- Ssr2-review - lists.icann.org

FYI ICANN 60 draft schedule
by Denise Michel Oct. 6, 2017

Oct. 6, 2017

Hi, All. Attached is a draft schedule for ICANN60, FYI. I believe a final schedule is to be posted on icann.org next week. Best, Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

Board letter on Subgroup 2's scope
by Kaveh Ranjbar Oct. 5, 2017

Oct. 5, 2017

Dear SSR2 Team, Please find below a letter from the ICANN Board, indicating our concern on scope of Subgroup 2’s audit plan. SSR2 will receive this letter through the standard board communication channel shortly, but in the meantime I thought it is good to share the text with you, since time is of essence. Please let me know if you have any questions or comments. All the best, Kaveh. ===== To: SSR2 Team Members The ICANN Board recently examined the proposed work plan for SSR2’s Subteam 2 on ICANN SSR, and has identified some areas of concern to flag for the broader Review Team. The mandate of the SSR2, from the Bylaws, is to perform a review of “ICANN's execution of its commitment to enhance the operational stability, reliability, resiliency, security, and global interoperability of the systems and processes, both internal and external, that directly affect and/or are affected by the Internet's system of unique identifiers that ICANN coordinates.” The SSR2’s working definitions, set out in the Terms of Reference, also affirms the focus of the SSR2’s work on the Internet’s unique identifiers: ·Security – The capacity to protect and prevent misuse of Internet unique identifiers; ·Stability – The capacity to ensure that the Identifier System operates as expected and that users of unique identifiers have confidence that the system operates as expected; ·Resiliency – The capacity of the Identifier System to effectively withstand, tolerate and survive malicious attacks and other disruptive events without disruption or cessation of service. ·Unique Identifiers - ICANN’s technical mission includes helping to coordinate, at the overall level, the allocation of the Internet’s system of unique identifiers: specifically, top-level domain names, blocks of Internet Protocol (IP) addresses and autonomous system (AS) numbers allocated to the Regional Internet Registries, and protocol parameters as directed by the IETF. As the Board noted in its 23 June 2017 response to the Terms of Reference, the Board looks forward to providing further input once the SSR2’s work plan is finalized and adopted. While the Board has not yet seen a final work plan for the review as a whole, our examination of the Subgroup 2 work plan on the performance of an audit over general ICANN security issues raised some scope concerns. While we support the community in receiving information necessary to perform a full and meaningful review over ICANN’s SSR commitments, there are portions of the more detailed “audit” plan that do not seem appropriate for in-depth investigation by the subgroup. Maintaining a plan to proceed with detailed assessments of these areas is likely to result in recommendations that are not tethered to the scope of the SSR review, and as such, may not be appropriate for Board acceptance when recommendations are issued. This also can expand the time and resources needed to perform this part of the review. The areas the Board is concerned with are areas that indeed raise important organizational information security and organizational oversight questions. However, these are also areas that are not segregated for community review, and are the responsibility of the ICANN Organization (through the CEO) to perform under the oversight of the ICANN Board. Specifically, we are concerned with 1- Perform an assessment of ICANN's Information Security Management System; 3- Perform a comprehensive assessment of ICANN's Risk Management Methodology and Framework; 5- Perform a comprehensive assessment of internal security, stability and resiliency of ICANN's operation processes and services; and 7- Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding REGISTRAR agreement and the consensus policies. The Board also has concerns with two sub-questions under section two: 2.7 Business Continuity Plans (BCP) 2.8 Evaluation of Business Continuity Procedures Understanding, at a high level, the work that ICANN does on many of these fronts could be helpful to give the RT a full picture of ICANN’s work. That is much different from performing detailed assessments or audits of these items. In advance of the Subteam’s visit to the ICANN office in Los Angeles in October 2017, the Subteam is encouraged to focus on narrowing the areas scheduled for fuller assessment to those that are more reasonably tethered to the expected mandate of the SSR2 team. The Board supports an agenda that provides a high-level overview of multiple topics, while also focusing the Subteam’s face-to-face time primarily on those areas which are likely to lead to recommendations that are within the scope of the SSR2’s mandate. The Board requests the SSR2 to revisit the Subteam 2 audit plan, as well as work plans across all the SSR2 Subteams, and provide updates on those plans. For Subteam 2, the Board requests confirmation of the restructuring of its work plan prior to the October 2017 face-to-face meeting. =====

