November 2018 - Ssr2-review

ACTION: Review work plan
by Jennifer Bryce Nov. 12, 2018

Nov. 12, 2018

Dear SSR2 RT members, The latest version of the work plan is attached. Please check over and raise any objections or edits on-list by 17:00 UTC on Friday 8 November. As noted on the call, unless objections are raised by the above date, this work plan will be considered to be adopted by the review team, and is the version that will be sent to the Board, SO/ACs, posted to the wiki. Note the intro text to the attached work plan states: “The Second Security, Stability, and Resiliency of the Domain Name System (SSR2) Review Team was confirmed in February 2017 and held its first Plenary meeting in March 2017. Its work was suspended by the ICANN Board in October 2017, and restarted in June 2018. This work plan subsequently was updated to reflect the work of SSR2 Review Team post-suspension, and previous work plans are archived on the SSR2 wiki. This work plan serves as a guide developed by the SSR2 Review Team as a plan for its work for the review focusing on key areas for research and discussion and related milestones to be achieved during the review process. The work plan is expected to evolve with the Review Team's work and will be updated as the work progresses. Dates reflect a typical Review lifecycle, but are to be adjusted by the Review Team, based upon their agreed-upon scope and the effort required to address highest-priority objectives within available budget and time.” Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

8 8

Call summary: SSR2 8 November
by Jennifer Bryce Nov. 9, 2018

Nov. 9, 2018

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #50, 8 November at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki at: https://community.icann.org/x/chu8BQ. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

final call for feedback on restructuring SSR substream 3&4
by k claffy Nov. 8, 2018

Nov. 8, 2018

please send any objections by tuesday for email discussion before we declare consensus on this bit and move on. if there are objections that are not resolved by email, please join the call next week to air them, otherwise we'll proceed with the plan below. we're also interested in volunteers to be on this subteam 3, as suggested below. (From last week's mail, so you've hopefully already read ;) ) > 1) review of WorkStream 4 subtopics with an eye toward potentially > integrating some of them into WorkStream 3 > > Eric and I jsut took a pass over that; the result is some > strikethrough on the current version of WorkStream 4 in the > "Working Document SSR2 topics": > https://docs.google.com/document/d/1Eaj92r_ZbGBqO-2t3-tJv4Teqtix20Dly7C14XK… > to be discussed tomorrow before we actually move them into > Workstream 3 (or delete). > > > 2) Integrate geoff's distillation of salient points re DNS SSR > from his meeting with ICANN (Kim Davies): > https://docs.google.com/document/d/1KWvdcZ2g8hBxUzvzPqgzVmsT4RZ5CbIo-N2IpUU… > and integration of relevant material into Workstream 3. > > As far as I'm concerned, all of these topics should be folded into > WorkStream 3, though the formats of the two documents currently differ > so I'm not inclined to just cut and paste. If the larger team > considers this appropriate, the sub-team for this workstream wilil > take it as an action item for next week (or realistically it might > take two weeks, i'm fully booked next week). anyone interested in > being on this subteam should speak up in the next week or two. thanks, k

1 0

Barcelona meeting blog post -- final review
by Denise Michel Nov. 8, 2018

Nov. 8, 2018

Dear Team members: The attached, updated version of the blog includes additional edits by Matogoro and Laurin. Please raise any additional edits via email today or on our Team call. The blog will be sent for posting tomorrow by 8 Nov, 18:00 UTC. Thanks. Denise Denise Michel Director, Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

2 1

Re: [Ssr2-review] Post-Barcelona SSR2 blog
by Barrett, Kerry-Ann Nov. 7, 2018

Nov. 7, 2018

Thanks Jennifer. [OAS.org]<http://www.oas.org/> Kerry-Ann Barrett Cybersecurity Program Officer Secretariat of the Inter-American Committee against Terrorism (CICTE) Secretariat for Multidimensional Security (SMS) Organization of American States 1889 F Street NW Washington D.C. 20006 [http://www.oas.org/en/sms/signature_images/phone.png] (202) 370 4675 - [http://www.oas.org/en/sms/signature_images/fax.png] (202) 458 3857 www.oas.org/cyber<http://www.oas.org/cyber> @KerryOAS<https://twitter.com/KerryOAS>| @OEA_Cyber<https://twitter.com/OEA_Cyber> Register to our distribution list here!<http://oas.us11.list-manage.com/subscribe?u=353ff0663258ae5a775d460db&id=10…> From: Ssr2-review [mailto:ssr2-review-bounces@icann.org] On Behalf Of Jennifer Bryce Sent: Tuesday, November 6, 2018 6:09 AM To: SSR2 <ssr2-review(a)icann.org> Subject: [EXT] [Ssr2-review] Post-Barcelona SSR2 blog Dear SSR2 RT members, For your information, please find attached the post-Barcelona review team blog, as reviewed by the leadership team. We will schedule this for posting to icann.org in the coming days and will share the link once published. If you have any concerns, please share them here as soon as possible. Thanks, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org> Skype: jennifer.bryce.icann www.icann.org<http://www.icann.org>

