- Ssr2-review - lists.icann.org

Re: [Ssr2-review] [EXT] Q&A Document
by Barrett, Kerry-Ann May 17, 2019

May 17, 2019

Thanks Naveed Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States On May 17, 2019, at 10:21 AM, Naveed Bin Rais <naveedbinrais(a)gmail.com<mailto:naveedbinrais@gmail.com>> wrote: CAUTION: EXTERNAL SENDER https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

SSR2 Compliance discussion today 13:15 UTC
by Jennifer Bryce May 17, 2019

May 17, 2019

All, Per the agenda, the team will be discussing the compliance items today at 13:15 UTC for 90 minutes. Please join the team for that part of the discussion if you are able. Zoom: https://icann.zoom.us/j/493602415. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

TLD-OPS: ccTLD Security and Stability Together
by Boban Krsic May 17, 2019

May 17, 2019

FYI - https://ccnso.icann.org/en/resources/tld-ops-secure-communication.htm -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Martin Küchenthal, Andreas Musielak, Sebastian Röthler, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main

1 0

registrar hack
by Denise Michel May 17, 2019

May 17, 2019

FYI, per discussion: https://krebsonsecurity.com/2019/02/crooks-continue-to-exploit-godaddy-hole/

1 1

FYI - FW: Critical domains and RegistryLock presentation Registration Ops Workshop
by Denise Michel May 17, 2019

May 17, 2019

Subject: Critical domains and RegistryLock presentation Registration Ops Workshop http://regiops.net/wp-content/uploads/2019/05/ROW8-RLPanel-DNSpionage-and-R…

1 0

Brussels day 1 detailed agenda
by Jennifer Bryce May 17, 2019

May 17, 2019

Dear SSR2 RT members, Russ has prepared the attached detailed agenda for day one of the Brussels meeting. The expectation is that each group will use the time to finalize the write ups within the workstreams. Please review the attached and share any questions/comments on list. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

