- Ssr2-review - lists.icann.org

Connectivity - for SSR2 Meeting Call - Tuesday, 11 July 2017 @ 21:00 UTC
by MSSI Secretariat July 11, 2017

July 11, 2017

Hello SSR2 Review Team - Good day. I just wanted to touch base regarding connectivity for our next SSR2 Meeting Call scheduled for Tuesday, 11 July 2017 @ 21:00 UTC. We have conquered many of the noise disturbances previously present and would like to ensure continued connectivity on future calls. For the best results in regions with connectivity, we suggest doing the following... * Connect to the Adobe Connect (https://participate.icann.org/ssrreview) 20-30 minutes before the scheduled call - the Adobe Connect room will be open and I will be available to assist you - in addition we can resolve any microphone/static/connection issues ahead of time - including connecting with international operators if need be. The goal is to have all connection concerns resolved by the top of the hour for the benefit of the team. * Be located (if possible) in an area that has proper broadband connection and is quiet - thus creating a strong signal connection, making it possible to see and hear in the Adobe Connect Room. * Feel free to Skype me either before, during or after the call - my skype address is yvette.guigneaux.icann - this way I can respond to you almost immediately for whatever you may need - including having the Adobe Connect Room dial out to you if need be. As your SSR2 Review Team Secretariat, I am determined to create an atmosphere where you can clearly participate in the Adobe Connect Room. Thank you everyone and I look forward to seeing you all on our upcoming call. :) Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FA1B.82CD2870]

1 0

Subgroup admin & action items tracking
by Jennifer Bryce July 11, 2017

July 11, 2017

Dear all, To help progress the subgroup work please find below: * Subtopic email addresses and Adobe Connect room information. * As with the regular plenary calls the adobe connect information will be included in any subgroup meeting invites that are sent. * Please let us know if you want to be added to any of the distribution lists. * Proposed times for subgroup calls, based on staff support availability. * Please discuss within your groups when you would like to have regular calls. * Could the rapporteur from each group please advise us on the preferred slot and we will help set up the meetings. * Please also note that the action/request tracking tool that was presented in Johannesburg is now live. You can find it here: https://community.icann.org/display/SSR/Tracking+Tool. * Action items for each subgroup are recorded on the wiki pages of each group. Links to the wiki pages are in the table below. Let me know if you have any questions. Thanks! Subgroup & wiki page link Email list Adobe Connect Room Review Team recipients SSR1 Review<https://community.icann.org/display/SSR/Subtopic+%231+-+SSR1+Review> SSR1implementation-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_ssr1review Alain, Ram Krishna, Denise, Eric, Emily ICANN SSR<https://community.icann.org/display/SSR/Subtopic+%232+-+ICANN+SSR> ICANNsecurity-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_icannssr James, Boban, Noorul, Denise, Kerry-Ann, Žarko, Eric, Emily DNS Security<https://community.icann.org/display/SSR/Subtopic+%233+-+DNS+Security> DNSsecurity-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_dnssecurity<https://participate.icann.org/SSR2_dnssecurrity> Emily, Alain, Cathy, Matogoro, Ram Krishna, Žarko, Geoff, Amin, Don, Eric, Denise Future Challenges <https://community.icann.org/display/SSR/Subtopic+%234+-+Future+Challenges> Futurechallenges-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_futurechallenges Emily, Kerry-Ann, Matogoro, Amin, Eric, Noorul, Denise IANA Transition<https://community.icann.org/display/SSR/Subtopic+%235+-+IANA+Transition> IANAtransition-SSR2-RT(a)icann.org https://participate.icann.org/SSR2_ianatransition Cathy, James, Eric, Geoff, Emily, Denise Available times (UTC) for subgroup calls Wednesday Thursday 14:00 14:00 - 17:00 21:00 21:00 -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2-RT Slide Deck for Plenary #18
by Karen Mulberry July 10, 2017

July 10, 2017

Attached is the presentation for tomorrow’s SSR2-RT Plenary meeting. Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

