- Ssr2-review - lists.icann.org

Connectivity Concerns for SSR2 Meeting Call - Tuesday, 13 June 2017 @ 06:00 UTC
by MSSI Secretariat June 12, 2017

June 12, 2017

Hello SSR2 Review Team - Good day. I just wanted to touch base regarding connectivity concerns for our next SSR2 Meeting Call scheduled for Tuesday, 06 2017 @ 06:00 UTC. We have conquered many of the noise disturbances previously present and would like to ensure continued connectivity on future calls. For the best results in regions with connectivity concerns, we suggest doing the following... * Connect to the Adobe Connect (https://participate.icann.org/ssrreview) 20-30 minutes before the scheduled call - the Adobe Connect room will be open and I will be available to assist you - in addition we can resolve any microphone/static/connection issues ahead of time - including connecting with international operators if need be. The goal is to have all connection concerns resolved by the top of the hour for the benefit of the team. * Be located (if possible) in an area that has proper broadband connection and is quiet - thus creating a strong signal connection, making it possible to see and hear in the Adobe Connect Room. * Feel free to Skype me either before, during or after the call - my skype address is yvette.guigneaux.icann - this way I can respond to you almost immediately for whatever you may need - including having the Adobe Connect Room dial out to you if need be. We will also have Tech Support on this call to trouble shoot any AC Room issues should they arise. As your SSR2 Review Team Secretariat, I am determined to create an atmosphere where you can clearly participate in the Adobe Connect Room. Thank you everyone and I look forward to seeing you all on our upcoming call. :) Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2E360.B4657800]

1 0

Proposed agenda for SSR2 conference call - Tuesday 13 June, 06:00 UTC
by Denise Michel June 12, 2017

June 12, 2017

Hello, All. Here’s the proposed agenda for our Tuesday, 13 June conference call: * Note updated SOIs & apologies/absences * Continue discussion on sub-topic workplans (see discussion on email list), including next steps to address scope, work plan and timeline, etc. * Review open action items list (please be prepared to address your items) * Johannesburg meetings * AOB As always, comments are welcome. Staff will provide supporting slides shortly. Thanks. Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

3 2

Role of observers and ways of participating
by Emily Taylor June 10, 2017

June 10, 2017

Dear all As mentioned by me on the last call, I have received some feedback that participating as an observer to this Team is not particularly straightforward. There is a sense that observers are fairly firewalled from the discussions on calls (I understand that they are not able to see the adobe room for example), and this can make it difficult to follow the discussions. There is also no direct way for them to raise input in real time, either in our calls or through remote participation in the face to face calls. Here are a few questions from me, to stimulate discussions on the list: - Shall we keep arrangements as they are, with regard to observer participations? If you are open to changing the current arrangements, consider the following options. - Able to see Adobe Room during calls - Able to participate in Adobe Room chat - Able to speak on calls by raising hand Adobe Room - Able to join in list discussions (perhaps with some designation as 'observer') Please let me know your thoughts, and of course any other options I may have missed. Personally, I feel that we have a small group of Team Members and a small group who wish to be Observers. In my opinion we should make our processes transparent and encourage active participation from interested parties. If we start to feel swamped or overwhelmed by Observer input, that will be a different problem which we can review if it arises. Best Emily -- Emily Taylor CEO, Oxford Information Labs *Associate Fellow, Chatham House; Editor, Journal of Cyber Policy* *PLEASE NOTE MY NEW EMAIL ADDRESS AND CONTACTS AS OF 1 JANUARY 2017* Magdalen Centre, Oxford OX4 4GA | T: 01865 582885 E: emily.taylor(a)oxil.co.uk | D: 01865 582811 | M: +44 7540 049322 <http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017> Registered office: 37 Market Square, Witney, Oxfordshire OX28 6RE. Registered in England and Wales No. 4520925. VAT No. 799526263 .

