- Ssr2-review - lists.icann.org

SSR2 agenda 8 April 2020
by Jennifer Bryce April 7, 2020

April 7, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 8 April @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Complete team member sign-up / assignment and determine rapporteurs (see sign-up sheet<https://docs.google.com/spreadsheets/u/1/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3g…> for subteams) 3. Begin review public comments assigned the ‘summary’ tag (see public comment feedback spreadsheet<https://docs.google.com/spreadsheets/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGCuTYI…> column ‘B’) 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Re: [Ssr2-review] [EXT] Re: [Ssr2-coordination] Public Comment Feedback spreadsheet fully populated
by Barrett, Kerry-Ann April 5, 2020

April 5, 2020

Russ Would it be useful to add a comment column on how the comment was addressed? That way if there is any ambiguity there is a logic. Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States On Apr 5, 2020, at 12:45 PM, Russ Housley <housley(a)vigilsec.com> wrote: CAUTION: EXTERNAL SENDER The GAG comment came in. These are the last comments that we are expecting. Thanks to Heather for adding them to the table so quickly. Sadly, we have 332 public comments to address. To tackle this volume of work, we have formed sub-teams for each recommendation. Some team member have still not signed up. Gaps will be filled on Wednesday. Please sign up now: https://docs.google.com/spreadsheets/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3gonDb… As mentioned on the call last week, many comments refer to the draft report overall, or to multiple SSR2 recommendations through a single public comment. Sub-teams are encouraged to scan the comments to make sure they have found everything related to their findings and recommendations. Sub-teams can start addressing the comments here: https://docs.google.com/spreadsheets/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGCuTYI… Remember there are three things that need to be done: 1) A response for each public comment in the table. The table contains a summary, not the full public comment. The sub-team will probably have to read the whole public comment to get the full intent of the comment. 2) There are comments from team members in the draft report. Handle those in addition to the public comments. 3) Modified finding and recommendation text. In making changes, think about the new document outline to avoid the repetition that is in the draft report. Flag items that are a big change from the draft report that require discussion (and consensus) from the whole team. Russ _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Re: [Ssr2-review] [Ssr2-coordination] Public Comment Feedback spreadsheet fully populated
by Russ Housley April 5, 2020

April 5, 2020

The GAG comment came in. These are the last comments that we are expecting. Thanks to Heather for adding them to the table so quickly. Sadly, we have 332 public comments to address. To tackle this volume of work, we have formed sub-teams for each recommendation. Some team member have still not signed up. Gaps will be filled on Wednesday. Please sign up now: https://docs.google.com/spreadsheets/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3gonDb… As mentioned on the call last week, many comments refer to the draft report overall, or to multiple SSR2 recommendations through a single public comment. Sub-teams are encouraged to scan the comments to make sure they have found everything related to their findings and recommendations. Sub-teams can start addressing the comments here: https://docs.google.com/spreadsheets/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGCuTYI… <https://docs.google.com/spreadsheets/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGCuTYI…> Remember there are three things that need to be done: 1) A response for each public comment in the table. The table contains a summary, not the full public comment. The sub-team will probably have to read the whole public comment to get the full intent of the comment. 2) There are comments from team members in the draft report. Handle those in addition to the public comments. 3) Modified finding and recommendation text. In making changes, think about the new document outline to avoid the repetition that is in the draft report. Flag items that are a big change from the draft report that require discussion (and consensus) from the whole team. Russ

1 0

Call summary: SSR2 1 April 2020
by Jennifer Bryce April 4, 2020

April 4, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #106, 1 April 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/LyKJBw. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Re: [Ssr2-review] [EXT] Call summary: SSR2 1 April 2020
by Barrett, Kerry-Ann April 1, 2020

April 1, 2020

Dear All Apologies for unexpectedly missing today. We had a regional CIRTs meeting to discuss the cyber times being observed in the region as a result of COVID-19 and got a request from my boss to take notes. Wi read the notes and already signed up for subteams last night. Hope everyone is ok Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States On Apr 1, 2020, at 2:51 PM, Jennifer Bryce <jennifer.bryce(a)icann.org> wrote: CAUTION: EXTERNAL SENDER Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #106, 1 April 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/LyKJBw. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org <SSR2 RT Plenary Call Report 106.pdf> _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

FYI Domain Name Registration Data at the Crossroads.
by Denise Michel March 31, 2020