3 3

ICANN SSR and DNS SSR answers
by Jennifer Bryce May 14, 2019

May 14, 2019

Dear SSR2 RT members, The below answers have been added to the Q&A Google doc: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…>. There is now 1 outstanding question in the ICANN SSR workstream. We expect this outstanding answer this week. Review Team volunteers: Denise, Kerry-Ann, Zarko Workstream: ICANN SSR Topic 7: Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding registrar agreements and the consensus policies. Outstanding questions: 0 Q: During the presentation in LA in October 2017, Francisco referred to internal procedures to deal with SLA monitoring cases that require follow up, please provide SSR2 with a copy? A: ICANN org’s internal operating procedures for addressing SLA monitoring cases that require follow-up can be described generally, but are not documented in a form for external publication. The procedures include detailed steps to be followed by the technical team that is on-call when responding to performance issues found in the DNS and RDDS. For example, when each service threshold is met, the procedures indicate which of the registry operator’s contacts to alert, how to alert them (e.g., via email and/or phone), and in what order they are attempted to be contacted. The procedures also describe what logs should be collected and when, to check whether there is a maintenance window scheduled for the service/TLD and whether the issue is caused by a TLD revocation. Additionally, the procedures indicate the thresholds at which escalation for a potential EBERO event are to be started. Q: What is the status of the registry service provider certification program? Is ICANN Org recommending any changes? What is the status of this issue within the Subsequent Procedures PDP? A: The Registry Service Provider (RSP) pre-approval was a topic of discussion <https://community.icann.org/download/attachments/74587868/Letter%20from%20R…> of a small group within the RySG. The small group delivered a recommendation<https://mm.icann.org/pipermail/gnso-newgtld-wg/2018-February/000935.html> to the Subsequent Procedures PDP working group and ICANN org provided recommended changes. It is up to the PDP WG to make its recommendations to the GNSO Council. The Subsequent Procedures working group discussed the recommendations in the course of its deliberations and formulated a set of initial recommendations that were published for public comment on 3 July 2018<https://www.icann.org/public-comments/gtld-subsequent-procedures-initial-20…>. The RSP pre-approval recommendation can be reviewed in section 2.2.6 of the Initial Report.<https://gnso.icann.org/sites/default/files/file/field-file-attach/subsequen…> Please note that the working group is developing final recommendations, which may not be the same as those found in the Initial Report. Review Team volunteers: Norm, Ram Workstream: ICANN SSR Topic 6: Perform an assessment of how effectively ICANN has implemented its processes around vetting registry operators and services concerning the New gTLD Delegation and Transition process. Outstanding questions: 0 Q: Referencing the EBERO testing of Fall, 2017 (https://schd.ws/hosted_files/icann60abudhabi2017/08/7%20EBERO%20Arias.pdf. Has the Root Cause Analysis been conducted? If so, is there a reference to the report? A: The slides referenced in the question describe the EBERO exercises conducted up to that point in time. Each of these exercises were conducted in the context of a registry that was being decommissioned, rather than cases of registry failure. ICANN org asked the registry operators involved in those exercises, who were each operating a TLD that was being decommissioned, for permission to use their TLDs to do EBERO exercises just prior to termination and removal from the root. The issues described on slides 18 and 19 are related to the internal, detailed procedures that are followed in an EBERO event. The issues identified during the exercises were minor (e.g., missing step to send email to someone) and did not require a root cause analysis. All identified issues were fixed promptly after the exercises by updating the EBERO procedures. Review Team volunteers: Russ, Laurin, Zarko Workstream: DNS SSR Topic: IDN domain names (glyph phish) Outstanding questions: 0 Q: Does ICANN support studies and research into the abuse of the DNS / URLs for phishing? If so, is there any documentation, outcome reports, etc? A: ICANN’s Office of the CTO (OCTO) provides anonymized monthly reports from the Domain Abuse Activity Reporting (DAAR)<https://www.icann.org/octo-ssr/daar> system, which monitors the amount of spam, phishing, malware, and botnet domains in the DNS. Also note Recommendation 16 from the CCT Review Team, which the ICANN Board directed<https://www.icann.org/en/system/files/files/resolutions-final-cct-recs-scor…> in part to the SSR2 Review Team: Further study the relationship between specific registry operators, registrars, and DNS Security Abuse [which includes phishing] by commissioning ongoing data collection, including but not limited to, ICANN Domain Abuse Activity Reporting (DAAR) initiatives. For transparency purposes, this information should be regularly published, ideally quarterly and no less than annually, in order to be able to identify registries and registrars that need to come under greater scrutiny, investigation, and potential enforcement action by ICANN organization. Upon identifying abuse phenomena, ICANN should put in place an action plan to respond to such studies, remedy problems identified, and define future ongoing data collection. OCTO will continue to publish DAAR reports. Should the above recommendation be implemented, further studies on phishing may be carried out Q: Does ICANN liaise with the main browser manufacturers regarding URL handling, e.g. IDN display, warnings, etc? A: Liaising with browsers for IDN display and warnings relates to Universal Acceptance of domain names. The community has organized a Universal Acceptance Steering Group (UASG) to undertake these tasks, which ICANN org has been supporting. Soon after its formation, in 2015/2016 UASG found multiple issues in how browsers were handling domain names. For example, in the browsers, domain names under new top-level domains were being used as search items instead of domain names and IDNs were not being displayed correctly. UASG engaged in discussions with Google, Apple, and Microsoft to raise these issues about the respective browsers. Some discussions were also done with Mozilla. UASG performed an evaluation of browsers, detailed in its report UASG016<https://uasg.tech/wp-content/uploads/2017/09/UASG-Report-UASG016.pdf>, which tested 17 URLs in eight browsers on six different operating systems (four desktop, two mobile). A reasonable support was shown in most browsers on desktop platforms (with some challenges for domain names in right-to-left scripts) but more varied results were found in mobile platforms. See the report for further details. UASG is now considering to undertake the browser evaluation exercise again in FY20 as it reconsiders the evaluation criteria for testing these browsers (e.g. reconsider testing for open dot) and as it looks to include more Android based browsers from China. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] Compliance responses
by Jennifer Bryce May 13, 2019

May 13, 2019

Dear all, The attached document is an update to the compliance responses previously shared below, as some links in the previous document did not work. The fixed links are the only update to the document. Best, Jennifer From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Jennifer Bryce <jennifer.bryce(a)icann.org> Date: Wednesday, May 8, 2019 at 9:12 AM To: "ssr2-review(a)icann.org" <ssr2-review(a)icann.org> Subject: [Ssr2-review] Compliance responses Dear SSR2 RT members, ICANN Compliance has provided the attached information regarding the questions asked in advance of the discussion scheduled for 14th May. These have been posted to the wiki here: https://community.icann.org/x/zgRpBQ. The call with ICANN Compliance remains scheduled for the 14th May as we understand that the review team members involved still wish to have the call, but please do let us know if anything changes based on the responses provided. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [EXT] Brussels F2F Agenda
by Barrett, Kerry-Ann May 13, 2019

