May 2019 - Ssr2-review - lists.icann.org

SSR2 agenda 2 May
by Jennifer Bryce May 2, 2019

May 2, 2019

Dear SSR2 RT members, Here is the agenda for the next SSR2 plenary call, scheduled for Thursday 2 May at 14:00 UTC. 1. Welcome, roll call, SOI updates 2. Technical Writer Update 3. Review items that are red, yellow on status table [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>, determine roadblocks and potential workarounds 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

4 3

Re: [Ssr2-review] FYI - ICANN DNS Symposium
by Jennifer Bryce May 2, 2019

May 2, 2019

Dear all, Remote participation will be available throughout the DNS Symposium - you can find the Zoom information at the bottom of the page here: https://www.icann.org/ids. Presentations and recordings will also be posted to this page after the event. Best, Jennifer From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Denise Michel <denisemichel(a)fb.com> Date: Monday, April 29, 2019 at 10:21 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] FYI - ICANN DNS Symposium Hi, All. I was wondering if anyone is attending this symposium: The third ICANN DNS Symposium (IDS 2019) will be held 10-11 May 2019 in Bangkok, Thailand at the Shangri-La hotel. The IDS 2019 is co-locating with the fifth GDD Industry Summit (6-9 May 2019), the Registration Operations Workshop - ROW (9 May 2019) and the DNS OARC meeting (12-13 May 2019). The theme for the ICANN DNS Symposium (IDS) 2019 is: "Understanding the Security, Stability and Resiliency of the Domain Name System". IDS 2019 will focus on emerging technologies, protocols and other issues that may affect the security, stability, or resiliency of the Domain Name System. https://www.icann.org/ids [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_ids&d=Dw…> Hi, Staff. Could you provide us with copies of IDS presentations and let us know if remote participation and recordings will be available? Thanks. Denise Denise Michel denisemichel(a)fb.com<mailto:denisemichel@fb.com>

3 2

ICANN SSR answers
by Jennifer Bryce May 1, 2019

May 1, 2019

Dear Scott, dear Noorul, The below answer in highlight has been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. Please let us know if you have any questions. Review Team volunteers: Scott, Noorul Workstream: ICANN SSR Topic 4: Perform an assessment of how effectively ICANN has implemented its Security Incident Management and Response Processes to reduce (pro-active and reactive) the probability of DNS-related incidents. Outstanding questions: 0 Q: Which certifications is ICANN pursuing for the organisation and staff? A: The certifications undertaken in ICANN are dependent on job function, and on a needs basis. For instance, InfoSec team members and all operations members complete and maintain GIAC SANS security modules. Software engineers are incentivised to undertake Secure Software Development Lifecycle training. ICANN Managed Root Server Team members have and maintain ITIL certifications. And all staff undergo mandatory yearly end user security training that encompasses infosec hygiene practices for end users, and awareness on phishing, spear-phishing, and other social engineering attempts. Q: Which certifications and compliance frameworks has ICANN completed? A: ICANN was following the Center for Internet Security (CIS) controls framework, after selecting 20 controls that best applied to ICANN business and operations. Recently the decision was made to move aware from CIS as it has shortcoming for the type of environment in which ICANN exists. The future framework of choice will be the NIST Cyber Security Framework (CSF) which is a better fit for ICANN and has a higher propensity for increasing the security posture to meaningful levels, inclusive of reviewing processes, for the entire ICANN Org. Work has commenced on building the ICANN Org CSF profile. Q: Who are ICANN’s auditors, what audits are completed regularly? A: Until recently ICANN used Leidos to complete its annual CIS audit. This has now been paused until the CSF work is done within ICANN, and an evaluation on auditors (for the ability to audit against CSF profiles) has been completed. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1