April 2019 - Ssr2-review - lists.icann.org

Please provide status for the topics you are working before the call on Thursday
by Russ Housley June 20, 2019

June 20, 2019

Hello. Two weeks ago, the team spent about 40 minutes going through the list of topics and gathering status. The list of topics is here: https://docs.google.com/document/d/1nmPIw-Q6nKI4UdQjAz4KAH83jMU2TIJWncZroWE… Please provide the current status in this Google Doc: https://docs.google.com/document/d/1Xid7AwbUpGRmX8c1TxxCmPF6mKxtdI30pwpEi-x… Just to put all of the links in one place, I include the link to the Q&As as well: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… I look forward to the team call on Thursday. Please provide the status before the call so that we can go through this fairly quickly. Thanks, Russ

5 9

Perform an assessment of ICANN's Information Security Management System.
by Matogoro Jabera May 2, 2019

May 2, 2019

Dear Alain, Dear Noorul, It is my hope that this email will find you doing fine. I am writing as a follow-up on any status regarding our topic - Perform an assessment of ICANN's Information Security Management System. Please let me know if you have something already. Otherwise, I would be happy to write something later today and share it back by next week for your quick review. Regards, -- MATOGORO Jabhera Assistant Lecturer College of Informatics and Virtual Education The University of Dodoma P.O Box 490, Dodoma. Website: www.udom.ac.tz *IEEE Membership ID: 93934185*

4 7

Re: [Ssr2-review] FYI - ICANN DNS Symposium
by Jennifer Bryce May 2, 2019

May 2, 2019

Dear all, Remote participation will be available throughout the DNS Symposium - you can find the Zoom information at the bottom of the page here: https://www.icann.org/ids. Presentations and recordings will also be posted to this page after the event. Best, Jennifer From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Monday, April 29, 2019 at 10:21 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] FYI - ICANN DNS Symposium Hi, All. I was wondering if anyone is attending this symposium: The third ICANN DNS Symposium (IDS 2019) will be held 10-11 May 2019 in Bangkok, Thailand at the Shangri-La hotel. The IDS 2019 is co-locating with the fifth GDD Industry Summit (6-9 May 2019), the Registration Operations Workshop - ROW (9 May 2019) and the DNS OARC meeting (12-13 May 2019). The theme for the ICANN DNS Symposium (IDS) 2019 is: "Understanding the Security, Stability and Resiliency of the Domain Name System". IDS 2019 will focus on emerging technologies, protocols and other issues that may affect the security, stability, or resiliency of the Domain Name System. https://www.icann.org/ids [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_ids&d=Dw…> Hi, Staff. Could you provide us with copies of IDS presentations and let us know if remote participation and recordings will be available? Thanks. Denise Denise Michel denisemichel(a)fb.com<mailto:denisemichel@fb.com>

3 2

ICANN SSR answers
by Jennifer Bryce May 1, 2019

May 1, 2019

Dear Scott, dear Noorul, The below answer in highlight has been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. Please let us know if you have any questions. Review Team volunteers: Scott, Noorul Workstream: ICANN SSR Topic 4: Perform an assessment of how effectively ICANN has implemented its Security Incident Management and Response Processes to reduce (pro-active and reactive) the probability of DNS-related incidents. Outstanding questions: 0 Q: Which certifications is ICANN pursuing for the organisation and staff? A: The certifications undertaken in ICANN are dependent on job function, and on a needs basis. For instance, InfoSec team members and all operations members complete and maintain GIAC SANS security modules. Software engineers are incentivised to undertake Secure Software Development Lifecycle training. ICANN Managed Root Server Team members have and maintain ITIL certifications. And all staff undergo mandatory yearly end user security training that encompasses infosec hygiene practices for end users, and awareness on phishing, spear-phishing, and other social engineering attempts. Q: Which certifications and compliance frameworks has ICANN completed? A: ICANN was following the Center for Internet Security (CIS) controls framework, after selecting 20 controls that best applied to ICANN business and operations. Recently the decision was made to move aware from CIS as it has shortcoming for the type of environment in which ICANN exists. The future framework of choice will be the NIST Cyber Security Framework (CSF) which is a better fit for ICANN and has a higher propensity for increasing the security posture to meaningful levels, inclusive of reviewing processes, for the entire ICANN Org. Work has commenced on building the ICANN Org CSF profile. Q: Who are ICANN’s auditors, what audits are completed regularly? A: Until recently ICANN used Leidos to complete its annual CIS audit. This has now been paused until the CSF work is done within ICANN, and an evaluation on auditors (for the ability to audit against CSF profiles) has been completed. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