March 31, 2020

A report documenting compliance and technical failures involving WHOIS, registrars and ICANN was published today – see this CircleID<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.circleid.com_posts_…> and the Domain Name Registration Data at the Crossroads<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.interisle.net_domai…>. In addition to providing extensive details on the failures, it shows how these problems have real life implications for security, stability and trust on the internet, including for detecting and mitigating cybercrime related to the current pandemic. It's well-researched and relevant to several SSR2 recommendations. Best, Denise Denise Michel denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

Next root zone key signing ceremony
by Žarko Kecić March 31, 2020

March 31, 2020

Dear team, I think you will be interested in the information below, about the possible approach for conducting the next root zone key signing ceremony. Obviously there is a disaster recovery plan and procedure to perform these ceremonies even in situations such as the present, although likely none of us even thought that what was happening now is actually possible. Žarko Contingency plans for the next Root KSK Ceremony Colleagues, The IANA team, and the broader ICANN organization, have been giving significant thought to the Coronavirus pandemic and its impact on root zone KSK operations. Managing the KSK is centred on conducting "key signing ceremonies", where trusted community representatives (TCRs) attend from around the world to witness utilization of the root zone KSK private key. This approach seeks to engender trust in the broader community that the key has not been compromised, in addition to more typical controls such as third-party auditing. In light of world events we have developed contingency plans around how to hold key ceremonies in the short term. To that end, we identified a graduated set of options, in summary: 1. Hold the next ceremony as planned on April 23, with a quorum of participants globally. 2. Hold the next ceremony on a different date using only US-based TCRs. 3. Hold the next ceremony using our disaster recovery procedure, which provides for a staff-only ceremony (i.e. no TCRs would be physically present). In general, our goal has been to navigate from Option 1, and if that is not possible, Option 2, and so on. However, at this time, our focus is on developing a plan around Option 3. The ceremony is currently scheduled unusually early in the quarter (it is typically held in May), and needs to be held to generate signatures that will be needed in production for July. Our contingency plan is comprised of: * Holding the ceremony with a bare minimum of staff (approximately 6); * Using 3 TCRs' credentials, either by having their access key transferred to us in a secure manner in advance of the ceremony, or by drilling the safety deposit box that holds their secure elements. * Holding the ceremony under typical audit coverage, allowing for remote witnessing of events by all, plus providing additional opportunities for TCRs to stay involved in the process remotely. * Signing key materials to cover one or more subsequent quarters, to provide relief from the need to necessarily hold ceremonies later in 2020 if circumstances disallow it. (The additional signatures would be withheld securely until they are needed.) Our key management facilities were designed with the disaster recovery capability of performing staff-only ceremonies in mind, but this is a significant shift from normal operations and we want to promote broader community awareness of this work. Those directly involved in key ceremonies - the trusted community representatives, our vendors and auditors - have been consulted and are broadly supportive of this effort. Should there be any specific feedback you would like to share with our team, please let me know or respond to this thread. We will take it into consideration as we finalize our plans. Thank you for your support. Kim Davies VP, IANA Services, ICANN President, Public Technical Identifiers (PTI)

1 0

SSR2 agenda 1 April 2020
by Jennifer Bryce March 31, 2020

March 31, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 1 April @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Determine approach to review of public comments (see analysis spreadsheet<https://docs.google.com/spreadsheets/u/1/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGC…>) 3. Determine approach to completion of review work (see sign-up sheet<https://docs.google.com/spreadsheets/u/1/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3g…> for subteams) 4. Review of outstanding team member comments in the markup document [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> 5. AOB 6. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Re: [Ssr2-review] [EXT] SSR2 agenda 1 April 2020
by Barrett, Kerry-Ann March 30, 2020

March 30, 2020

Team Just heads up. The GAC is preparing comments for our draft report. From all indications so far it seems positive and very constructive. Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States On Mar 30, 2020, at 5:44 PM, Jennifer Bryce <jennifer.bryce(a)icann.org> wrote: CAUTION: EXTERNAL SENDER Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 1 April @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Determine approach to review of public comments (see analysis spreadsheet<https://docs.google.com/spreadsheets/u/1/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGC…>) 3. Determine approach to completion of review work (see sign-up sheet<https://docs.google.com/spreadsheets/u/1/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3g…> for subteams) 4. Review of outstanding team member comments in the markup document [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> 5. AOB 6. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Recommendation 8.3
by Russ Housley March 30, 2020

March 30, 2020

Alain: On the call today, there was a discussion of Recommendation 8.3. The question raised is: "Is there any evidence this has ever been a problem?" Can you point to one? Russ

2 3