December 2020 - Ssr2-review

Time to get that final consensus call
by Russ Housley Dec. 22, 2020

Dec. 22, 2020

Dear SSR2 RT, This is the consensus all on the final report: https://docs.google.com/document/d/1rMdW1YCebe6Yj678OUrlc3TsACZsqmwuqN3yaIj… <https://docs.google.com/document/d/1rMdW1YCebe6Yj678OUrlc3TsACZsqmwuqN3yaIj…> If you see anything that needs further editorial attention in the report, please let Heather know. Please use suggest mode. Heather incorporated item discussed on the plenary call lat Thursday. Please review before the next call on January 14th. Please post any concerns about the report before that call. Alos, please let us know if you intent to include a dissenting opinion about anything. Happy holidays, Russ

1 0

Call summary: SSR2 Plenary - 17 December 2020
by Brenda Brewer Dec. 18, 2020

Dec. 18, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 plenary #132, 17 December 2020 at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/DAENCQ. The transcript will be posted 5-7 days after call. With kind regards, Brenda --- Brenda Brewer Internet Corporation for Assigned Names and Numbers (ICANN)

1 0

Thursday is the last call about SSR2 Report
by Russ Housley Dec. 17, 2020

Dec. 17, 2020

SSR2 Review Team: We are getting close to the end! Please read the report and have your comments and concerns ready for discussion on the two-hours team call on Thursday: https://docs.google.com/document/d/1myG9dtYYiL8lFd3ZOPXNUwKfr1yuAsNrwzod-J8… <https://docs.google.com/document/d/1myG9dtYYiL8lFd3ZOPXNUwKfr1yuAsNrwzod-J8…> Please put comments in the report in advance; use suggest mode. If you have any solutions to the few remaining questions asked by Heather, please offer suggested resolutions. Again, use suggest mode. Finally, by close of business, please complete the following survey: https://tufts.qualtrics.com/jfe/form/SV_eLm7NIjU8hmOvw9 The survey results will also be discussed on Thursday. The survey will determine what the report includes about priority Russ P.S. On January 14th, we will have a call about the public comment response. Hopefully, there will be no need to talk about the report on that call.

2 2

Call summary: SSR2 Plenary - 10 December 2020
by Brenda Brewer Dec. 15, 2020

Dec. 15, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 plenary #131, 10 December 2020 at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/CgENCQ. With kind regards, Brenda --- Brenda Brewer Internet Corporation for Assigned Names and Numbers (ICANN)

1 0

SSR2 plenary agenda | 17 December 2020 @ 15:00 - 17:00 UTC
by Jennifer Bryce Dec. 15, 2020

Dec. 15, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Thursday 17 December @ 15:00 - 17:00 UTC. Please note this is the last planned meeting to discuss the report. 1. Welcome, roll call, SOI updates 2. Discuss comments/concerns regarding SSR2 Final Draft<https://docs.google.com/document/d/1myG9dtYYiL8lFd3ZOPXNUwKfr1yuAsNrwzod-J8…> Google document (please add comments to the document in advance of the call) 3. Discuss results of the prioritization survey (please complete the survey by EOD Wednesday 16 December – access here: https://tufts.qualtrics.com/jfe/form/SV_eLm7NIjU8hmOvw9) 4. Next steps * Next plenary meeting scheduled for Thursday 14th January (15:00 – 17:00 UTC) – purpose of this meeting is to discuss the public comment response spreadsheet 5. AOB 6. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce Project Manager, Review Support and Accountability Internet Corporation for Assigned Names and Numbers (ICANN) Skype: jennifer.bryce.icann Email: jennifer.bryce(a)icann.org

1 0

SSR2 Report - Final Draft
by Heather Flanagan Dec. 13, 2020

Dec. 13, 2020

Hello SSR2 Review Team, The draft final report is available now for your review. I have not included a table with all the recommendations yet; I’d very much like you all to read the recommendations in context. I will build that table after the RT indicates acceptance of the draft. https://docs.google.com/document/d/1myG9dtYYiL8lFd3ZOPXNUwKfr1yuAsNrwzod-J8… A few notes: There are 13 questions/comments pending. I expect most are easily resolved, but I’d like to point to four areas in particular: 1. Logically speaking, the findings in support of the C-Suite position recommendation are the weakest in the report. If anyone has citable examples of how you determined that there is a "risk of communications failures around critical security matters and the potential for conflicts around the prioritization of the budget” as well as a citable example of how the lack of a C-Suite role "has led to the ineffective documentation and implementation of security control measures organization-wide” that would be fantastic. 2. I have gone ahead and removed the Baseline Security Practices recommendation. I have not heard back from Naveed with more specific text, based on our conversation during the last plenary call, this definitely seems like a good idea, but not one in response to a specific problem observed by the RT (which makes it fall outside the Operating Standards for Specific Reviews). 3. I believe that Recommendation 20.1 can be removed, but as we have not discussed that as a group, I have left that removal as a suggestion. 4. And last but not least, given how we’ve supported the document at this point, do we still want to have a table that links every recommendation to a strategic plan line item? I have not re-built that table, but am happy to do so if the RT thinks it still has value. Feedback is always welcome. And of course, if you want to make changes in the doc, please do it in suggest mode. Heather Flanagan — Translator of Geek to Human https://sphericalcowconsulting.com

1 0

A question regarding the decrease in delegation of new gTLDs
by Heather Flanagan Dec. 10, 2020

