April 2019 - Ssr2-review - lists.icann.org

SSR2 agenda 25 April
by Jennifer Bryce April 25, 2019

April 25, 2019

Dear SSR2 RT members, Here is the agenda for the next SSR2 plenary call, scheduled for Thursday 25 April at 14:00 UTC. 1. Welcome, roll call, SOI updates 2. Finalize the list of questions for discussion with ICANN Compliance 3. Review items that are red, yellow or blank on status table [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>, determine roadblocks and potential workarounds 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

4 5

Re: [Ssr2-review] [EXT] SSR2 agenda 25 April
by Barrett, Kerry-Ann April 25, 2019

April 25, 2019

HI Team I will not be able to join the call tomorrow as Im in transit from Chile. Apologies in advance. Kind Regards Kerry-Ann Barrett Cyber Security Policy Specialist Organization of American States From: Jennifer Bryce<mailto:jennifer.bryce@icann.org> Sent: Wednesday, April 24, 2019 4:22 AM To: ssr2-review(a)icann.org<mailto:ssr2-review@icann.org> Subject: [EXT] [Ssr2-review] SSR2 agenda 25 April Dear SSR2 RT members, Here is the agenda for the next SSR2 plenary call, scheduled for Thursday 25 April at 14:00 UTC. 1. Welcome, roll call, SOI updates 2. Finalize the list of questions for discussion with ICANN Compliance 3. Review items that are red, yellow or blank on status table [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>, determine roadblocks and potential workarounds 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [Ext] Re: ICANN SSR and Future Challenges answers
by Jennifer Bryce April 23, 2019

April 23, 2019

Dear Boban, Thanks for this - we have asked the follow-up question and will provide the answer once available. Best, Jennifer -----Original Message----- From: Boban Krsic <krsic(a)denic.de> Date: Sunday, April 21, 2019 at 11:16 AM To: Jennifer Bryce <jennifer.bryce(a)icann.org> Cc: "zarko.kecic(a)rnids.rs" <zarko.kecic(a)rnids.rs>, "housley(a)vigilsec.com" <housley(a)vigilsec.com> Subject: [Ext] Re: [Ssr2-review] ICANN SSR and Future Challenges answers Dear Jennifer, On 12.04.19 19:09, Jennifer Bryce wrote: > Q: Does ICANN have documented boundaries and processes that have inter-org dependencies? Are they relate back to BC plans? > a. Clarification requested from Boban, Alain, Zarko: What is meant by “inter-org” dependencies? Which orgs? What is meant by “boundaries.” This refers to the interaction and trust boundaries within the two organizations ICANN and PTI. > b. ICANN org has asked for clarification as to the meaning of this question, and is awaiting a response. That said, based on current understanding, ICANN org thinks the answer is no, not beyond the shared services agreement between ICANN and PTI. re: ICANN SSR workstream / DNS SSR Workstream Q from ICANN SSR workstream: Does ICANN have a documented business continuity operational planning and control process that enables it to determine, plan, implement and control those actions needed to fulfil its business continuity policy and objectives? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. Just for clarification in re to DNS SSR Workstream: Does the DR Plan also include Root Zone Management? Thanks and Happy Easter - Boban

2 1

Call summary: SSR2 18 Apr
by Jennifer Bryce April 18, 2019

April 18, 2019

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #66, 18 April at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/dBNIBg. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2 agenda 18 April
by Jennifer Bryce April 18, 2019

April 18, 2019

Dear SSR2 RT members, Here is the agenda for the next SSR2 plenary call, scheduled for Thursday 18 April at 14:00 UTC (reminder that this meeting and those going forward will be on Zoom and not Adobe Connect). 1. Welcome, roll call, SOI updates * Upcoming face-to-face meetings: Please complete Doodle poll to indicate your attendance in Brussels and Marrakech: https://doodle.com/poll/evk98zqk7gvbzsxp 2. Develop list of questions for discussion with ICANN Compliance (meeting to be scheduled) 3. Review items that are red or blank on status table<https://docs.google.com/document/d/1Xid7AwbUpGRmX8c1TxxCmPF6mKxtdI30pwpEi-x…> to determine roadblocks and potential workarounds 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 2