7 7

Re: [Ssr2-review] Email replying to Board
by Barrett, Kerry-Ann Oct. 5, 2017

Oct. 5, 2017

And mine Sincerely, Kerry-Ann Barrett Cyber Security Policy Specialist Inter-American Committee against Terrorism Secretariat for Multidimensional Security Organization of American States 1889 F Street N.W., Washington, D.C. 20006 T. 202-370-4675 F. 202-458-3857 kabarrett(a)oas.org www.oas.org/cyber Register to our distribution list here! -----Original Message----- From: ssr2-review-bounces(a)icann.org [mailto:ssr2-review-bounces@icann.org] On Behalf Of James Gannon Sent: Thursday, October 5, 2017 3:35 PM To: Osterweil, Eric <eosterweil(a)verisign.com> Cc: SSR2 Review Team Email List <ssr2-review(a)icann.org> Subject: [EXT] Re: [Ssr2-review] Email replying to Board It has my support. Jame s > On 5 Oct 2017, at 21:33, Osterweil, Eric via Ssr2-review <SSR2-review(a)icann.org> wrote: > > Team, > > Just to clarify, the intended messaging we want to send to the Board is currently planned to be nothing more than a stop-gap message. Our plan has been to just summarize how we got here, and to defer the important discussion of our path forward to a later time/communication when the team has had a chance to meet, get on the same page, and to vet a detailed/team-centric perspective. > > The idea of postponing the LA meeting comes a little late in the process (as this has been under discussion for months, and we are now just days away, with travel plans made and booked). We, the co-chairs, would like to schedule a full-team plenary meeting to cover this topic ASAP next week (hopefully Weds or Thurs). The rather than trying to tackle all of that right now, can I just ask if this stop-gap message is something that you all are comfortable with us sending (as outlined below) just so the Board has some kind of answer sooner, rather than later? > > Eric > > On 10/5/17, 1:25 PM, "ssr2-review-bounces(a)icann.org on behalf of ALAIN AINA" <ssr2-review-bounces(a)icann.org on behalf of aalain(a)trstech.net> wrote: > > Hi, > > I Concur with Geoff. I suggest we look at options to postpone the > LA meeting and convene a call to discuss the board and SSAC concerns > immediately > > Hope this helps > > —Alain > >> On 5 Oct 2017, at 16:39, Geoff Huston <gih(a)apnic.net> wrote: >> >> Denise, >> >> Please note in any proposed response that such a response is not based on an unanimous view from all SSR2 Review Team members, and that some individual members of this group have views that differ materially from those expressed in this response and agree with the Board’s stated conceerns. As I have posted already, I happen to share the Board's concerns here (rather than merely ‘noting’ them). >> >> thanks, >> >> Geoff >> >> >> >>> On 6 Oct 2017, at 2:17 am, Denise Michel <denisemichel(a)fb.com> wrote: >>> >>> Dear Team Members: >>> >>> As discussed, the co-chairs are preparing a brief email reply to the Board’s latest correspondence regarding the ICANN SSR Subgroup fact-finding meeting in LA Oct 9-10. Because we are so short on time, we’ve outlined the points we’ll make and invite any Team members to provide any comments they may have by COB today (PT). After we send the email, we intend to follow-up with more discussion after the workshop and a more fulsome correspondence to the Board. >>> >>> • SSR mandate from ICANN’s bylaws to provide increased accountability and transparency of ICANN to its community for key aspects of ICANN’s work >>> • SSR2’s terms of reference modelled on bylaws and adopted by majority consensus >>> • Workplan and sub-group efforts flow from ToR >>> • ICANN SSR subgroup’s fact-finding mission at ICANN addresses SSR2’s bylaw obligation. >>> • Note Board concern about risks of exceeding SSR2 scope; Team discussed potential for over-reach while creating ToR, and reinforced Team’s commitment with text on gaining complete understanding of interconnected issues but then ensuring SSR2 recommendations are in-scope. >>> • After subgroup’s Oct 9-10 fact-finding mission, Team will discuss results and next steps. >>> • Look forward to discussing all this with the Board at ICANN 60 >>> and getting more information on Board’s concerns >>> >>> >>> Best, >>> Denise & Eric >>> >>> Denise Michel >>> Domain Name System Strategy & Management Facebook, Inc. >>> denisemichel(a)fb.com >>> >>> >>> _______________________________________________ >>> Ssr2-review mailing list >>> Ssr2-review(a)icann.org >>> https://mm.icann.org/mailman/listinfo/ssr2-review >> >> _______________________________________________ >> Ssr2-review mailing list >> Ssr2-review(a)icann.org >> https://mm.icann.org/mailman/listinfo/ssr2-review > > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review > > > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