1 0

SSR1 recommendations sub-group
by ALAIN AINA July 10, 2017

July 10, 2017

Dear SSR1 team (Denise,RAM,Eric), While waiting for the Mailing list for the sub-group, let me set the scene here. The SSR1 recommendations are classified in the 5 following categories: - SSR Framework =============== #1,#7,#8,#11,#17,#18,#19,#20,#21,#22 - SSR Relationships to Support ICANN’s Work ================================== #4,#5 - Compliance =========== #10 - ICANN’s SSR Role & Remit Within It’s Limited Mission ========================================= #2,#3,#9,#24,#25,#26,#27 - SSR Community Outreach & Info Sharing–Security Threats & Mitigation ======================================================= #6,#12,#13,#14,#15,#16,#23,#28 A quick counting shows: SSR1 recommendations we’ve been briefed about before last face to face : #1,#4,#5,#14,#15,#16,#18,#19, #24,#28 Briefed about at last face to face #2,#7,#8,#9,#17,#20,#21,#22 Plan for the call tomorrow: #10 Others #3.#6.#11,#12,#13,#23,,#25,#26,#27 Before we start working on the recommendations starting with the ones the briefings have been completed, i would like to set a doodle poll for a call to: 1- Finalize the work items 2- Agree on methodology 3- Set timelines 4 -AoB Before then, please review the work items and indicate which ones are out of scope, which ones are missing. The floor is yours. Silence means agreement :-) —Alain

1 0

Work plan (draft) Sub Team 2 – ICANN Security
by Boban Krsic July 9, 2017

July 9, 2017

Dear All, Please find attached a first draft of a work plan for subteam 2 - ICANN Security. I propose, that the basis for further development should be a gap analysis (without any obligations to certify something) based on the following two industrial standards: ISO/IEC 27001:2013 Information Security Management Systems (ISMS) and ISO 22301:2012 Business Continuity Management Systems (BCMS). With the use of both standards, we should be able to address all relevant work items that we identified in Madrid. For the beginning, I have created a simple MS Excel that consists all relevant information for project planning and realization of the gap analysis. The file contains a total of four sheets: * Sheet1 (Workplan) contains the main key action steps, a description of the action, expected outcome, evaluation methodology, required skill set, responsible person, proposed timeline, and finally a reference to Madrid’s work item list. The list is not finished and needs to be completed. * Sheet2 (Checklist 27001) contains 32 questions to address all relevant requirements of the main part of a ISMS based on ISO/IEC 27001. With the checklist, we are able to evaluate the following category groups: * Scope, relevant parties (stakeholder) * Leadership, roles and responsibilities * Risk management and risk treatment * Resources, competence, awareness and communication * Performance evaluation, internal audit and management review * Improvement of the ISMS * Sheet3 (Checklist 27001 – Annex A) contains a list of 114 questions based on the Annex A of ISO/IEC 27001. It is a list of security controls (or safeguards) that are to be used to improve security of information. The controls are structured, and the purpose of each of the 14 sections from Annex A [1]: * Information security policies - controls how to write and review policies * Organization of information security – controls on how the responsibilities are assigned * Human resources security – controls affecting the employment * Asset management – controls related to inventory of assets and acceptable use, also for information classification and media handling * Access control – controls for Access control policy, user access management, system and application access control, and user responsibilities * Cryptography – controls related to encryption and key management * Physical and environmental security – controls defining secure areas, entry controls, protection against threats, equipment security, secure disposal, clear desk and clear screen policy, etc. * Operational security – lots of controls related to management of IT production: change management, capacity management, malware, backup, logging, monitoring, installation, vulnerabilities * Communications security – controls related to network security, segregation, network services, transfer of information, messaging, etc. * System acquisition, development and maintenance – controls defining security requirements and security in development and support processes * Supplier relationships – controls on what to include in agreements, and how to monitor the suppliers * Information security incident management – controls for reporting events and weaknesses, defining responsibilities, response procedures, and collection of evidence * Information security aspects of business continuity management – controls requiring the planning of business continuity, procedures, verification and reviewing, and IT redundancy * Compliance – controls requiring the identification of applicable laws and regulations, intellectual property protection, personal data protection, and reviews of information security * Sheet4 (Checklist 22301) similar to sheet1 but with a focus on Business Continuity Management. The checklist contains a list of 90 questions to address all relevant requirements of a BCMS based on ISO 22301. With the checklist, we are able to evaluate the following category groups: * Scope, supply chain, l&r requirements and assurance * Leadership, roles and responsibilities * Risks and opportunities * Business continuity objectives and plans to achieve them * Human resources, competence and training and awareness * Communication and documentation * Operational planning and control * Business Impact Analysis (BIA) and Risk Assessment * Business continuity strategy / Resource recovery strategy * Incident response structure * Business continuity plans * Monitoring, measurement, analysis and evaluation * Internal audit and management review * Improvement of the BCMS I am using a similar list for my annually internal audits at DENIC. Altogether I would expect a total effort of approx. 15-20 m/d to perform key action steps 1.0 and 2.0. External consultants are also possible and in my view a good option. Jennifer, it would be great if you could import the file to google docs and share the link for editing purposes. Any feedback on this would be great. Regards, - Boban. [1]https://advisera.com/27001academy/knowledgebase/overview-of-iso-270012013… -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main