Dec. 10, 2020

Hello all, In the Name Collision section, the RT states the following: "However, it is important to note that decrease of traditional reporting mechanisms of name collisions may not be seen as absence of name collisions. Rather, the SSR2 Review Team believes that it could be because the nature of occurrence of name collisions might have been changed as well as the decrease in the delegation of new gTLDs in recent years." I’d like to point to something where a reader can verify that there has been a decrease in the delegation of new gTLDs in recent years. The original draft text did not include a pointer to anything that backs up this statement. I had thought to point to https://newgtlds.icann.org/en/program-status/statistics, but as far as I can tell, that site does not offer insight into the rate of delegation over time. The page is a rather strange combination of current data, updated monthly, and stats from 2012-2013, and nothing in between. Am I looking at the right place for this kind of data? Does anyone have any better data to cite? Heather Flanagan — Translator of Geek to Human https://sphericalcowconsulting.com

2 3

Proposal: delete “Establish Baseline Security Practices” recommendation as OBE
by Heather Flanagan Dec. 10, 2020

Dec. 10, 2020

Hi all, I’m working on the Baseline Security (see page 38) findings to try and help them support the recommendations. The evidence for the recommendation depend entirely on how the Board handled RSSAC037 and 038. Since this recommendation was first drafted, the Board likely hadn’t done much of anything. The Board’s initial response was in June 2018 and it said they would create an Root Server System Governance Working Group (RSS GWG) so that the community could tell them how to implement RSSAC 037 and 038. That working group didn’t form until the very end of 2019 (see https://ccnso.icann.org/en/announcements/announcement-26nov19-en.htm) That said, it did form, and has a work plan that runs through 2022. Given that, I’m not entirely sure that this still fits - the Board will simply point to the RSS GWG as the group with all the action items in the RSS space. I think it makes sense to drop this recommendation, unless there other supporting evidence we would like to refer to for the recommendation to have merit. Text of the recommendation: SSR2 Recommendation 21: Establish Baseline Security Practices for Root Server Operators and Operations 21.1. ICANN org, in close cooperation with RSSAC and other relevant stakeholders, should ensure that the RSS governance model as proposed by RSSAC037 includes baseline security best practices for Root Server Operators and operations to minimize the SSR risks associated with root server operation. These best practices should include change management, verification procedures, and sanity check procedures. As part of this process, ICANN org should publish its own strategies for managing SSR for the IMRS and encourage other Root Server Operators to do the same. Heather Flanagan — Translator of Geek to Human https://sphericalcowconsulting.com

4 5

SSR2 plenary agenda | 10 December 2020 @ 15:00 UTC
by Jennifer Bryce Dec. 8, 2020

Dec. 8, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Thursday 10 December @ 15:00 - 16:00 UTC. 1. Welcome, roll call, SOI updates 2. Reminder of Implementation Shepherd volunteer opportunity (see email<https://mm.icann.org/pipermail/ssr2-review/2020-December/002396.html>) 3. Heather to present any outstanding issues in the report for team’s attention during the meeting (draft document here<https://docs.google.com/document/d/1myG9dtYYiL8lFd3ZOPXNUwKfr1yuAsNrwzod-J8…>) 4. Next steps * Heather will send the full report draft on 13th December – please be prepared for discussion on 17th December plenary meeting * Prioritization survey will follow the full report draft – please be prepared to complete this survey * Plenary meeting will need to be scheduled in January – RT members to confirm if Thursday 7th January is ok 5. AOB 6. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce Project Manager, Review Support and Accountability Internet Corporation for Assigned Names and Numbers (ICANN) Skype: jennifer.bryce.icann Email: jennifer.bryce(a)icann.org

1 0

Implementation Shepherds
by Jennifer Bryce Dec. 8, 2020

Dec. 8, 2020

Dear SSR2 RT members, As you prepare to finalize your report to submit to the Board I wanted to remind you about Implementation Shepherds so that you can start to think if this is something you’d like to volunteer for. The role of Implementation Shepherds is to be the first contact for any questions or clarifications the Board seeks as it considers the recommendations, and ICANN org seeks once the implementation is underway. Examples of information and clarification that can be sought from Implementation Shepherds include items such as the SSR2's intent behind its recommendations; SSR2 rationale for recommendations; facts that led the SSR2 to certain conclusions; the envisioned implementation timeline; and metrics related to the measure of implementation success. Any RT member who volunteers can be an Implementation Shepherd, there is no specific number required. ATRT3 and CCT each have 6, and RDS has 4. For CCT, RDS, and ATRT3 Reviews, the time commitment has been minimal, around 1-3 hours per month. Implementation is not linked to ICANN meetings. Therefore, the Implementation Shepherds shall not be eligible for travel funding in relation to this role. For examples of the types of discussions, see the wiki pages: * RDS: https://community.icann.org/x/lIICBw * CCT: https://community.icann.org/x/ugSrBQ * ATRT3: https://community.icann.org/x/BYM4C You can read more about Implementation Shepherds in the Operating Standards<https://www.icann.org/en/system/files/files/operating-standards-specific-re…> (p28). Please let me know if you’ve any questions. Best, Jennifer -- Jennifer Bryce Project Manager, Review Support and Accountability Internet Corporation for Assigned Names and Numbers (ICANN) Skype: jennifer.bryce.icann Email: jennifer.bryce(a)icann.org

1 0