3 3

Action Items: SSR2 Plenary 14
by Jennifer Bryce June 9, 2017

June 9, 2017

Hi all, Below are the draft action items from the SSR2 plenary on Tuesday 6 June. Summary notes are attached. Note the official record of the meeting can be found on the SSR2 wiki here<https://community.icann.org/display/SSR/SSR2+Meeting+%2314+-+06+June+2017+@…>. Action Items Plenary #14 Action Owner Due Date Send written responses to RT questions asked during the presentation on ICANN’s Global Stakeholder Engagement outreach efforts to SSR technical community. 1. We’re hearing that the GSE is supporting the work done by CTO. So, what do we mean by help support? And what is the relationship between this engagement and the IANA functions? (AA) 2. A lot of the presentation was about sending the message out. How does it work going the other way? You point to passive mechanisms but what about active measures? (GH) 3. Regarding L-root operations and hosting: What is the planning process vs. passive response? Is there a master plan for anyone who operates, in terms of Anycast? And how is that overall process implemented? (GH) 4. What efforts does ICANN take to inform the policy debate as it is taking place vs. after the fact? (GH) 5. How does GSE work specifically with the ccTLD community on SSR? (JM) 6. How is your work is coordinated and support the OCTO and SSR teams commitment to engage and seek input from the broader SSR community that’s not necessarily active in ICANN. Including their obligation to get input/interaction from them on SSR Framework and strategic priorities. How are you involved and how does the coordination occur? (DM) 7. When do you think in terms of GSE that the focus on explanation/teaching of what ICANN does will shift to more of an interaction/ substantive engagement? ICANN Org TBD Share thoughts and continue discussion on list regarding presentation of ICANN Security and SSR1 subtopic work plans. SSR2-RT TBD Share thoughts on list on how to be more open to observer inputs. SSR2-RT TBD -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] Work plan (draft) Sub Team 2 – ICANN Security
by Barrett, Kerry-Ann June 8, 2017

June 8, 2017

Dear Boban Thanks in advance for preparing this. We should decide if we set up a meeting with the sub-team to discuss and set deadlines for feedback and comments before that meeting. Sincerely, Kerry-Ann Barrett Cyber Security Policy Specialist Inter-American Committee against Terrorism Secretariat for Multidimensional Security Organization of American States 1889 F Street N.W., Washington, D.C. 20006 T. 202-370-4675 F. 202-458-3857 kabarrett(a)oas.org www.oas.org/cyber Register to our distribution list here! -----Original Message----- From: ssr2-review-bounces(a)icann.org [mailto:ssr2-review-bounces@icann.org] On Behalf Of Jennifer Bryce Sent: Monday, June 5, 2017 11:45 AM To: Boban Krsic <krsic(a)denic.de>; SSR2 <ssr2-review(a)icann.org> Subject: [EXT] Re: [Ssr2-review] Work plan (draft) Sub Team 2 – ICANN Security Hi all, The Google doc version has been posted on the wiki here: https://community.icann.org/pages/viewpage.action?pageId=64076120 . RT members have editing rights. Best, Jennifer -----Original Message----- From: <ssr2-review-bounces(a)icann.org> on behalf of Boban Krsic <krsic(a)denic.de> Date: Sunday, June 4, 2017 at 10:24 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Work plan (draft) Sub Team 2 – ICANN Security Dear All, Please find attached a first draft of a work plan for subteam 2 - ICANN Security. I propose, that the basis for further development should be a gap analysis (without any obligations to certify something) based on the following two industrial standards: ISO/IEC 27001:2013 Information Security Management Systems (ISMS) and ISO 22301:2012 Business Continuity Management Systems (BCMS). With the use of both standards, we should be able to address all relevant work items that we identified in Madrid. For the beginning, I have created a simple MS Excel that consists all relevant information for project planning and realization of the gap analysis. The file contains a total of four sheets: * Sheet1 (Workplan) contains the main key action steps, a description of the action, expected outcome, evaluation methodology, required skill set, responsible person, proposed timeline, and finally a reference to Madrid’s work item list. The list is not finished and needs to be completed. * Sheet2 (Checklist 27001) contains 32 questions to address all relevant requirements of the main part of a ISMS based on ISO/IEC 27001. With the checklist, we are able to evaluate the following category groups: * Scope, relevant parties (stakeholder) * Leadership, roles and responsibilities * Risk management and risk treatment * Resources, competence, awareness and communication * Performance evaluation, internal audit and management review * Improvement of the ISMS * Sheet3 (Checklist 27001 – Annex A) contains a list of 114 questions based on the Annex A of ISO/IEC 27001. It is a list of security controls (or safeguards) that are to be used to improve security of information. The controls are structured, and the purpose of each of the 14 sections from Annex A [1]: * Information security policies - controls how to write and review policies * Organization of information security – controls on how the responsibilities are assigned * Human resources security – controls affecting the employment * Asset management – controls related to inventory of assets and acceptable use, also for information classification and media handling * Access control – controls for Access control policy, user access management, system and application access control, and user responsibilities * Cryptography – controls related to encryption and key management * Physical and environmental security – controls defining secure areas, entry controls, protection against threats, equipment security, secure disposal, clear desk and clear screen policy, etc. * Operational security – lots of controls related to management of IT production: change management, capacity management, malware, backup, logging, monitoring, installation, vulnerabilities * Communications security – controls related to network security, segregation, network services, transfer of information, messaging, etc. * System acquisition, development and maintenance – controls defining security requirements and security in development and support processes * Supplier relationships – controls on what to include in agreements, and how to monitor the suppliers * Information security incident management – controls for reporting events and weaknesses, defining responsibilities, response procedures, and collection of evidence * Information security aspects of business continuity management – controls requiring the planning of business continuity, procedures, verification and reviewing, and IT redundancy * Compliance – controls requiring the identification of applicable laws and regulations, intellectual property protection, personal data protection, and reviews of information security * Sheet4 (Checklist 22301) similar to sheet1 but with a focus on Business Continuity Management. The checklist contains a list of 90 questions to address all relevant requirements of a BCMS based on ISO 22301. With the checklist, we are able to evaluate the following category groups: * Scope, supply chain, l&r requirements and assurance * Leadership, roles and responsibilities * Risks and opportunities * Business continuity objectives and plans to achieve them * Human resources, competence and training and awareness * Communication and documentation * Operational planning and control * Business Impact Analysis (BIA) and Risk Assessment * Business continuity strategy / Resource recovery strategy * Incident response structure * Business continuity plans * Monitoring, measurement, analysis and evaluation * Internal audit and management review * Improvement of the BCMS I am using a similar list for my annually internal audits at DENIC. Altogether I would expect a total effort of approx. 15-20 m/d to perform key action steps 1.0 and 2.0. External consultants are also possible and in my view a good option. Jennifer, it would be great if you could import the file to google docs and share the link for editing purposes. Any feedback on this would be great. Regards, - Boban. [1]https://advisera.com/27001academy/knowledgebase/overview-of-iso-270012013… -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