3 7

On 12 July - Security Framework Drafting Team to Present Draft Framework for Registry Operators to Respond to Security Threats
by Karen Mulberry July 7, 2017

July 7, 2017

I thought the SSR2-RT might be interested in this this announcement. Security Framework Drafting Team to Present Draft Framework for Registry Operators to Respond to Security Threats https://www.icann.org/news/announcement-3-2017-07-06-en LOS ANGELES – 6 July 2017 – The Security Framework Drafting Team (SFDT) consisting of representatives from registries, registrars, the Public Safety Working Group (PSWG), and the ICANN organization today announced it will present the draft Framework document<https://www.icann.org/public-comments/draft-framework-registry-respond-secu…> that has been published for public comment. The Framework includes results of a two-year collaborative effort by the SFDT that addresses registries’ responses to notifications of security threats. The objective of this framework is to deliver on the New gTLD Program Committee of the ICANN board’s (NGPC) commitment to the GAC regarding ICANN soliciting community participation to develop a framework for how a Registry Operator (RO) may respond to identified security threats. The meeting will take place on 12 July 2017 at 14:00 Coordinated Universal Time (UTC) and will be hosted by members of the SFDT to present the draft framework and provide an opportunity for the public to ask questions directly to the SFDT. The meeting will be presented in English. Participants will have the opportunity to ask questions during the meeting using the chat function in Adobe Connect. Speakers will include: * Brian Cimbolic, Deputy General Counsel, Public Interest Registry * Dennis Chang, GDD Services and Engagement Program Director, ICANN * Iranga Kahangama, GAC PSWG Member; Science and Technology Branch, Federal Bureau of Investigation, United States * Alan Woods, Compliance Manager, Rightside Meeting Details & How to Attend Date: 12 July 2017 Time: 14:00 - 15:00 UTC Join via Adobe Connect <https://participate.icann.org/spec11-sec-frmwk/> View Dial-In Information<https://www.myrcplus.com/cnums.asp?bwebid=8369444&ppc=8653177963&num=1-719-…> Participant Code: 8653177963 Sincerely, Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

2 1

SSR2 Plenary 18 agenda
by Jennifer Bryce July 7, 2017

July 7, 2017

Hi all, Please see below for the SSR2 Plenary #18 draft agenda SSR2 Plenary #18 - Tuesday 11 July 2017 21:00 - 22:00 UTC * Updated SOIs & note apologies/absences * Johannesburg meeting – recap & review of action items * Updates from subtopic teams (SSR1 Implementation, ICANN SSR, DNS Security, Future Challenges, IANA Transition) * SSR1 Implementation Briefing: Maguy Serad, VP ICANN Compliance (Recommendation 10) * Trello Demonstration: James Gannon * AOB Have a good weekend! -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2 Johannesburg meeting recap
by Jennifer Bryce June 30, 2017