SSR2 Technical Writer
by Negar Farzinnia April 30, 2019

April 30, 2019

Dear members of the SSR2 Review Team, As you may be aware, ICANN org has been working diligently, on your behalf, to engage a Technical Writer for the SSR2 Review based on the criteria the SSR2 Review Team identified as required for this role. ICANN org’s due diligence efforts followed ICANN’s standard practice used for other similar assignments. Due diligence included evaluations by our Talent Acquisition and Communications teams. There were 12 candidates submitted for the Temporary Technical Writer assignment. The candidates included individuals referred by the SSR2 Review Team and those sourced by ICANN’s Talent Acquisition team. All candidates were carefully considered based on the job description criteria (see attached). Short-listed candidates were each interviewed by MSSI, Talent Acquisition, and Communications teams to gain a thorough understanding of their experiences vs. the job requirements. We have identified two suitable candidates that could both, potentially, fulfill this role. Please review their resumes (attached) and highlights of their credentials below: Candidate (A): * Over 18 years deep experience in technical writing for both private & public sectors * Master’s Degree * Experience writing for technical & non-technical audiences * Has written contents of various lengths, long reports with footnotes, etc. * Experience traveling internationally, and has held various contract roles for other technical companies. Candidate (B): * Over 18 years of experience in consulting and facilitation * Bachelor’s Degree, relevant technical certifications & membership * Has written strategy articles, including standards and policies * Experience traveling internationally, and has held various contract roles for other technical companies. * Some ICANN experience but not significant enough to outweigh the other candidate’s technical writing skills Both are considered very strong candidate but candidate “A” is recommended due to their superior technical writing skills and experience. Please review this information and provide your selection by 23:59 UTC on Tuesday, 30 April 2019. Both candidates are available to start right away, prepared to travel to Brussels in May and Marrakech in June, and contracting will be completed within a few days after the SSR2 provides their selection. Kind regards, Negar

2 1

FYI - ICANN DNS Symposium
by Denise Michel April 30, 2019

April 30, 2019

Hi, All. I was wondering if anyone is attending this symposium: The third ICANN DNS Symposium (IDS 2019) will be held 10-11 May 2019 in Bangkok, Thailand at the Shangri-La hotel. The IDS 2019 is co-locating with the fifth GDD Industry Summit (6-9 May 2019), the Registration Operations Workshop - ROW (9 May 2019) and the DNS OARC meeting (12-13 May 2019). The theme for the ICANN DNS Symposium (IDS) 2019 is: "Understanding the Security, Stability and Resiliency of the Domain Name System". IDS 2019 will focus on emerging technologies, protocols and other issues that may affect the security, stability, or resiliency of the Domain Name System. https://www.icann.org/ids Hi, Staff. Could you provide us with copies of IDS presentations and let us know if remote participation and recordings will be available? Thanks. Denise Denise Michel denisemichel(a)fb.com<mailto:denisemichel@fb.com>

3 2

DNS cryptography Document
by ALAIN AINA April 29, 2019

April 29, 2019

Hello, Please see attached, the document referred in the subject. Russ and I started it. My mails to Russ (housley(a)vigilsec.com <mailto:housley@vigilsec.com>) are bouncing . Anyone experienced the same thing? Thanks —Alain

2 2

Call summary: SSR2 25 Apr
by Jennifer Bryce April 26, 2019

April 26, 2019

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #67, 25 April at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/ehNIBg. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 2

Re: [Ssr2-review] [Ext] Compliance Call
by Jennifer Bryce April 25, 2019

April 25, 2019

Hi Laurin, Thanks for this - acknowledging receipt. Also copied the SSR2 list for transparency. Best, Jennifer -----Original Message----- From: "Weissinger, Laurin" <laurin.weissinger(a)yale.edu> Date: Thursday, April 25, 2019 at 4:25 PM To: Jennifer Bryce <jennifer.bryce(a)icann.org> Subject: [Ext] Compliance Call Hi Jennifer, Thank you for facilitating the call with Compliance, which we would like to have by May 3 if possible (that failing, as soon as possible) to provide time for Compliance to follow-up with information prior to our Brussels meeting. The areas of questions / issues we would like to discuss with Compliance are listed below. Considering the number of issues to be addressed, we need at least one hour, preferably 90 mins. Team members to join: Denise, Kerry-Ann, KC, Norm, Laurin • Tell us about Compliance’s access to, and use of, WHOIS. • Tell us about Compliance’s approach with contracted parties that have systemic ‘overwhelming rates of abuse.’ • Tell us about the volume over the last few years of enforcement actions and how Compliance has selected auditing and enforcement targets. • Describe how issues are flagged, how Compliance proceeds with contracted parties and complainants, and what your main obstacles and challenges are when dealing with violations. • What parts of the contracted party agreements that Compliance audits and enforces do you think are effective in supporting DNS security, stability and resiliency? • What part of these contracts do you think hinder Compliance in any way from effectively addressing the levels of abuse involving contracted parties? Note: this call is meant to be discussion-heavy, not just a question-answer session. With many thanks and best wishes Laurin

1 0

ICANN DNS Symposium 2019
by ALAIN AINA April 25, 2019

April 25, 2019

Hello, I remembered we discussed colocating our face-face meeting with the IDS2019, but not sure, we knew about the theme of the IDS2019. The theme is so related to our work and i wonder how we contribute to this and how the outcomes of this can be applied our work. === https://www.icann.org/ids The theme for the ICANN DNS Symposium (IDS) 2019 is: "Understanding the Security, Stability and Resiliency of the Domain Name System". IDS 2019 will focus on emerging technologies, protocols and other issues that may affect the security, stability, or resiliency of the Domain Name System. ========== Anyone from the team attending ? —Alain

1 0