- Ssr2-review - lists.icann.org

Updated subtopic volunteers
by Jennifer Bryce May 23, 2017

May 23, 2017

Hi all, The subtopics document is now updated with the volunteers from plenary call 12: https://community.icann.org/pages/viewpage.action?pageId=64076120&preview=/… Current list of volunteers: Topic Volunteers 1. SSR1 Review Denise, Alain, Ram Krishna 1. ICANN Security James, Denise, Boban, Noorul Ameen, Kerry-Ann, Žarko 1. DNS Security Emily, Alain, Cathy, Matogoro, Ram Krishna, Geoff, Amin Hasbini, Žarko 1. Future Threats Emily, Kerry-Ann, Matogoro, Amin Hasbini, Noorul Ameen 1. IANA Transition Cathy, James, Geoff, Eric 1. Other -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2 Meeting Call - Tuesday, 23 May 2017
by Žarko Kecić May 23, 2017

May 23, 2017

Hi all, I would like to repeat what I've said in the chat room. I can work on business process analysis, DNS and security items. As far as I can estimate, I am nominating myself for DNS and ICANN security sub-groups. Also, I am willing to help in any other sub-group where it is needed. I believe that we can't have the final list of members of the subgroups until we define the tasks and activities. Also, I'll finish workplan proposal for SSR1 Review sub-group. I am in the middle of that but I really didn't have time to finish it for today. Nearly two weeks out of the office brought a pile of unfinished tasks at home. Regards, Žarko

3 3

Call 0600 UTC 23/5/17
by Cathy Handley May 22, 2017

May 22, 2017

I will not be on this call. Cathy Cathy Handley Executive Director Government Affairs American Registry for Internet Numbers (ARIN) Mobile: +1 703 341 7996 Fax: +1 703 263 0111 Email: chandley(a)arin.net<mailto:chandley@arin.net> Confidentiality Notice: This message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please delete.. Thank you.

1 0

Connectivity Concerns for SSR2 Meeting Call - Tuesday, 23 May 2017 @ 0600 UTC
by MSSI Secretariat May 22, 2017

May 22, 2017

Hello SSR2 Review Team - Good day. I just wanted to touch base regarding connectivity concerns for our next SSR2 Meeting Call scheduled for Tuesday, 23 May 2017 @ 06:00 UTC. We have conquered many of the noise disturbances previously present and would like to ensure continued connectivity on future calls. For the best results in regions with connectivity concerns, we suggest doing the following... * Connect to the Adobe Connect (https://participate.icann.org/ssrreview) 20-30 minutes before the scheduled call - the Adobe Connect room will be open and I will be available to assist you - in addition we can resolve any microphone/static/connection issues ahead of time - including connecting with international operators if need be. The goal is to have all connection concerns resolved by the top of the hour for the benefit of the team. * Be located (if possible) in an area that has proper broadband connection and is quiet - thus creating a strong signal connection, making it possible to see and hear in the Adobe Connect Room. * Feel free to Skype me either before, during or after the call - my skype address is yvette.guigneaux.icann - this way I can respond to you almost immediately for whatever you may need - including having the Adobe Connect Room dial out to you if need be. We will also have Tech Support on this call to trouble shoot any AC Room issues should they arise. As your SSR2 Review Team Secretariat, I am determined to create an atmosphere where you can clearly participate in the Adobe Connect Room. Thank you everyone and I look forward to seeing you all on our upcoming call. :) Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2D2E4.72564AC0]

5 4

Draft slides SSR Plenary 12
by Jennifer Bryce May 22, 2017

May 22, 2017

Dear all, Attached are the draft slides for the SSR2-RT plenary call, Tuesday 23 May at 06:00 UTC. The latest topics and volunteers document can be found here (also attached): https://community.icann.org/pages/viewpage.action?pageId=64076120&previe&pr… Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Agenda SSR2 Plenary #12 on 23May 2017 at 0600UTC
by Karen Mulberry May 19, 2017

May 19, 2017

Dear SR2-RT, SSR2-RT Plenary # 12 23 May 2017 0600 UTC Agenda * Updated SOIs & note apologies/absences * Madrid follow-up: review of topics list and volunteers (see document circulated on list); brainstorming/discussion on next steps for Review Team * ICANN59 Johannesburg – agenda brainstorming discussion; update on meeting issues * Review open action items list & team members’ to-do list * AOB Note: ICANN59 Johannesburg approved travel dates for RT members are June 24 to 30 ICANN60 Abu Dhabi SSR2-RT meeting will be held on October 27, 2017 Sincerely, Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