3 2

Proposed agenda for SSR2 Review Team call -- 21:00 UTC , Tuesday, 06 June 2017
by Denise Michel June 7, 2017

June 7, 2017

Hello, All. Here’s the proposed agenda for our Tuesday, 6 June conference call: * Note updated SOIs & apologies/absences · Staff presentation: ICANN Global Stakeholder Engagement outreach efforts to SSR technical community (for Review Team consideration; follow-up request from Madrid meeting) * Review/discuss follow-up work on sub-topic groups (Žarko & Boban to lead first 2 bullets below) * Draft work plan for sub-topic “ICANN Security” (see Boban email & attachment) * Consolidating and reviewing sub-topic groups’ lists * Finalize volunteers list and discuss next steps * ICANN59 Johannesburg – agenda input * Review open action items list * AOB As always, comments are welcome. Staff will provide supporting slides shortly. Thanks. Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

3 2

From Patrick Jones - SSR2 Briefing on Outreach
by Karen Mulberry June 7, 2017

June 7, 2017

SSR2-RT Members, Here is what Patrick is covering on today’s call. Karen Mulberry Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN From: Patrick Jones <patrick.jones(a)icann.org> Date: Tuesday, June 6, 2017 at 7:46 AM To: Karen Mulberry <karen.mulberry(a)icann.org>, Adiel Akplogan <adiel.akplogan(a)icann.org> Cc: Steve Conte <steve.conte(a)icann.org>, Margie Milam <Margie.Milam(a)icann.org> Subject: Re: ASK - SSR2 Briefing on Outreach One more aspect that I failed to make clear in my comments is the role Global Stakeholder Engagement has with the DNS Engineering Team. GSE regularly works with stakeholders in the regions to answer questions and assist with the distribution of new L root instances around the world. Typically this involves fielding questions from Internet Service Providers and other infrastructure operators about the technical requirements for hosting an instance, connecting them with the DNS Engineering team, and doing any follow-up in case there are issues. Coordination between GSE and the DNS Engineering team is built into the process: https://www.dns.icann.org/lroot/host/ and has resulted in wide distribution of L root instances around the world. Patrick From: Patrick Jones <patrick.jones(a)icann.org> Date: Monday, June 5, 2017 at 6:39 PM To: Karen Mulberry <karen.mulberry(a)icann.org>, Adiel Akplogan <adiel.akplogan(a)icann.org> Cc: Steve Conte <steve.conte(a)icann.org>, Margie Milam <Margie.Milam(a)icann.org> Subject: Re: ASK - SSR2 Briefing on Outreach Karen, Below is a written summary in advance of tomorrow’s call. Patrick -- Overview of engagement on security, stability and resiliency issues Several departments within the ICANN Organization perform outreach and engagement on security, stability and resiliency issues. This includes the technical community engagement of the Office of the CTO, Global Stakeholder Engagement and Government Engagement teams, DNS Engineering, Public Technical Identifiers (IANA), and Global Domains Division. Global Stakeholder Engagement helps support the work of the Office of the CTO, representing ICANN at technical community events (often attending events such as IETF, DNS-OARC, Network Operator Group meetings, Regional Internet Registry meetings, regional TLD organization meetings, DNS Forums and DNS Symposiums), supporting DNSSEC training, DNS abuse and misuse training with public safety entities, individual training with ccTLD operators, regional and national Internet Governance Forums, cybersecurity conferences and related technical events. We work with our Government Engagement colleagues on requests from the GAC Public Safety Working Group and in facilitating DNS training for recent GAC capacity development events in Nairobi and Vanuatu (see https://www.icann.org/news/announcement-2017-01-13-en and https://www.icann.org/news/announcement-3-2017-04-20-en) . Global Stakeholder Engagement has regular contacts with the Office of the CTO to ensure ICANN’s SSR engagement is coordinated and that community requests for engagement and training are tracked. The Global Stakeholder Engagement team uses its knowledge of the wider Internet community in the regions to identify participation gaps at ICANN and encourage stakeholders to contribute public comments and expertise in ICANN policy work related to the unique identifier systems within ICANN’s Mission. I have personally given talks on DNS, DNSSEC and ICANN’s SSR role and remit at regional and national IGFs, with ccTLDs, regional NOG meetings, Organization of American States, talks with participants from underserved regions at the US Telecommunications Training Institute (USTTI) and technical experts with the UN Group of Experts on Geographic Names. I regularly work with the Office of the CTO to identify subject matter experts and resources to speak on behalf of ICANN in technical engagement activities, trainings and other meetings. Adiel has covered similar other talks at IETF, with NOGs, I* partners, RIRs and others such as at the recent Africa Internet Summit. -- Patrick L. Jones Senior Director, Global Stakeholder Engagement Internet Corporation for Assigned Names & Numbers 801 17th Street, NW Suite 400 Washington, DC 20006 Tel: +1 310 967 9084 patrick.jones(a)icann.org