ACTION REQUESTED: SSR2 Doodle Poll
by MSSI Secretariat April 16, 2019

April 16, 2019

Dear SSR2 Members, Please see doodle poll; https://doodle.com/poll/evk98zqk7gvbzsxp and provide your availability to attend upcoming Face to Face meetings. The doodle poll will close at 23:59 UTC tomorrow, 17 April and results will be shared on Thursday’s plenary call. With kind regards, Brenda --- Brenda Brewer, Projects & Operations Assistant Multistakeholder Strategy & Strategic Initiatives (MSSI) Internet Corporation for Assigned Names and Numbers (ICANN) Skype: brenda.brewer.icann

1 0

ICANN SSR and Future Challenges answers
by Jennifer Bryce April 12, 2019

April 12, 2019

Dear SSR2 RT members, The below answers has been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. Please let us know if you have any questions. Review Team volunteers: Boban, Alain, Žarko Workstream: ICANN SSR Topic 2: Perform an assessment of ICANN's Business Continuity Management System. Outstanding questions: 1 Q: What is the frequency of DR testing? A: As it relates to systems, disaster recovery fail-over between data centers is tested annually. Q: Was an impact analysis done after PTI separation to asses needed for update to BC plans? A: PTI, the affiliate with which ICANN contracts for the performance of the IANA Functions, is not separate from ICANN. As noted through the IANA Stewardship Transition process, a separate contracting entity was created in the event that it was determined that the performance of the IANA Functions needed to be separated. As anticipated, there is little functional change in how the IANA Functions are actually performed, including the systems through which those services are performed. ICANN and PTI entered into a shared services agreement (https://www.icann.org/iana_pti_docs/153-services-agreement-v-30sep16) which is common in affiliate and spin-off relationships, through which ICANN commits to provide services to support the IANA activities, as well as commits ICANN to coordinate and maintain business continuity efforts. As a result, the IANA Stewardship Transition did not have an impact on ICANN’s business continuity plans. Q: Has ICANN implement the recommendations of the following exercise: IANA Full‐Scale Business Continuity Exercise Conducted 19 January 2010 (https://www.icann.org/en/system/files/files/iana-business-continuity-exerci…) A: Yes. Over time, IANA procedures have matured and evolved to incorporate the types of recommendations in that report. Q: Does ICANN's top management and /or the responsible person) established and published a documented organization business continuity policy? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. Q: Does ICANN have a documented Policy concerning the procurement, provision and management of outsourced good and services via its supply chain? A: Yes. See https://www.icann.org/en/system/files/files/procurement-guidelines-21feb10-… Q: Does ICANN have a documented business continuity operational planning and control process that enables it to determine, plan, implement and control those actions needed to fulfil its business continuity policy and objectives? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. Q: Does ICANN have a formal documented standard procedure and evaluation process for conducting a Business Impact Analysis (BIA)?\ A: ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Has ICANN carried out a BIA to identify its prioritized activities? If so, what was the results? A: ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Is there a documented Business Continuity Resumption/Recovery Strategy(ies) for the ICANN's prioritized activities their support resources and dependencies that has been signed off by top management? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Is there a documented Resource Recovery Strategy for critical business activities and their dependencies that has been signed off by top management, which includes the identification of critical assets on a scheduled basis? If so, is the strategy based upon and consistent with the resource recovery requirements identified within the current BIA in respect to ICANN's prioritized activities their support services and dependencies recovery profile? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Does ICANN have documented business continuity plans in respect of each of the prioritized activities and their dependencies? A: These documents are confidential and not published publicly for security reasons. There is an established Disaster Recovery plan for systems, a Continuity Plan for the IANA Functions, and a broader Continuity Plan under development for the wider ICANN organization to be delivered in 2019. ICANN has carried out a BIA in the past. Providing detailed information on such results could highlight vulnerabilities to the organization. The revised Continuity Plan, discussed in response to other questions, will be more focused on resource substitution until a disaster recovery is complete generally, rather than making scenario assumptions. BIA implies a certain speed of resource recovery which in practice may be much different than expected. That is, there should be contingency plans for all important resources, dispensing with a detailed analysis based on recovery time assumptions which may not hold in a crisis. Q: Does each plan contain predefined task checklists that includes mandatory and discretionary tasks together with individuals/roles/teams responsible for their completion and a process for tracking they're completion within an allocated timeframes? A: No, as previously stated, the plan will focus on resource recovery generally. Q: Does ICANN have a documented exercise/testing programme and process for business continuity procedures, plans and arrangements? The last available exercise is from 2009: https://www.icann.org/en/system/files/files/gtld-registry-continuity-plan-2… A: The referenced document relates to backup registries, rather than continuity at ICANN itself. The continuity plan being developed for the organization will include testing. Systems disaster recovery testing is done annually. Q: Depth of testing of DR needs to be elaborated on (Table top vs power trip). Are there any results of power trip exercises? A: Systems disaster recovery tests are actual failover tests. All systems were successfully recovered failing-over from primary to secondary. Q: Does ICANN conduct performance evaluations of its business continuity procedures, arrangements and capabilities in order to verify their continued suitability, adequacy and effectiveness? A: The continuity plan will be reviewed periodically, with testing, which would achieve what this question seems to be asking. Q: Does ICANN have documented boundaries and processes that have inter-org dependencies? Are they relate back