3 3

Recent SSR2 status
by Mohamad Amin hasbini Oct. 5, 2017

Oct. 5, 2017

Hi all, I’ve been monitoring and mostly silent, nevertheless I feel i should share few thought about recent occurrences. While people dived into the deep processes of ICANN and the dozens of ICANN documents, history, trying to define a feasible scope, I do not think this should be the SSR2 main role. We are experts in the infosec field, that is why we were selected. We should help ICANN do the SSR evaluation in the best possible manner. Observations: 1- We do not have full visibility on what is happening at ICANN and partner organizations (we do not work inside, we do not live inside, at least myself) 2- We will not be able to fully grasp what is happening at ICANN and partner organizations, this is not a small organizations being examined. What I think we should do as SSR2: 1- We are not supposed to get hold of all that happens at ICANN. Not even ICANN staff are able to do that and they frequently referred us to different people/employees when we had different questions 2- We should establish a solid evaluation process where we as SSR2 members are not essential. Our main role is to offer our expertise and develop an evaluation process which guarantees integrity and transparency for the community we represent. The process should be repeatable and self-sustainable, our follow-up meetings should be to assure the process is being executed and followed accurately, keeping the ICANN board in full visibility, until ending results are achieved. How should the SSR2 do the above mentioned: One of the main things we need to initiate asap is supporting ICANN to contract an IT/IS risk specialized firm to handle the field work phase, part of the SSR2 roadmap. Why do that? Such an organization will: 1- will be onsite(s) at ICANN, with solid previous experience from hundreds of large clients, structured dedicated staff and a large toolset 2- will be able to consolidate and sharpen the scope of the SSR2 evaluation (including this phase budget) 3- will be able to execute the negotiated scope while reporting to the SSR2 and answering its experts questions and concerns 4- will be accountable to deadlines and integrity issues 5- NDA issues solved? If we’re not doing the field work (we can’t anyway afaik), we have no need to sign any NDAs, the engaged firm would need to do so and that would be absolute standard behavior. What would the SSR2 role be here? As SSR2 members and experts in the field: 1- we would help ICANN negotiate the most efficient and authentic offering 2- we shall be directing the engaged firm into what we think should be prioritized (agreed as a concern with the ICANN board part of the scope) 3- we shall do our best to guarantee the objectivity and integrity of the field work, while continuously reporting results to the ICANN board Final thoughts: The need for SSR2 to hire and monitor for the ICANN SSR evaluation is something i personally mentioned times before, though it did not get much attention, i do not believe the SSR2 members are able to deliver quality Security Stability and Reliability evaluation by themselves for ICANN, not with any of our conditions anyway(different locations, timezones, all have job/family priorities…). Nevertheless i believe the SSR2 group of experts (or what is left of it) will have a much better chance to efficient success, overseeing/guiding the SSR evaluation field execution. Also please do not misunderstand me, SSR2 people are doing very hard work already. While my comments are mainly targeting the SSR2 team, I also hope they are relayed to the board, i represent myself and could be mistaken, apologies for the long message. Regards, Amin KL SSC Brunel

2 1

Action Required Today - SSR2 Plenary Call Thursday, 12 October - Doodle Poll
by Yvette Guigneaux Oct. 5, 2017

Oct. 5, 2017

Hi All - Good day. Below is a doodle poll link for availability for an SSR2 Plenary call - Thursday, 12 October - as the usual Tuesday Plenary call was cancelled due to the ICANN SSR meeting in Los Angeles - please advise on your availability. Doodle Link: http://doodle.com/poll/nkqvmpfy8pgs8utd | Poll closes: Wednesday, 11 October @ 19:00 UTC. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D33DEB.817A6F50]

1 0

Draft Agenda: ICANN SSR LA Meeting
by Jennifer Bryce Oct. 5, 2017

Oct. 5, 2017

Hi all, Please find attached a draft agenda for the ICANN SSR subgroup meeting in LA, 9-10 October. Please note that the agenda is subject to change. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

