a different problem which we can review if it arises. Best Emily -- Emily Taylor CEO, Oxford Information Labs *Associate Fellow, Chatham House; Editor, Journal of Cyber Policy* *PLEASE NOTE MY NEW EMAIL ADDRESS AND CONTACTS AS OF 1 JANUARY 2017* Magdalen Centre, Oxford OX4 4GA | T: 01865 582885 E: emily.taylor(a)oxil.co.uk | D: 01865 582811 | M: +44 7540 049322 <http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017> Registered office: 37 Market Square, Witney, Oxfordshire OX28 6RE. Registered in England and Wales No. 4520925. VAT No. 799526263 .

3 3

Action Items: SSR2 Plenary 14
by Jennifer Bryce June 9, 2017

June 9, 2017

Hi all, Below are the draft action items from the SSR2 plenary on Tuesday 6 June. Summary notes are attached. Note the official record of the meeting can be found on the SSR2 wiki here<https://community.icann.org/display/SSR/SSR2+Meeting+%2314+-+06+June+2017+@…>. Action Items Plenary #14 Action Owner Due Date Send written responses to RT questions asked during the presentation on ICANN’s Global Stakeholder Engagement outreach efforts to SSR technical community. 1. We’re hearing that the GSE is supporting the work done by CTO. So, what do we mean by help support? And what is the relationship between this engagement and the IANA functions? (AA) 2. A lot of the presentation was about sending the message out. How does it work going the other way? You point to passive mechanisms but what about active measures? (GH) 3. Regarding L-root operations and hosting: What is the planning process vs. passive response? Is there a master plan for anyone who operates, in terms of Anycast? And how is that overall process implemented? (GH) 4. What efforts does ICANN take to inform the policy debate as it is taking place vs. after the fact? (GH) 5. How does GSE work specifically with the ccTLD community on SSR? (JM) 6. How is your work is coordinated and support the OCTO and SSR teams commitment to engage and seek input from the broader SSR community that’s not necessarily active in ICANN. Including their obligation to get input/interaction from them on SSR Framework and strategic priorities. How are you involved and how does the coordination occur? (DM) 7. When do you think in terms of GSE that the focus on explanation/teaching of what ICANN does will shift to more of an interaction/ substantive engagement? ICANN Org TBD Share thoughts and continue discussion on list regarding presentation of ICANN Security and SSR1 subtopic work plans. SSR2-RT TBD Share thoughts on list on how to be more open to observer inputs. SSR2-RT TBD -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] Work plan (draft) Sub Team 2 – ICANN Security
by Barrett, Kerry-Ann June 8, 2017