1 0

DNS Symposium presentations
by Jennifer Bryce May 18, 2017

May 18, 2017

Dear all, ICANN DNS Symposium presentations have been posted here: https://www.icann.org/resources/pages/agenda-ids-2017-05-14-en I’ve also added a link to the background materials page on the wiki. Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Google Doc's Topic Table
by Karen Mulberry May 15, 2017

May 15, 2017

Link to the Google Doc table of the topics https://docs.google.com/document/d/1Q6yN3H3Jb8WHKoUNUN04haKmNGkqpgW8YxzpELb… Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

1 0

Re: [Ssr2-review] [EXT] Re: SSR2 Google Drive and Google Doc for Input
by Barrett, Kerry-Ann May 15, 2017

May 15, 2017

Hi everyone I was unable to edit as well. I'm in additional security checks so won't be able to join as planned. I also had points 1-3 of Emily's as well as: 1. Physical security requirements in place and enforcement of minimum security specification for DNSSEC key storage Facility 2. Level of compliance requirement for registrars agreements 3. SLAM and performance indicators 4. With regards to SSR1, implementation of Rec 7, 10, 11 and 27, to see to what extent the current OCTO research feeds into the risk management framework especially in relation to the SSR of unique identifier space. An observation from SSR 1 was to ensure ICANN outlines its process for security stability and resilience and keeping in mind comment made yesterday regarding OCTO's mandate we should revisit how clear this outlines. ( if not clear I can clarify in email list) All the best today Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist On May 15, 2017, at 8:38 AM, Emily Taylor <emily.taylor(a)oxil.co.uk<mailto:emily.taylor@oxil.co.uk>> wrote: Hi all I was also unable to write in changes into the document. Here are my suggestions. I'm basing these on Eric's bullet points. * Universal resolvability: Can identifiers be uniquely resolved and consumed? * Alternate root * Name collisions (status and remediations) * Universal resolvability and the internet of things * IPv6 / CGN complexity (query the role of ICANN on this?) * Headline and not-so-headline threats and exploits * DDoS * Improving the security of unique identifiers * DNSSec (progress, Key roll over) * Universal acceptance: Can identifiers be consumed by clients * IDNs and new gTLDs * Platforms, approaches, and status * Measures and metrics * How can the community measure the status of ‘S’, ‘S’, and ‘R’? * What are, and how can the community measure the relevant abuses for ICANN identifiers? * The evidence base: DNS health index and abuse data. What the evidence tells us; access to information (risks and benefits) * ICANN's internal security, stability and resiliency operations: * Allocation of resources and priority within the organisation * Outreach and public information role (training, vulnerability disclosure, system attack mitigation etc) * Risk management, compliance with relevant frameworks. * White-hat operations * What are the white-hat operations that are taken in ICANN space that may need exceptional handling (gratis for registering sink-holes, etc.) On Mon, May 15, 2017 at 7:12 AM, Osterweil, Eric via Ssr2-review <ssr2-review(a)icann.org<mailto:ssr2-review@icann.org>> wrote: My changes are also not being saved in the doc. Here is my list (it’s a little rough because I retyped in a hurry after realizing that it didn’t get saved the first time). Eric (second try) * Universal resolvability: Can identifiers be uniquely resolved and consumed? * Alternate root * Name collisions (status and remediations) * Universal acceptance: Can identifiers be consumed by clients * Platforms, approaches, and status * Measures and metrics * How can the community measure the status of ‘S’, ‘S’, and ‘R’? * What are, and how can the community measure the relevant abuses for ICANN identifiers? * White-hat operations * What are the white-hat operations that are taken in ICANN space that may need exceptional handling (gratis for registering sink-holes, etc.) Eric From: <ssr2-review-bounces(a)icann.org<mailto:ssr2-review-bounces@icann.org>> on behalf of ALAIN AINA <aalain(a)trstech.net<mailto:aalain@trstech.net>> Date: Monday, May 15, 2017 at 7:24 AM To: SSR2 <ssr2-review(a)icann.org<mailto:ssr2-review@icann.org>> Subject: [EXTERNAL] Re: [Ssr2-review] SSR2 Google Drive and Google Doc for Input Hello, I also have some issues accessing and editing the document, see below : Possible focus area. ====== - Complete the assessment of the implementation of SSR1 recommendations, the impact of the implementation, how the post implementation is being managed and what implications for the SSR2 