July 2017 - Ssr2-review - lists.icann.org

Re: [Ssr2-review] Item 68: L Root Question
by Denise Michel July 12, 2017

July 12, 2017

Thanks, Steve. Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com On 7/11/17, 12:22 PM, "ssr2-review-bounces(a)icann.org on behalf of Steve Conte" <ssr2-review-bounces(a)icann.org on behalf of steve.conte(a)icann.org> wrote: Greetings all, In response to the question on open item 68: "What measures are undertaken by ICANN for the anycast deployment for L-Root to ensure physical and network security and stability." Please see the response below: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- SSR measures undertaken by ICANN for the anycast deployment of the root server operated y ICANN can be considered on two axis, Structured activities, and technical considerations. The ICANN DNS Engineering department undertakes two structured activities directed at operational security matters, they are: - ICANN DNS Engineering engages in an annual table-top exercise with other root server operators to test its global operational readiness to security or attack events. - ICANN DNS Engineering have commenced an annual security review where a 3rd party security firm is contracted to perform a range of penetration tests targeting all facets of L-Root operations. Technical considerations cover actions applied to all ICANN root server anycast instances. All L-Root instances have access control lists applied to the interfaces in a stateless mode that: - only permits access from the greater internet to the public service addresses for the necessary ports on the expected protocols (eg 2001:500:9f::42, port 53, TCP and UDP) - restrict all traffic to/from the management interfaces to ICANN management networks Additionally, all L-Root instances: - follow a plan and process to update all hardware before it reaches 5 years of age - follow a policy that all hardware is under either a 3 year or 5 year, next business day, support contract from the hardware vendor (when supported by the vendor in the particular country where the instance is located) - have internal and external monitoring of the L-Root service AS number - have internal and external monitoring of the L-Root service on all necessary protocols and service addresses - are monitored for access activity, network uptime and performance, and system uptime and performance - implement the appropriate recommendations from BCP38 and RFC7454. Given ICANN anycast deployments come in two forms. 1) Anycast instances operated by ICANN and hosted by contracted parties. 2) Anycast instances operated and hosted by ICANN SSR measures for these two deployment forms differ slightly 1. Anycast instances operated by ICANN and hosted by contracted parties. For all L-Root instances hosted by contracted parties the following conditions are placed on the host, by contract. - provide connectivity for network traffic for the DNS service interface in such a way to achieve high availability; - provide connectivity for network traffic for the remote management interface in such a way to achieve high availability; - provide physical security with no history of breaches within the last 12 months, which may be monitored and adjusted by ICANN from time to time; - provide suitable power and cooling, which may be monitored and adjusted by ICANN - ensure access to the Equipment to is restricted to no other individuals than an ICANN representative or an authorised employee of the contracted organisation - ensure the contracted organisation access the Equipment only as directed by ICANN - notify ICANN should any security, power or cooling arrangements be changed 2. Anycast instances both operated and hosted by ICANN These anycast instances are maintained in ICANN controlled cages in data-centers that have been inspected by ICANN Staff and meet the following access security and infrastructure requirements: - require photographic government issued ID for access - premises are manned by security personnel 24x7 - pre-authorisation is required for access - key or pin-code access into ICANN caged areas - 24x7 monitoring and recording of access - equipment entering or leaving the facility is vetted and checked with ICANN staff - full UPS power on all circuits - power supply redundancy including on-site generators. - robust and redundant heating, ventilation, and air conditioning (HVAC) systems Network connectivity at these anycast locations is via multiple redundant upstream connections and the providers of these services are contracted directly to ICANN, and as such changes can only be implemented by authorised ICANN staff. ----- Steve Conte steve.conte(a)icann.org _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_l…

1 0

Board SSR2 Caucus details
by Kaveh Ranjbar July 12, 2017

July 12, 2017

Dear SSR2 Review Team, In line with best practice experience from the Transition-related work, Board Caucus Groups have been formed as a mechanism for the Board to provide input to Specific Review Teams on the scope of work, feasibility of recommendations and other key matters. These Caucus groups are small groups of Board members with expertise and interest in the particular Review-related topics. The goal is to create an interactive environment where the Board can engage with the Review Teams to offer input and observations for Review Teams’ consideration on a timely basis, via the Board Caucus Group. To that end, the Board Caucus Group for SSR2 Review has been formed, consisting of George Sadowsky, Lito Ibarra, Ram Mohan, Rinalia Abdul Rahim, Steve Crocker and myself. It is important to highlight that the formation of the Caucus Groups is the Board’s internal method of conducting their work and not only are all of the final results seen and reviewed by the full Board but also the full Board stands behind the Caucus Group’s work. Any response or feedback provided to the Review Teams is the Board’s response and not the Caucus Groups. Thank you for your dedicated efforts. All the best, Kaveh.