June 8, 2017

Dear Boban Thanks in advance for preparing this. We should decide if we set up a meeting with the sub-team to discuss and set deadlines for feedback and comments before that meeting. Sincerely, Kerry-Ann Barrett Cyber Security Policy Specialist Inter-American Committee against Terrorism Secretariat for Multidimensional Security Organization of American States 1889 F Street N.W., Washington, D.C. 20006 T. 202-370-4675 F. 202-458-3857 kabarrett(a)oas.org www.oas.org/cyber Register to our distribution list here! -----Original Message----- From: ssr2-review-bounces(a)icann.org [mailto:ssr2-review-bounces@icann.org] On Behalf Of Jennifer Bryce Sent: Monday, June 5, 2017 11:45 AM To: Boban Krsic <krsic(a)denic.de>; SSR2 <ssr2-review(a)icann.org> Subject: [EXT] Re: [Ssr2-review] Work plan (draft) Sub Team 2 – ICANN Security Hi all, The Google doc version has been posted on the wiki here: https://community.icann.org/pages/viewpage.action?pageId=64076120 . RT members have editing rights. Best, Jennifer -----Original Message----- From: <ssr2-review-bounces(a)icann.org> on behalf of Boban Krsic <krsic(a)denic.de> Date: Sunday, June 4, 2017 at 10:24 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Work plan (draft) Sub Team 2 – ICANN Security Dear All, Please find attached a first draft of a work plan for subteam 2 - ICANN Security. I propose, that the basis for further development should be a gap analysis (without any obligations to certify something) based on the following two industrial standards: ISO/IEC 27001:2013 Information Security Management Systems (ISMS) and ISO 22301:2012 Business Continuity Management Systems (BCMS). With the use of both standards, we should be able to address all relevant work items that we identified in Madrid. For the beginning, I have created a simple MS Excel that consists all relevant information for project planning and realization of the gap analysis. The file contains a total of four sheets: * Sheet1 (Workplan) contains the main key action steps, a description of the action, expected outcome, evaluation methodology, required skill set, responsible person, proposed timeline, and finally a reference to Madrid’s work item list. The list is not finished and needs to be completed. * Sheet2 (Checklist 27001) contains 32 questions to address all relevant requirements of the main part of a ISMS based on ISO/IEC 27001. With the checklist, we are able to evaluate the following category groups: * Scope, relevant parties (stakeholder) * Leadership, roles and responsibilities * Risk management and risk treatment * Resources, competence, awareness and communication * Performance evaluation, internal audit and management review * Improvement of the ISMS * Sheet3 (Checklist 27001 – Annex A) contains a list of 114 questions based on the Annex A of ISO/IEC 27001. It is a list of security controls (or safeguards) that are to be used to improve security of information. The controls are structured, and the purpose of each of the 14 sections from Annex A [1]: * Information security policies - controls how to write and review policies * Organization of information security – controls on how the responsibilities are assigned * Human resources security – controls affecting the employment * Asset management – controls related to inventory of assets and acceptable use, also for information classification and media handling * Access control – controls for Access control policy, user access management, system and application access control, and user responsibilities * Cryptography – controls related to encryption and key management * Physical and environmental security – controls defining secure areas, entry controls, protection against threats, equipment security, secure disposal, clear desk and clear screen policy, etc. * Operational security – lots of controls related to management of IT production: change management, capacity management, malware, backup, logging, monitoring, installation, vulnerabilities * Communications security – controls related to network security, segregation, network services, transfer of information, messaging, etc. * System acquisition, development and maintenance – controls defining security requirements and security in development and support processes * Supplier relationships – controls on what to include in agreements, and how to monitor the suppliers * Information security incident management – controls for reporting events and weaknesses, defining responsibilities, response procedures, and collection of evidence * Information security aspects of business continuity management – controls requiring the planning of business continuity, procedures, verification and reviewing, and IT redundancy * Compliance – controls requiring the identification of applicable laws and regulations, intellectual property protection, personal data protection, and reviews of information security * Sheet4 (Checklist 22301) similar to sheet1 but with a focus on Business Continuity Management. The checklist contains a list of 90 questions to address all relevant requirements of a BCMS based on ISO 22301. With the checklist, we are able to evaluate the following category groups: * Scope, supply chain, l&r requirements and assurance * Leadership, roles and responsibilities * Risks and opportunities * Business continuity objectives and plans to achieve them * Human resources, competence and training and awareness * Communication and documentation * Operational planning and control * Business Impact Analysis (BIA) and Risk Assessment * Business continuity strategy / Resource recovery strategy * Incident response structure * Business continuity plans * Monitoring, measurement, analysis and evaluation * Internal audit and management review * Improvement of the BCMS I am using a similar list for my annually internal audits at DENIC. Altogether I would expect a total effort of approx. 15-20 m/d to perform key action steps 1.0 and 2.0. External consultants are also possible and in my view a good option. Jennifer, it would be great if you could import the file to google docs and share the link for editing purposes. Any feedback on this would be great. Regards, - Boban. [1]https://advisera.com/27001academy/knowledgebase/overview-of-iso-270012013… -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

3 2

Proposed agenda for SSR2 Review Team call -- 21:00 UTC , Tuesday, 06 June 2017
by Denise Michel June 7, 2017

June 7, 2017

Hello, All. Here’s the proposed agenda for our Tuesday, 6 June conference call: * Note updated SOIs & apologies/absences · Staff presentation: ICANN Global Stakeholder Engagement outreach efforts to SSR technical community (for Review Team consideration; follow-up request from Madrid meeting) * Review/discuss follow-up work on sub-topic groups (Žarko & Boban to lead first 2 bullets below) * Draft work plan for sub-topic “ICANN Security” (see Boban email & attachment) * Consolidating and reviewing sub-topic groups’ lists * Finalize volunteers list and discuss next steps * ICANN59 Johannesburg – agenda input * Review open action items list * AOB As always, comments are welcome. Staff will provide supporting slides shortly. Thanks. Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

3 2