July 2017 - Ssr2-review - lists.icann.org

Item 68: L Root Question
by Steve Conte July 17, 2017

July 17, 2017

Greetings all, In response to the question on open item 68: "What measures are undertaken by ICANN for the anycast deployment for L-Root to ensure physical and network security and stability." Please see the response below: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- SSR measures undertaken by ICANN for the anycast deployment of the root server operated y ICANN can be considered on two axis, Structured activities, and technical considerations. The ICANN DNS Engineering department undertakes two structured activities directed at operational security matters, they are: - ICANN DNS Engineering engages in an annual table-top exercise with other root server operators to test its global operational readiness to security or attack events. - ICANN DNS Engineering have commenced an annual security review where a 3rd party security firm is contracted to perform a range of penetration tests targeting all facets of L-Root operations. Technical considerations cover actions applied to all ICANN root server anycast instances. All L-Root instances have access control lists applied to the interfaces in a stateless mode that: - only permits access from the greater internet to the public service addresses for the necessary ports on the expected protocols (eg 2001:500:9f::42, port 53, TCP and UDP) - restrict all traffic to/from the management interfaces to ICANN management networks Additionally, all L-Root instances: - follow a plan and process to update all hardware before it reaches 5 years of age - follow a policy that all hardware is under either a 3 year or 5 year, next business day, support contract from the hardware vendor (when supported by the vendor in the particular country where the instance is located) - have internal and external monitoring of the L-Root service AS number - have internal and external monitoring of the L-Root service on all necessary protocols and service addresses - are monitored for access activity, network uptime and performance, and system uptime and performance - implement the appropriate recommendations from BCP38 and RFC7454. Given ICANN anycast deployments come in two forms. 1) Anycast instances operated by ICANN and hosted by contracted parties. 2) Anycast instances operated and hosted by ICANN SSR measures for these two deployment forms differ slightly 1. Anycast instances operated by ICANN and hosted by contracted parties. For all L-Root instances hosted by contracted parties the following conditions are placed on the host, by contract. - provide connectivity for network traffic for the DNS service interface in such a way to achieve high availability; - provide connectivity for network traffic for the remote management interface in such a way to achieve high availability; - provide physical security with no history of breaches within the last 12 months, which may be monitored and adjusted by ICANN from time to time; - provide suitable power and cooling, which may be monitored and adjusted by ICANN - ensure access to the Equipment to is restricted to no other individuals than an ICANN representative or an authorised employee of the contracted organisation - ensure the contracted organisation access the Equipment only as directed by ICANN - notify ICANN should any security, power or cooling arrangements be changed 2. Anycast instances both operated and hosted by ICANN These anycast instances are maintained in ICANN controlled cages in data-centers that have been inspected by ICANN Staff and meet the following access security and infrastructure requirements: - require photographic government issued ID for access - premises are manned by security personnel 24x7 - pre-authorisation is required for access - key or pin-code access into ICANN caged areas - 24x7 monitoring and recording of access - equipment entering or leaving the facility is vetted and checked with ICANN staff - full UPS power on all circuits - power supply redundancy including on-site generators. - robust and redundant heating, ventilation, and air conditioning (HVAC) systems Network connectivity at these anycast locations is via multiple redundant upstream connections and the providers of these services are contracted directly to ICANN, and as such changes can only be implemented by authorised ICANN staff. ----- Steve Conte steve.conte(a)icann.org

3 4

SSR2-RT Plenary #18 Actions
by Karen Mulberry July 17, 2017

July 17, 2017

Here are the notes and draft Action Items from the SSR2-RT Plenary meeting #18. Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

1 0

Resignation from SSR2
by Emily Taylor July 17, 2017

July 17, 2017

Dear colleagues With regret, I am resigning from the SSR2 with immediate effect. As you know from my SOI, my company Oxford Information Labs occasionally provides consultancy work for ICANN. ICANN has introduced terms for consultants which make it no longer viable for me to continue as a volunteer within the ICANN community. I have consulted with the SSR2 co-chairs and my business partners and have their full support in taking this step. I would like to extend a personal thanks to both Eric and Denise for their support and dedicated work on this project. I wish you all every success in the months ahead. I will inform the leadership of the RrSG, which nominated me to this team. Best wishes Emily -- Emily Taylor CEO, Oxford Information Labs *Associate Fellow, Chatham House; Editor, Journal of Cyber Policy* Magdalen Centre, Oxford OX4 4GA | T: 01865 582885 E: emily.taylor(a)oxil.co.uk | D: 01865 582811 | M: +44 7540 049322 <http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017> Registered office: 37 Market Square, Witney, Oxfordshire OX28 6RE. Registered in England and Wales No. 4520925. VAT No. 799526263 .