June 30, 2017

Hi all, Hope you had a comfortable trip home! Thank you all again for a great meeting. Here’s a recap: * The draft action items for both plenary and subtopic groups are attached, along with summary notes. As usual, please review and let us know if you have any edits. The actions will also be posted to the wiki Action Items<https://community.icann.org/display/SSR/Action+Items> page. * The relevant Google docs are linked from the action items but I’ve also included links below. * As a reminder, each of the subtopics now has a wiki page. You can access them here<https://community.icann.org/display/SSR/Subtopics>. * The recordings of and other resources from the meeting have been posted here<https://community.icann.org/pages/viewpage.action?pageId=64949767>. * The next plenary session is on Tuesday, July 11th @ 21:00 UTC. Google docs: * Questions asked during SSR1 briefing<https://docs.google.com/document/d/15g9bz4h57wC9LmNltKLarLRGhJdztnCBzDGtWmB…> * Questions for ICANN Chief Innovation & Information Officer<https://docs.google.com/document/d/1QmUaAufCfYtEs0cXS-fTxwtkxHZMrBj1IwGIe33…> * Subtopics list<https://docs.google.com/document/d/1DWoT4VoMlT5Dvcy78EXI-O5tQFqa9CblwsDEV6g…> * Outreach list<https://docs.google.com/document/d/1iqI-67Ir-EydmPPJzsEeBO98X4jucgpFX3HaL_9…> * Doodle poll<https://beta.doodle.com/poll/6k8at4f63wpv37c3> * Future challenges<https://docs.google.com/document/d/1nBZXvPNVIGsqDUaTZkm9aW5Rit0hR4YHf3wftU2…> brainstorming doc Other resources: * SSR1 Briefing slides<https://community.icann.org/pages/viewpage.action?pageId=64949767&preview=/…> June 25 2017 * SSR1 Review Implementation Final Report<https://community.icann.org/display/SSR/SSR1+Review+Implementation+Home> * WHOIS Knowledge Center<https://whois.icann.org/en/knowledge-center> * Universal Acceptance Steering Group<https://uasg.tech/> * SAC097 SSAC Advisory Regarding the Centralized Zone Data Service (CZDS) and Registry Operator Monthly Activity Reports<•%09https:/www.icann.org/en/system/files/files/sac-097-en.pdf> And finally, a note from the ICANN meetings team: Please fill out the ICANN59 survey to assist us in improving our community experience at ICANN meetings >> https://meetingapp.icann.org/icann59/ Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Apologies: 29 June to 15 July
by Emily Taylor June 28, 2017

June 28, 2017

Dear all Please note that I will be on annual leave from 29 June to 15 July inclusive. My apologies for all SSR2 meetings that take place during these dates. Kind regards Emily -- Emily Taylor CEO, Oxford Information Labs *Associate Fellow, Chatham House; Editor, Journal of Cyber Policy* *PLEASE NOTE MY NEW EMAIL ADDRESS AND CONTACTS AS OF 1 JANUARY 2017* Magdalen Centre, Oxford OX4 4GA | T: 01865 582885 E: emily.taylor(a)oxil.co.uk | D: 01865 582811 | M: +44 7540 049322 <http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017> Registered office: 37 Market Square, Witney, Oxfordshire OX28 6RE. Registered in England and Wales No. 4520925. VAT No. 799526263 .

1 0

Input Needed on Possible SSR2-RT Face-to-Face Meeting January 2018
by Karen Mulberry June 28, 2017

June 28, 2017

Dear SSR2 Review Team Members, The Co-Chair’s anticipate the need for a face-to-face meeting in January 2018 focused on writing and editing a draft report. Determining the dates and location now will enable you to plan your schedules and will enable ICANN Staff to make arrangements and assist with visa issues. The dates that have been proposed to be blocked for this face-to-face meeting for 2018 are: January 15, 15, 17 or January 22, 23, 24 (to be determined whether two or three days will be needed) Please indicate your availability to attend a face-to-face Review Team meeting on these dates. Please respond to the poll by 25 June 1900 UTC https://beta.doodle.com/poll/meb4yab79qwmuep2#table<https://urldefense.proofpoint.com/v2/url?u=https-3A__beta.doodle.com_poll_m…> We are exploring potentially holding this meeting either in Brussels or in Montreal. If you have a preference for location, please email staff directly (off-list) at MSSI Secretariat mssi-secretariat(a)icann.org<mailto:mssi-secretariat@icann.org> so that can be considered as arrangements are being explored for the SSR2-RT meeting. Sincerely, Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

9 9