May 13, 2019

Perfect Thanks Russ [OAS.org]<http://www.oas.org/> Sincerely Kerry-Ann Barrett Cybersecurity Program Officer Secretariat of the Inter-American Committee against Terrorism (CICTE) Secretariat for Multidimensional Security (SMS) Organization of American States 1889 F Street NW Washington D.C. 20006 [http://www.oas.org/en/sms/signature_images/phone.png] (202) 370 4675 - [http://www.oas.org/en/sms/signature_images/fax.png] (202) 458 3857 www.oas.org/cyber<http://www.oas.org/cyber> @KerryOAS<https://twitter.com/KerryOAS>| @OEA_Cyber<https://twitter.com/OEA_Cyber> Register to our distribution list here!<http://oas.us11.list-manage.com/subscribe?u=353ff0663258ae5a775d460db&id=10…> From: Russ Housley [mailto:housley@vigilsec.com] Sent: Monday, May 13, 2019 2:02 PM To: Barrett, Kerry-Ann <KABarrett(a)oas.org> Cc: ICANN SSR2 <ssr2-review(a)icann.org> Subject: Re: [Ssr2-review] [EXT] Brussels F2F Agenda CAUTION: EXTERNAL SENDER Kerry-Ann: I put together a detailed agenda for Day 1. There is a cluster of topics that cannot make too much progress until the call with the compliance folks happens tomorrow. Since that leaves very little time for people to digest what they hear, I have put 90 minutes on the agenda for the whole team. That will start at 15:15 (Brussels time) and go for 90 minutes. This is the only part of the agenda on Day 1 of the Brussels face-to-face meeting where remote participation will be productive. Russ On May 9, 2019, at 3:46 PM, Barrett, Kerry-Ann <KABarrett(a)oas.org<mailto:KABarrett@oas.org>> wrote: Thanks Jen Dear Team, I wanted to suggest for those of us participating remotely, if we can indicate which time slots would require the most consensus in plenary. For example, it doesn’t seem feasible to join in on Day 1 except for maybe the debrief but it makes sense to participate on Day 2 during the second Agenda item. Let me know if that approach sounds reasonable. Cheers [OAS.org]<http://www.oas.org/> Sincerely Kerry-Ann Barrett Cybersecurity Program Officer Secretariat of the Inter-American Committee against Terrorism (CICTE) Secretariat for Multidimensional Security (SMS) Organization of American States 1889 F Street NW Washington D.C. 20006 [http://www.oas.org/en/sms/signature_images/phone.png] (202) 370 4675 - [http://www.oas.org/en/sms/signature_images/fax.png] (202) 458 3857 www.oas.org/cyber<http://www.oas.org/cyber> @KerryOAS<https://twitter.com/KerryOAS>| @OEA_Cyber<https://twitter.com/OEA_Cyber> Register to our distribution list here!<http://oas.us11.list-manage.com/subscribe?u=353ff0663258ae5a775d460db&id=10…> From: Ssr2-review [mailto:ssr2-review-bounces@icann.org] On Behalf Of Jennifer Bryce Sent: Thursday, May 9, 2019 11:21 AM To: ICANN SSR2 <ssr2-review(a)icann.org<mailto:ssr2-review@icann.org>> Subject: [EXT] [Ssr2-review] Brussels F2F Agenda CAUTION: EXTERNAL SENDER Dear SSR2 Review Team members, Please find attached the agenda for the face-to-face meeting in Brussels, as Russ outlined today on the call. Please share any comments or questions you have on-list. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org> Skype: jennifer.bryce.icann www.icann.org<http://www.icann.org/> _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

Re: [Ssr2-review] [EXT] Brussels F2F Agenda
by Barrett, Kerry-Ann May 13, 2019

May 13, 2019

Thanks Jen Dear Team, I wanted to suggest for those of us participating remotely, if we can indicate which time slots would require the most consensus in plenary. For example, it doesn’t seem feasible to join in on Day 1 except for maybe the debrief but it makes sense to participate on Day 2 during the second Agenda item. Let me know if that approach sounds reasonable. Cheers [OAS.org]<http://www.oas.org/> Sincerely Kerry-Ann Barrett Cybersecurity Program Officer Secretariat of the Inter-American Committee against Terrorism (CICTE) Secretariat for Multidimensional Security (SMS) Organization of American States 1889 F Street NW Washington D.C. 20006 [http://www.oas.org/en/sms/signature_images/phone.png] (202) 370 4675 - [http://www.oas.org/en/sms/signature_images/fax.png] (202) 458 3857 www.oas.org/cyber<http://www.oas.org/cyber> @KerryOAS<https://twitter.com/KerryOAS>| @OEA_Cyber<https://twitter.com/OEA_Cyber> Register to our distribution list here!<http://oas.us11.list-manage.com/subscribe?u=353ff0663258ae5a775d460db&id=10…> From: Ssr2-review [mailto:ssr2-review-bounces@icann.org] On Behalf Of Jennifer Bryce Sent: Thursday, May 9, 2019 11:21 AM To: ICANN SSR2 <ssr2-review(a)icann.org> Subject: [EXT] [Ssr2-review] Brussels F2F Agenda CAUTION: EXTERNAL SENDER Dear SSR2 Review Team members, Please find attached the agenda for the face-to-face meeting in Brussels, as Russ outlined today on the call. Please share any comments or questions you have on-list. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org> Skype: jennifer.bryce.icann www.icann.org<http://www.icann.org>

2 1