2 1

Item 85: Operating Standards & Templates
by Jennifer Bryce July 12, 2017

July 12, 2017

All, Regarding action item 85: “Provide SSR2-RT with information on if ICANN Org will accept Board proposal for a new, template “Terms of Reference in Operating Standards”? If so, when will it be issued?”, please see below for this information from MSSI. Current Status of the Operating Standards: Following public sessions on Operating Standards during ICANN57<https://icann572016.sched.com/event/8czm/operating-standards-workshop-to-so…> and ICANN58<https://icann58copenhagen2017.sched.com/event/9nn7/icann-review-operating-s…>, and a community webinar<https://community.icann.org/display/OSFR/21+February+2017> in February 2017, ICANN59 saw a presentation<https://schedule.icann.org/event/B3zk/review-of-icann-process-documentation…> of ‘options’ on certain issues that will require in-depth community feedback due to the fact that best practices are yet to be established for various processes that came into existence with the new Bylaws, relative to Specific Reviews. These include the selection process of review teams, the setting of the scope, and review teams’ decision-making procedures. Taking all community feedback received so far into account, including from ICANN59, ICANN organization is currently preparing to publish a full draft of the proposed Operating Standards for public comment. We anticipate that during ICANN60 a full draft of the Operating Standards, reflecting the public comments received in the meantime, will be presented and discussed in a cross-community setting. Tools, Templates, Checklists, etc.: Regarding the reference materials, tools, templates, checklists, etc. to assist review teams in their work: The Operating Standards will contain guidelines of how Specific Reviews should operate and, among other things, what is expected of review team members in terms of work contributions, outputs, etc. These tools and templates will be referenced in the Operating Standards but we will house them on a separate website or wiki page. This is because each of these documents is there to support the work of review teams but the teams should have the flexibility to adapt these tools and templates to fit their individual needs. ICANN organization will make these templates and tools available as they are developed and current review teams can leverage these tools in short order. For example, we anticipate that a template for the Terms of Reference will be available for the forthcoming Registry Directory Services (RDS/WHOIS2) and Accountably and Transparency (ATRT3) review teams. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Just landed
by Gannon, James-1 July 11, 2017

July 11, 2017

Hi guys sorry I just landed won't b back home for another 30 mins apologies Sent from my iPhone Novartis Ireland Ltd. Registered No. 11931, Ireland. Registered Office: The Vista Building, Elm Park Business Park, Merrion Road, Dublin 4. DO4 A9N6, Ireland. Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

3 2

Re: [Ssr2-review] [EXT] Re: Just landed
by Barrett, Kerry-Ann July 11, 2017

July 11, 2017

Hi team Was in transit in Chicago and got the time mixed up. Apologies and I will be back on my game as of next week. Sincerely, Kerry-Ann > On Jul 11, 2017, at 4:53 PM, Karen Mulberry <karen.mulberry(a)icann.org> wrote: > > Not a problem we will postpone your update to the next call > > > Karen Mulberry > Multistakeholder Strategy and Strategic Initiatives (MSSI) > ICANN > > > > On 7/11/17, 3:51 PM, "ssr2-review-bounces(a)icann.org on behalf of Gannon, James-1" <ssr2-review-bounces(a)icann.org on behalf of james-1.gannon(a)novartis.com> wrote: > > > Hi guys sorry I just landed won't b back home for another 30 mins apologies > Sent from my iPhone > > Novartis Ireland Ltd. > Registered No. 11931, Ireland. > Registered Office: The Vista Building, Elm Park Business Park, Merrion Road, Dublin 4. DO4 A9N6, Ireland. > > Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review > > > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

Connectivity - for SSR2 Meeting Call - Tuesday, 11 July 2017 @ 21:00 UTC
by MSSI Secretariat July 11, 2017