2 1

Apologies
by James Gannon June 6, 2017

June 6, 2017

Hi everyone apologies I just got off a delayed flight, sorry if I miss anything important. I'll have a read of the transcript once its posted.

2 1

Re: [Ssr2-review] Work plan - Sub topic 1 (SSR1 Review)
by Jennifer Bryce June 6, 2017

June 6, 2017

Hi all, The SSR1 subtopic work plan draft developed by Žarko is now in Google docs. You can find also it on the wiki ‘Documents & Drafts’ page: https://community.icann.org/pages/viewpage.action?pageId=64076120 -----Original Message----- From: <ssr2-review-bounces(a)icann.org> on behalf of Žarko Kecić <Zarko.Kecic(a)rnids.rs> Date: Monday, June 5, 2017 at 4:23 PM To: SSR2 <ssr2-review(a)icann.org> Subject: [Ssr2-review] Work plan - Sub topic 1 (SSR1 Review) Dear Team members, Attached is a draft plan (Excel) with the main tasks to review the implementation of recommendations made by the SSR1 Team. The recommendations are grouped on the basis of a briefing in Madrid. This will simplify planning activities related to the review of the SSR1 implementation. Those are main tasks that Sub-team 1 should perform and additional tasks will be added when we dig deeper into review process. There are the tasks that overlap with the tasks allocated to the other sub-topics and it is one of the things that need to be resolved as soon as possible. I've made a few comments (see attached document SSR2-Topics-20170603v1.1ZK), but it should be a joint effort of the team. There is no need to incorporate my comments into valid copy of the document since we'll have the joint exercise with the aim of reaching an agreement. The skills that I used in the draft work plan are: Policy and law (PL) Business & processes (BP) Risk (RA) Technical (TE) ICT security (IS) Skills that are added to each task reflect my opinion based on limited knowledge and understanding, and I cannot guarantee that they fully meet the requirements of the corresponding activities. Sub-teams will define the real needs Best regards, Žarko

1 0

Work plan - Sub topic 1 (SSR1 Review)
by Žarko Kecić June 5, 2017

June 5, 2017

Dear Team members, Attached is a draft plan (Excel) with the main tasks to review the implementation of recommendations made by the SSR1 Team. The recommendations are grouped on the basis of a briefing in Madrid. This will simplify planning activities related to the review of the SSR1 implementation. Those are main tasks that Sub-team 1 should perform and additional tasks will be added when we dig deeper into review process. There are the tasks that overlap with the tasks allocated to the other sub-topics and it is one of the things that need to be resolved as soon as possible. I've made a few comments (see attached document SSR2-Topics-20170603v1.1ZK), but it should be a joint effort of the team. There is no need to incorporate my comments into valid copy of the document since we'll have the joint exercise with the aim of reaching an agreement. The skills that I used in the draft work plan are: Policy and law (PL) Business & processes (BP) Risk (RA) Technical (TE) ICT security (IS) Skills that are added to each task reflect my opinion based on limited knowledge and understanding, and I cannot guarantee that they fully meet the requirements of the corresponding activities. Sub-teams will define the real needs Best regards, Žarko

1 0