1 0

Please prepare for the plenary call on Thursday
by Russ Housley Nov. 6, 2018

Nov. 6, 2018

I hope everyone had an uneventful trip home from Barcelona. This week, there are three areas that need your attention for the call on Thursday. 1) Laurin added text into the SSR1 Google Doc for Recommendation 4. Please review it. Please raise any issues or concerns on the mail list. See https://docs.google.com/document/d/1qUxV4L-gS5xHmC4QQPGRk81MgQuhQvsbnEU7xxe… 2) In Barcelona we talked abut the topics in the Internal Facing work stream. See https://docs.google.com/document/d/1Eaj92r_ZbGBqO-2t3-tJv4Teqtix20Dly7C14XK… and https://community.icann.org/display/SSR/Subgroup+%232+-+ICANN+SSR Before the pause, there was a lot of information collected here: https://trello.com/b/5Eu1ppuv/ssr2-subtopic-2-icann-ssr Please review this material. Are there any questions we need to ask? We will need volunteers to start writing text. Please be ready to volunteer for some writing. 3) In Barcelona KC agreed to propose a set of topics for the External Facing work stream. It will be a merge of several working documents. KC said that she would send something out on Wednesday. Please review it when it comes to your mailbox. Think about what information needs to be gathered to cover those topics. Thanks, Russ

4 7

Work Plan
by Weissinger, Laurin Nov. 6, 2018

Nov. 6, 2018

Dear all, Naveed proposed some deadline changes last week and has now entered them into the work plan document. Furthermore, Jennifer has deleted most of the WS5 (IANA) elements, as agreed in Barcelona. Things to do before our call on Thursday: 1. Confirm that the deadlines we set are appropriate now 2. Please check the percentages behind the relevant tasks. Make sure that they reflect our status. 3. If you have any other concerns, please raise them via email to list _before_ the call. Please keep in mind that these work plans are generally understood as "in flux" by the ICANN community. This work plan obviously matters and is important — but we can adjust it as required in the future. With many thanks Laurin

1 0

SSR2 Plenary Meetings UTC time update
by MSSI Secretariat Nov. 6, 2018

Nov. 6, 2018

Dear SSR2 RT, Daylight savings time has now come to an end globally. At the request of the leadership team, we will be moving the review team plenary calendar invite to 15:00 UTC. Please let us know if you have any concerns. With kind regards, Brenda --- Brenda Brewer, Projects & Operations Assistant Multistakeholder Strategy & Strategic Initiatives (MSSI) Internet Corporation for Assigned Names and Numbers (ICANN) Skype: brenda.brewer.icann

1 0

Post-Barcelona SSR2 blog
by Jennifer Bryce Nov. 6, 2018

Nov. 6, 2018

Dear SSR2 RT members, For your information, please find attached the post-Barcelona review team blog, as reviewed by the leadership team. We will schedule this for posting to icann.org in the coming days and will share the link once published. If you have any concerns, please share them here as soon as possible. Thanks, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Re: [Ssr2-review] [EXT] Re: Please prepare for the plenary call on Thursday
by Barrett, Kerry-Ann Nov. 5, 2018