4 4

Re: [Ssr2-review] SAVE THE DATES - SSR2 RT Face to Face Meetings | 22-24 January 2018
by Cathy Handley July 15, 2017

July 15, 2017

I need to apologize, I will not be able to attend this meeting. When I originally responded my calendar was clear, however in the mean time other commitments have come up. If there are any changes in these dates and the meeting is in Brussels , I could make the 26-28 as I am in Geneva and could attend in between my other commitments. Sorry for any inconvenience, Cathy Handley Executive Director Government Affairs American Registry for Internet Numbers (ARIN) PO Box 232290 Centrevile, VA 20120 Mobile: +1 703 341 7996<tel:+1%20703%20341%207996> Email: chandley(a)arin.net<mailto:chandley@arin.net> On Jul 14, 2017, at 4:46 PM, MSSI Secretariat <mssi-secretariat(a)icann.org<mailto:mssi-secretariat@icann.org>> wrote: Hi All – SSR2 (F2F) Meetings in January - Save the Dates (22-24 January 2018) Location: TBD – more information to follow _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review <meeting.ics>

2 1

SAVE THE DATES - SSR2 RT Face to Face Meetings | 22-24 January 2018
by MSSI Secretariat July 14, 2017

July 14, 2017

Hi All - SSR2 (F2F) Meetings in January - Save the Dates (22-24 January 2018) Location: TBD - more information to follow

1 0

SSR2 items to note 14 July
by Jennifer Bryce July 14, 2017

July 14, 2017

Hi all, Please find below items to note from SSR2 leadership call with Co-Chairs today: * The SSR2 plenary call scheduled for 06:00 UTC on Tuesday 18 July has been canceled. * Subtopic groups should work to schedule a Johannesburg follow-up meeting in the coming week to review action items and progress work. I will send a separate note to subtopic groups who have not yet scheduled calls with more information on this. (Please also note that Co-Chairs have requested that staff set up the Doodle polls, for consistency). * Please notify staff off-list if you have upcoming vacation plans that will impact your call attendance. * Please note that SSR2 plenary meeting attendance Fact Sheet as of 30 June has been posted to the wiki here: https://community.icann.org/display/SSR/Fact+Sheet Let me know of any questions and have a great weekend, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Next week
by Denise Michel July 14, 2017

July 14, 2017

Hi All. The co-chairs have canceled next week’s scheduled full Team call to focus on sub-topic group work. Staff will assist with scheduling sub-topic group calls to help advance our focused work agendas. As always, we ask members to also use our email lists to progress work. We’ll re-group the following week on our regularly scheduled call to address our workplan and sub-topic efforts, and receive a presentation. Best, Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

Compliance follow-up to questions from SSR2 RT Meeting
by Karen Mulberry July 13, 2017

July 13, 2017

From: Maguy Serad <maguy.serad(a)icann.org> Thank you for the opportunity to present a briefing on SSR1 Recommendation #10. Below the responses to the questions from the session. Please let me know if I missed anything or if you have more questions. Sincerely, Maguy. Questions: 1. At DNS Symposium in Madrid, a presentation made about SLA indicated that 32 out of the 37 RSP had failed their DNS SLA. Can you please provide more information on this? * Link to the presentation referenced in the question https://www.icann.org/en/system/files/files/presentation-slam-13may17-en.pdf - slide #23. * The ICANN SLA monitoring system triggers automated escalated alerts to registry operators via the ICANN Contractual Compliance ticketing system for DNS and RDDS failures. Upon resolution of the issue, the Compliance team follows up with the registry operator to find out what happened and the registry operator’s remediation. The reasons for failures (and fixes) vary widely. The Compliance team consults with ICANN Technical Services before closing a ticket to ensure the response is sufficient. * Compliance tracks the SLAM alerts by gTLD not by RSP. * The decision to invoke emergency transition of a TLD (EBERO) is made by the EBERO event directors team. Invoking an EBERO event may not be deemed helpful when the impact is low, such as when there are no registrations or when a registry is responsive and addressing the failure. * If you require more information, please send us the question and we can forward it to the ICANN Technical Services team for a follow-up. 1. Regarding WHOIS Bulk submission – what is the use of this tool? * ICANN has 10 approved users; users can submit up to 300 WHOIS Inaccuracy complaints at a time per submission per week. * During May 2017, ICANN processed a total of 154 tickets initiated from the bulk submission user. This information can be found in the monthly dashboard at this link https://features.icann.org/compliance . 1. Recent article about high rate of failure of registrars in an audit conducted by compliance – Share the link to the published report * Link to the published registrar audit report https://www.icann.org/resources/pages/compliance-reports-2016 1. What does compliance do regarding enforcement of registry obligations for CZDS? · (CZDS) Zone File Access by Third Parties via the Centralized Zone Data Service · Compliance receives complaints alleging that registry operators are not responding to requests for zone file or denying/revoking access for reasons not permitted under the registry agreement. · The Registry Agreement is not explicit on when a registry operator must reply to requests for access. ICANN forwards the complaint to the RO and inquires about the pending requests and works toward a resolution of the issue. As for denial or revocation of access, registry operators collaborate with CZDS users to clarify the user’s credentials and usage. However, imposing requirements for access beyond those in the registry agreement and CZDS Terms and Conditions is noncompliant. 1. What actions does compliance take regarding Abuse? * ICANN provided a detailed response on handling of abuse in the response to Annex 1 GAC Communique; the response is at this link https://gacweb.icann.org/display/gacweb/GAC+Correspondence?preview=/2749251… Sincerely, Karen Mulberry Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN

1 0

SSR1 Review team call
by ALAIN AINA July 13, 2017

July 13, 2017

Hello team member, Based on staff availability to support a call for the sub-group next week, i have set up a doodle poll. Please fill it as soon as possible. I know next week is IETF, but lets see what we could do. http://doodle.com/poll/95gsnxzburrvw36f <http://doodle.com/poll/95gsnxzburrvw36f> Thanks —Alain

1 0

Re: [Ssr2-review] [Ext] Re: Item 85: Operating Standards & Templates
by Jennifer Bryce July 13, 2017

July 13, 2017

Hi Denise, The estimated completion date for the Terms of Reference template is 28 July 2017. Jennifer From: Denise Michel <denisemichel(a)fb.com> Date: Wednesday, July 12, 2017 at 2:33 PM To: Jennifer Bryce <jennifer.bryce(a)icann.org>, SSR2 Review Team Email List <ssr2-review(a)icann.org> Subject: [Ext] Re: [Ssr2-review] Item 85: Operating Standards & Templates Thanks, Jennifer. Could you please convey to the author that I gleaned a “yes” to the first part of the question, but I’m not clear on the “when.” Could you please ask them to clarify (preferably in 1 sentence ;) Thanks. Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com> From: <ssr2-review-bounces(a)icann.org> on behalf of Jennifer Bryce <jennifer.bryce(a)icann.org> Date: Wednesday, July 12, 2017 at 5:17 AM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Item 85: Operating Standards & Templates All, Regarding action item 85: “Provide SSR2-RT with information on if ICANN Org will accept Board proposal for a new, template “Terms of Reference in Operating Standards”? If so, when will it be issued?”, please see below for this information from MSSI. Current Status of the Operating Standards: Following public sessions on Operating Standards during ICANN57<https://urldefense.proofpoint.com/v2/url?u=https-3A__icann572016.sched.com_…> and ICANN58<https://urldefense.proofpoint.com/v2/url?u=https-3A__icann58copenhagen2017.…>, and a community webinar<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> in February 2017, ICANN59 saw a presentation<https://urldefense.proofpoint.com/v2/url?u=https-3A__schedule.icann.org_eve…> of ‘options’ on certain issues that will require in-depth community feedback due to the fact that best practices are yet to be established for various processes that came into existence with the new Bylaws, relative to Specific Reviews. These include the selection process of review teams, the setting of the scope, and review teams’ decision-making procedures. Taking all community feedback received so far into account, including from ICANN59, ICANN organization is currently preparing to publish a full draft of the proposed Operating Standards for public comment. We anticipate that during ICANN60 a full draft of the Operating Standards, reflecting the public comments received in the meantime, will be presented and discussed in a cross-community setting. Tools, Templates, Checklists, etc.: Regarding the reference materials, tools, templates, checklists, etc. to assist review teams in their work: The Operating Standards will contain guidelines of how Specific Reviews should operate and, among other things, what is expected of review team members in terms of work contributions, outputs, etc. These tools and templates will be referenced in the Operating Standards but we will house them on a separate website or wiki page. This is because each of these documents is there to support the work of review teams but the teams should have the flexibility to adapt these tools and templates to fit their individual needs. ICANN organization will make these templates and tools available as they are developed and current review teams can leverage these tools in short order. For example, we anticipate that a template for the Terms of Reference will be available for the forthcoming Registry Directory Services (RDS/WHOIS2) and Accountably and Transparency (ATRT3) review teams. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0