to BC plans? a. Clarification requested from Boban, Alain, Zarko: What is meant by “inter-org” dependencies? Which orgs? What is meant by “boundaries.” b. ICANN org has asked for clarification as to the meaning of this question, and is awaiting a response. That said, based on current understanding, ICANN org thinks the answer is no, not beyond the shared services agreement between ICANN and PTI. Q: Does ICANN conduct internal audits at planned intervals to provide information on whether the Business Continuity Management is effectively implemented and maintained? A: Periodic testing and validation by the Risk Management function will be an important part of the Continuity Plan being developed this year. Review Team volunteers: Laurin, Boban, Žarko, Kerry-Ann Workstream: ICANN SSR Topic 3: Perform an assessment of ICANN's Risk Management Methodology and Framework. Outstanding questions: 0 Q: As of Oct 2017, ICANN did not follow formal information security audit frameworks such as ISO 27001. Is that still the case? A: That statement is incorrect. ICANN org has carried out assessments based on the CIS20 Cyber Security Framework starting in 2014. During 2018, ICANN transitioned to the NIST Cyber Security Framework. The benchmarking assessment has been done annually by a consulting firm with expertise in such assessments. In addition, two annual information security audits are performed related to the IANA Functions. The IANA department has been performing SOC3 audits on the Root Zone Key Signing Key Operator System since 2010, and SOC2 audits on the Registry Assignment and Maintenance System since 2013. Those audits are performed by external auditors. Q: Are there any plans to adopt a formal framework? If so, please give details of the framework, timeline for implementation and budget allocated. If not, provide reasoning for pursuing a formal framework. A: ICANN org has carried out assessments based on the CIS20 Cyber Security Framework starting in 2014. During 2018, ICANN transitioned to the NIST Cyber Security Framework. The benchmarking assessment has been done annually by a consulting firm with expertise in such assessments. In addition, two annual information security audits are performed related to the IANA Functions. The IANA department has been performing SOC3 audits on the Root Zone Key Signing Key Operator System since 2010, and SOC2 audits on the Registry Assignment and Maintenance System since 2013. Those audits are performed by external auditors. Q: Please provide documentation (links/perma-links) about your business continuity and risk management processes. A: ICANN org is not able to provide links to these processes, as this detailed information is confidential and unable to be shared due the nature of risk management, which may involve vulnerabilities and threats to the organization. Therefore, it would not be prudent to provide details of those vulnerabilities and threats nor details of the countermeasures ICANN takes or would take to counter vulnerabilities and threats. In general, however, ICANN org has a risk management policy and risk identification process. The policy and the process are reviewed by a Risk Management Committee made up of the org executives, approved by the President and CEO, and reviewed by the Board Risk Committee. Key elements of the policy have been presented to the full Board. A Continuity Plan is under development for ICANN organization and will be delivered later in 2019. That Continuity Plan will also be reviewed by a committee of the org executives, approved by the President and CEO, and reviewed by the Board Risk Committee. ICANN org is planning to develop public risk management reporting in 2019 which would highlight some of our risk management activities. Q: Is James Caulfield still the person responsible for risk and business continuity management? A: Yes. Q: There is a Board Risk Committee which meets at least twice a year, and considers the risk register. Is this still the case? The Committee organises an interactive risk workshop at least once a year, is that still the case? Please give dates of meetings since 2016, along with attendees, agendas, and outcome reports. A: Yes and yes. Minutes of the Board and Board Committee meetings are a matter of public record and can be found here: https://www.icann.org/resources/pages/minutes-2014-03-24-en Q: Please confirm that the risk register is updated on an ongoing basis, and give evidence of these updates. A: Yes, the Risk Register is updated regularly. Please refer to the Board Risk Committee minutes. Q: Relevant managers are responsible for declaring a disaster. Is this still the case? A: ICANN organization has a crisis management policy that defines the roles and responsibilities for declaring a crisis. Per that policy, it is the responsibility of executive management to determine whether a crisis is in progress. Review Team volunteers: Denise, Žarko, Kerry-Ann Workstream: ICANN SSR Topic 7: Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding registrar agreements and the consensus policies. Outstanding questions: 3 Q: Is there are separate risk management framework (including risk register and business continuity plan) for the PTI? A: There is a separate continuity plan for the IANA Functions, and that plan is also included in the ICANN organization risk management framework. Q: IANA (PTI) systems (both IT and operational) continue to be dependent on ICANN. When PTI staff login in the morning, they are on the ICANN secured network, correct? Is this still the case? Note: may want to address this off the public list/wiki) A: ICANN org is unable to provide a specific response to this question due to system security concerns. Further, ICANN org understands that a response has already been provided in the questions answered by the IANA functions regarding the level of network access security. Q: Within risk classification or scoring, there is no multiplier for potential impact on the internet’s system of unique identifiers. Is this still the case? A: Yes, there is no multiplier, and we do not see that as a standard risk management approach. Review Team volunteers: Noorul, Kerry-Ann, Eric, Laurin, Norm Workstream: Future Challenges Topic: Root server system protection: assess the threatscape of top threats (e.g. DDoS to the root system) Outstanding questions: 0 Q: What does staff and the community already do regarding emerging and future threats, and related issues? We are aware of efforts focused on emerging technologies; are there ones that focus on threats too? A: Emerging risks are treated in the usual risk management process. For example the recent DNS threat alert: https://www.icann.org/news/announcement-2019-02-15-en -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Call summary: SSR2 11 Apr
by Jennifer Bryce April 11, 2019