review. - Scope of ICANN’s SSR responsibilities: action zone, influence zone, coordination zone *ICANN SSR responsibility for the coordination of the global unique Identifiers *ICANN operational role *ICANN influence role (TLD operators, registrars ….), *ICANN coordination role( IETF, RIRs Root zone operators ,technical community - Effectiveness of ICANN’s SSR framework, SSR Plan and its implementation *Security framework * Contingence planning *security framework robustness for a rapid evolving security environment ========= On 14 May 2017, at 17:28, Boban Krsic <krsic(a)denic.de<mailto:krsic@denic.de>> wrote: Dear All, Given that I could not access the Google Drive folder, please find my homework in accordance to James proposal below ;-) ----- Focus on Sub-Team Number 2 - ICANN’ Internal Security Processes The sub team will be responsible for reviewing the completeness and effectiveness of ICANNs internal security processes and the effectiveness of the ICANN security framework Due to ICANN’s orientation to ISO/IEC 27001 I would recommend to provide a gap-analysis to the normative requirements of the management part and Annex A of the ISO standard based on the SoA (Scope). - Perform interviews and review descriptions and evidence of: * ISMS Scope * Information security policy * Information risk assessment and risk treatment processes * Information security objectives * Information security roles and responsibilities * ISMS internal audit program and results of conducted audits * Operational planning and control documents * Evidence of top management reviews of the ISMS Various others from the Annex A like rules for acceptable use of assets, access control policy, operating procedures, confidentiality or non-disclosure agreements, secure system engineering principles, information security policy for supplier relationships, etc. - Categorize and prioritize the outcome of the analysis - Develop a short-, medium- and long-term schedule to implement different controls in accordance to the requirements - Define a set of metrics to measure the effectiveness of the implementation With the goal to achieve a high level of maturity and to pass a successful certification process concerning ICANNs ISMS. Best, - Boban. Am 14.05.17 um 17:08 schrieb Karen Mulberry: Dear SSR2 Review Team, Per the discussion this afternoon on next steps, I have created a Google Drive for the SSR2 Review Team to place their collaborative materials. Here is the link to the Folder where I have created a Google Doc for you to add your areas of interest or topics for tomorrow’s planning discussion. https://drive.google.com/drive/folders/0B_IP1b20BSBUcndyOFVpbEZKbTQ?usp=sha… Sincerely, Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745<tel:(424)%20353-9745> _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de<mailto:krsic@denic.de>, Fon: +49 69 272 35-120<tel:+49%2069%2027235120>, Fax: -248 Mobil: +49 172 67 61 671<tel:+49%20172%206761671> https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review -- Emily Taylor CEO, Oxford Information Labs Associate Fellow, Chatham House; Editor, Journal of Cyber Policy PLEASE NOTE MY NEW EMAIL ADDRESS AND CONTACTS AS OF 1 JANUARY 2017 Magdalen Centre, Oxford OX4 4GA | T: 01865 582885 E: emily.taylor(a)oxil.co.uk<mailto:emily.taylor@oxil.co.uk> | D: 01865 582811 | M: +44 7540 049322 [https://s3-eu-west-1.amazonaws.com/static.oxil/oxil_logo-150x.png] [https://docs.google.com/a/oxil.co.uk/uc?id=0B7sS_6djDxsHNm92d21jM21HMDQ&exp…] <http://explore.tandfonline.com/cfp/pgas/rcyb-cfp-2017> Registered office: 37 Market Square, Witney, Oxfordshire OX28 6RE. Registered in England and Wales No. 4520925. VAT No. 799526263 . _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

3 2

Re: [Ssr2-review] Revised SSR2 Google Doc
by Karen Mulberry May 15, 2017

May 15, 2017

One more try – hopefully the editing rights are there this time. https://docs.google.com/document/d/1qco8EDhzxFbLVMaC6Jy7s9hGhvCjWdzsSLR9FPp… Karen Mulberry Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN From: <ssr2-review-bounces(a)icann.org> on behalf of Karen Mulberry <karen.mulberry(a)icann.org> Date: Monday, May 15, 2017 at 8:42 AM To: SSR2 Review Team Email List <ssr2-review(a)icann.org> Subject: [Ssr2-review] Revised SSR2 Google Doc In the Google Folder for SSR2 there is now a Google Doc that you should be able to edit and contribute to. It can be found at this link https://docs.google.com/document/d/1qco8EDhzxFbLVMaC6Jy7s9hGhvCjWdzsSLR9FPp… Karen Mulberry Director, Multistakeholder Strategy and Strategic Initiatives (MSSI) ICANN 12025 Waterfront Dr., Suite 300 Los Angeles, CA 90094 Phone: +1 424 353 9745

1 0