July 11, 2017

Hello SSR2 Review Team - Good day. I just wanted to touch base regarding connectivity for our next SSR2 Meeting Call scheduled for Tuesday, 11 July 2017 @ 21:00 UTC. We have conquered many of the noise disturbances previously present and would like to ensure continued connectivity on future calls. For the best results in regions with connectivity, we suggest doing the following... * Connect to the Adobe Connect (https://participate.icann.org/ssrreview) 20-30 minutes before the scheduled call - the Adobe Connect room will be open and I will be available to assist you - in addition we can resolve any microphone/static/connection issues ahead of time - including connecting with international operators if need be. The goal is to have all connection concerns resolved by the top of the hour for the benefit of the team. * Be located (if possible) in an area that has proper broadband connection and is quiet - thus creating a strong signal connection, making it possible to see and hear in the Adobe Connect Room. * Feel free to Skype me either before, during or after the call - my skype address is yvette.guigneaux.icann - this way I can respond to you almost immediately for whatever you may need - including having the Adobe Connect Room dial out to you if need be. As your SSR2 Review Team Secretariat, I am determined to create an atmosphere where you can clearly participate in the Adobe Connect Room. Thank you everyone and I look forward to seeing you all on our upcoming call. :) Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FA1B.82CD2870]

1 0

Subgroup admin & action items tracking
by Jennifer Bryce July 11, 2017

July 11, 2017

Dear all, To help progress the subgroup work please find below: * Subtopic email addresses and Adobe Connect room information. * As with the regular plenary calls the adobe connect information will be included in any subgroup meeting invites that are sent. * Please let us know if you want to be added to any of the distribution lists. * Proposed times for subgroup calls, based on staff support availability. * Please discuss within your groups when you would like to have regular calls. * Could the rapporteur from each group please advise us on the preferred slot and we will help set up the meetings. * Please also note that the action/request tracking tool that was presented in Johannesburg is now live. You can find it here: https://community.icann.org/display/SSR/Tracking+Tool. * Action items for each subgroup are recorded on the wiki pages of each group. Links to the wiki pages are in the table below. Let me know if you have any questions. Thanks! Subgroup & wiki page link Email list Adobe Connect Room Review Team recipients SSR1 Review<https://community.icann.org/display/SSR/Subtopic+%231+-+SSR1+Review> SSR1implementation-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_ssr1review Alain, Ram Krishna, Denise, Eric, Emily ICANN SSR<https://community.icann.org/display/SSR/Subtopic+%232+-+ICANN+SSR> ICANNsecurity-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_icannssr James, Boban, Noorul, Denise, Kerry-Ann, Žarko, Eric, Emily DNS Security<https://community.icann.org/display/SSR/Subtopic+%233+-+DNS+Security> DNSsecurity-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_dnssecurity<https://participate.icann.org/SSR2_dnssecurrity> Emily, Alain, Cathy, Matogoro, Ram Krishna, Žarko, Geoff, Amin, Don, Eric, Denise Future Challenges <https://community.icann.org/display/SSR/Subtopic+%234+-+Future+Challenges> Futurechallenges-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_futurechallenges Emily, Kerry-Ann, Matogoro, Amin, Eric, Noorul, Denise IANA Transition<https://community.icann.org/display/SSR/Subtopic+%235+-+IANA+Transition> IANAtransition-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_ianatransition Cathy, James, Eric, Geoff, Emily, Denise Available times (UTC) for subgroup calls Wednesday Thursday 14:00 14:00 - 17:00 21:00 21:00 -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2-RT Slide Deck for Plenary #18
by Karen Mulberry July 10, 2017

July 10, 2017

Attached is the presentation for tomorrow’s SSR2-RT Plenary meeting. Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

1 0

SSR1 recommendations sub-group
by ALAIN AINA July 10, 2017

July 10, 2017

Dear SSR1 team (Denise,RAM,Eric), While waiting for the Mailing list for the sub-group, let me set the scene here. The SSR1 recommendations are classified in the 5 following categories: - SSR Framework =============== #1,#7,#8,#11,#17,#18,#19,#20,#21,#22 - SSR Relationships to Support ICANN’s Work ================================== #4,#5 - Compliance =========== #10 - ICANN’s SSR Role & Remit Within It’s Limited Mission ========================================= #2,#3,#9,#24,#25,#26,#27 - SSR Community Outreach & Info Sharing–Security Threats & Mitigation ======================================================= #6,#12,#13,#14,#15,#16,#23,#28 A quick counting shows: SSR1 recommendations we’ve been briefed about before last face to face : #1,#4,#5,#14,#15,#16,#18,#19, #24,#28 Briefed about at last face to face #2,#7,#8,#9,#17,#20,#21,#22 Plan for the call tomorrow: #10 Others #3.#6.#11,#12,#13,#23,,#25,#26,#27 Before we start working on the recommendations starting with the ones the briefings have been completed, i would like to set a doodle poll for a call to: 1- Finalize the work items 2- Agree on methodology 3- Set timelines 4 -AoB Before then, please review the work items and indicate which ones are out of scope, which ones are missing. The floor is yours. Silence means agreement :-) —Alain