April 11, 2019

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #65, 11 April at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [EXT] SSR2 agenda: 11 April
by Barrett, Kerry-Ann April 11, 2019

April 11, 2019

Dear Team Regrettably Ill be in meetings tomorrow at the time of the call that I wont be able to get out of. I will provide updates in the google doc as suggested by Russ under separate cover. All the best for the week. Kind Regards Kerry-Ann Barrett Cyber Security Policy Specialist Organization of American States From: Jennifer Bryce<mailto:jennifer.bryce@icann.org> Sent: Wednesday, April 10, 2019 12:50 PM To: ssr2-review(a)icann.org<mailto:ssr2-review@icann.org> Subject: [EXT] [Ssr2-review] SSR2 agenda: 11 April Dear SSR2 RT members, Please see below for the SSR2 Review Team plenary agenda, Thursday 11 April at 14:00 UTC. 1. Welcome, roll call, SOI updates * Marrakech meeting dates - 22nd and 23rd June confirmed, morning of 27th June pending * Brussels meeting - team members to book flights, hotel confirmations pending * Technical writer - progress update to the team 2. Walk through the table of work topics here: https://docs.google.com/document/d/1Xid7AwbUpGRmX8c1TxxCmPF6mKxtdI30pwpEi-x… 3. AOB 4. Confirm action items / decisions reached Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 1

SSR2 agenda: 11 April
by Jennifer Bryce April 11, 2019

April 11, 2019

Dear SSR2 RT members, Please see below for the SSR2 Review Team plenary agenda, Thursday 11 April at 14:00 UTC. 1. Welcome, roll call, SOI updates * Marrakech meeting dates - 22nd and 23rd June confirmed, morning of 27th June pending * Brussels meeting - team members to book flights, hotel confirmations pending * Technical writer - progress update to the team 2. Walk through the table of work topics here: https://docs.google.com/document/d/1Xid7AwbUpGRmX8c1TxxCmPF6mKxtdI30pwpEi-x… 3. AOB 4. Confirm action items / decisions reached Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

4 4