Nov. 5, 2018

HI Alain Unfortunately for me, it was difficult to follow which text was yours and which was previously written because of the text format. But I did understand your concerns from previous emails. What I think will happen is when we start to compile the final report we will be able to record what areas we think we were not able to do a sufficient review and maybe recommend follow up by the next SSR 3 (if the issue is still current/relevant). We will also be able to fine tune as well the language of our conclusions. I think we could also flag your email as a reference to ensure we addressed concerns raised below as well (which I have been following in previous and this email thread). Kerry-Ann Barrett Cybersecurity Program Officer Secretariat of the Inter-American Committee against Terrorism (CICTE) Secretariat for Multidimensional Security (SMS) Organization of American States 1889 F Street NW Washington D.C. 20006 (202) 370 4675 - (202) 458 3857 www.oas.org/cyber @KerryOAS| @OEA_Cyber Register to our distribution list here! -----Original Message----- From: Ssr2-review [mailto:ssr2-review-bounces@icann.org] On Behalf Of ALAIN AINA Sent: Monday, November 5, 2018 6:02 AM To: ICANN SSR2 <SSR2-review(a)icann.org> Subject: [EXT] Re: [Ssr2-review] Please prepare for the plenary call on Thursday Hello, > On 1 Nov 2018, at 23:39, Russ Housley <housley(a)vigilsec.com> wrote: > > >> On Nov 1, 2018, at 4:36 AM, ALAIN AINA <aalain(a)trstech.net> wrote: >> >> I still think the methodology we used for the assessment of the implementation of the 28 recommendations is not very suitable. We ended the following conclusions: >> >> 1- most of the recommendations are vague and not measurable and sometimes not implementable >> 2- we have not seen evidence of implementation and effect, and so the recommendation has not been fully implemented, effect can’t be measured, etc... >> >> on 1) we will have at some point, to review the board actions on the 28 recommendations and respond to certain aspects in our assessment. >> >> https://www.icann.org/resources/board-material/resolutions-2012-10-18-en#1.e >> >> On 2) we have not agreed on all documents or evidences required for our assessment. We shall also factor in the fact that the organisation has evolved over the years. The recommendations were issued on 2012, and implemented throughout up to 2017 and we are reviewing the impact in 2017/2018. >> >> the SSR framework and the implementation of some of the recommendations have influenced the Strategic plan and Operation plan and the 5 years operating plan regularly updated, have KPIs for programs to y19 and y20 which are SSR related. >> >> >> Most of the impact of the implementation in my opinion are to be investigated in strategic objectives and their implementation through activities portfolio throughout the years. We shall measure the impact from the KPI and deliverable in the OP, Annual report and also how SSR inputs and influences the strategic/ operation plannings and the prioritisation of the activities and projects. Engage with Staff, board and any other affected parties or constituencies by the recommendations. >> >> >> On the specifics. >> >> For example we claimed that definition of security in the registry agreement differs from the one published in the SSR framework, added to the ICANN glossary and supposed to be used in all materials. >> >> But, section 7.3 of the registry agreement does not define “security”, or “stability” but define what “effect on them mean or refer to" >> >> ====== >> >> (a) For the purposes of this Agreement, an effect on “Security” shall mean >> >> (1) the unauthorized disclosure, alteration, insertion or destruction of registry data, or (2) the unauthorized access to or disclosure of information or resources on the Internet by systems operating in accordance with all applicable standards. >> >> >> (b) For purposes of this Agreement, an effect on “Stability” shall refer to >> >> (1) lack of compliance with applicable relevant standards that are authoritative and published by a well-established and recognized Internet standards body, such as the >> >> ======= >> So using this example to justify a breach in the implementation of the recommendation is not appropriate in my opinion. > > Alain: > > The Bylaws say: > > (iv) The SSR Review Team shall also assess the extent to which > prior SSR Review recommendations have been implemented and the extent > to which implementation of such recommendations has resulted in the > intended effect. > > I think we have done what the Bylaws require. We are in full agreement on the task list as per the bylaws, especially on the SSR1 recommendations. I assumed it is still work in progress as you asked for comments/discussions. > > Some actions were taken to implement each of the recommendations. The write-up summarizes those actions. We concluded that some recommendations were not fully implemented, while staff concluded that they were all fully implemented. This would call for reviewing board/staff understanding of the recommendations, the implementation plan and actions taken to implement to eventually determine where the gap is. > > We made an assessment regarding whether those actions "resulted in the intended effect.” my main concern in this thread is about how this assessment was made. It needs a more structured approach than going through responses to some questions to staff and through some random documentation. > > In some cases, we have follow-on recommendations. > > We agreed that the wording of many SSR1 recommendations were not measurable, SSR1 like SSR2 is an “review” and i would say a ”high level review”, from which recommendations may not be directly measurable, as they affect strategic thinking/planning and operations of the organisation and/or the ecosystem. This is my last communication of the topic and as Boban suggested, would be good to hear what the team’s thoughts are about these points. Thanks —Alain > and we agreed to two things: > 1) Include some text regarding the situation. Your words above seem like a good strawman. > 2) When we write our recommendations, we will make sure that they are measurable. > > Russ > _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

1 0