1 0

Work plan (draft) Sub Team 2 – ICANN Security
by Boban Krsic July 9, 2017

July 9, 2017

Dear All, Please find attached a first draft of a work plan for subteam 2 - ICANN Security. I propose, that the basis for further development should be a gap analysis (without any obligations to certify something) based on the following two industrial standards: ISO/IEC 27001:2013 Information Security Management Systems (ISMS) and ISO 22301:2012 Business Continuity Management Systems (BCMS). With the use of both standards, we should be able to address all relevant work items that we identified in Madrid. For the beginning, I have created a simple MS Excel that consists all relevant information for project planning and realization of the gap analysis. The file contains a total of four sheets: * Sheet1 (Workplan) contains the main key action steps, a description of the action, expected outcome, evaluation methodology, required skill set, responsible person, proposed timeline, and finally a reference to Madrid’s work item list. The list is not finished and needs to be completed. * Sheet2 (Checklist 27001) contains 32 questions to address all relevant requirements of the main part of a ISMS based on ISO/IEC 27001. With the checklist, we are able to evaluate the following category groups: * Scope, relevant parties (stakeholder) * Leadership, roles and responsibilities * Risk management and risk treatment * Resources, competence, awareness and communication * Performance evaluation, internal audit and management review * Improvement of the ISMS * Sheet3 (Checklist 27001 – Annex A) contains a list of 114 questions based on the Annex A of ISO/IEC 27001. It is a list of security controls (or safeguards) that are to be used to improve security of information. The controls are structured, and the purpose of each of the 14 sections from Annex A [1]: * Information security policies - controls how to write and review policies * Organization of information security – controls on how the responsibilities are assigned * Human resources security – controls affecting the employment * Asset management – controls related to inventory of assets and acceptable use, also for information classification and media handling * Access control – controls for Access control policy, user access management, system and application access control, and user responsibilities * Cryptography – controls related to encryption and key management * Physical and environmental security – controls defining secure areas, entry controls, protection against threats, equipment security, secure disposal, clear desk and clear screen policy, etc. * Operational security – lots of controls related to management of IT production: change management, capacity management, malware, backup, logging, monitoring, installation, vulnerabilities * Communications security – controls related to network security, segregation, network services, transfer of information, messaging, etc. * System acquisition, development and maintenance – controls defining security requirements and security in development and support processes * Supplier relationships – controls on what to include in agreements, and how to monitor the suppliers * Information security incident management – controls for reporting events and weaknesses, defining responsibilities, response procedures, and collection of evidence * Information security aspects of business continuity management – controls requiring the planning of business continuity, procedures, verification and reviewing, and IT redundancy * Compliance – controls requiring the identification of applicable laws and regulations, intellectual property protection, personal data protection, and reviews of information security * Sheet4 (Checklist 22301) similar to sheet1 but with a focus on Business Continuity Management. The checklist contains a list of 90 questions to address all relevant requirements of a BCMS based on ISO 22301. With the checklist, we are able to evaluate the following category groups: * Scope, supply chain, l&r requirements and assurance * Leadership, roles and responsibilities * Risks and opportunities * Business continuity objectives and plans to achieve them * Human resources, competence and training and awareness * Communication and documentation * Operational planning and control * Business Impact Analysis (BIA) and Risk Assessment * Business continuity strategy / Resource recovery strategy * Incident response structure * Business continuity plans * Monitoring, measurement, analysis and evaluation * Internal audit and management review * Improvement of the BCMS I am using a similar list for my annually internal audits at DENIC. Altogether I would expect a total effort of approx. 15-20 m/d to perform key action steps 1.0 and 2.0. External consultants are also possible and in my view a good option. Jennifer, it would be great if you could import the file to google docs and share the link for editing purposes. Any feedback on this would be great. Regards, - Boban. [1]https://advisera.com/27001academy/knowledgebase/overview-of-iso-270012013… -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main

3 7