SSAC letter to the Board
by James Gannon Oct. 4, 2017

Oct. 4, 2017

Im sure some of you have seen this but important for everyone to read this. https://www.icann.org/en/system/files/correspondence/faltstrom-to-icann-boa… I copy the core text below: Dear ICANN Board, The SSAC is strongly committed to the aims of the quintennial Security, Stability and Resiliency of the DNS Review (now SSR2) and our members have given and will continue to give, considerable time in support of SSR2. It is therefore with considerable regret that we inform you that SSAC has serious concerns that the SSR2 effort may fail, and we request that you give it urgent and serious attention. One basic problem with the SSR2 work is that the review team seems neither to have sufficient external instruction about what to study nor to have been able to formulate a clear direction for itself. Whatever the case, the Review Team has spent hundreds of hours engaged in procedural matters and almost no progress has been made on substantive matters, which in turn has damaged the goodwill and forbearance of its members, some of whom are SSSAC members. We are concerned that, left to its own devices, SSR2 is on a path to almost certain failure bringing a consequential loss of credibility in the accountability processes of ICANN and its community. Some seven months into the review process, the last SSR2 scorecard shows 15% of milestones being accomplished, but all of these accomplishments have been process issues – for example, determining the role of observers, adopting terms of reference, determine terms of communications with the Board, and so on. On 28 September 2017, ICANN called for proposals by external consultants to perform a gap analysis of the Implementation of SSR1 Recommendations , but this analysis will not necessarily identify new or emerging SSR issues. While it may provide useful input to the SSR2 work, it does not change the view of the SSAC. The SSAC believes that the existing composition, structure, and processes of the SSR2 Review Team lack the necessary effectiveness to achieve the desired results. The SSAC recommendation to the ICANN Board of Directors and the ICANN Community is to take immediate action to temporarily halt the SSR2 review and produce a detailed plan before resuming work. The current approach, if continued without significant change, will ultimately result in a report that does not have the quality expected by the ICANN Community

2 1

Re: [Ssr2-review] [EXT] Question on definition of "security"
by Barrett, Kerry-Ann Oct. 4, 2017

Oct. 4, 2017

Dear All Apologies if I missed the answer to my question, but have we satisfied the redefinition of the scope of 'security' for the purposes of our Review and submitted same ot the Baord as yet? If not can we include a discussion item about this for our next plenary. Thanks for the clarification Kaveh and have a great weekend everyone. Sincerely, Kerry-Ann Barrett Cyber Security Policy Specialist Inter-American Committee against Terrorism Secretariat for Multidimensional Security Organization of American States 1889 F Street N.W., Washington, D.C. 20006 T. 202-370-4675 F. 202-458-3857 kabarrett(a)oas.org www.oas.org/cyber Register to our distribution list here! -----Original Message----- From: ssr2-review-bounces(a)icann.org [mailto:ssr2-review-bounces@icann.org] On Behalf Of Kaveh Ranjbar Sent: Tuesday, September 5, 2017 6:10 AM To: SSR2 Review Team Email List <ssr2-review(a)icann.org> Subject: [EXT] [Ssr2-review] Question on definition of "security" Hello team, Going through action items we had this open question from SSR2 Review Team: "The ICANN security team (now OCTO/SSR) developed a framework that provided a definition for "security". The SSR2 team used that definition. The Board response to the Terms of Reference expressed that this definition is too broad for the Review Team’s use. Is Board asking staff to redefine definition of “security”?” Although I have answered this in person, to have a record of the answer on the list, please find my written response below: “Thank you for this question. The answer is no, the board is not asking staff to redefine current working definition of “security”. As I clarified in the SSR2’s meeting in Johannesburg, on 26th of June 2017, aim of the board's question was to ensure that -given how broad the definition of “security” could be- the SSR2 Review Team focuses its efforts on a manageable set of issues properly within ICANN’s mission and remit.” Please let me know if you have any further questions or comments. All the best, Kaveh. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

2 1

Fwd: Board letter on Subgroup 2's scope
by Bernard Turcotte Oct. 4, 2017

Oct. 4, 2017

---------- Forwarded message ---------- From: Žarko Kecić <Zarko.Kecic(a)rnids.rs> Date: Tue, Oct 3, 2017 at 7:00 PM Subject: RE: [Ssr2-review] Board letter on Subgroup 2's scope To: Bernard Turcotte <turcotte.bernard(a)gmail.com> Hi Bernie, For some reason ICANN mailing list service doesn’t like me (even my mail does have correct spf, DKIM and DMARC to proof authenticity). I have asked Karen to raise this issue to the tech staff but it is even worse now. Can you please forward the message bellow to the group. I hope I’ll have time in La to fix this with ICANN staff. Thanks! Hello RT, In principle, I agree with the position of the Board that SRR RT has no mandate to check the operational capability and safety of ICANN's internal systems. However, I personally do not know to what extent ICANN systems are used for operational tasks related to unique Internet identifiers. I believe that the meeting in Los Angeles will solve some of these dilemmas and will help us to include in the final report only the findings that are within our scope. Also, in order to carry out tasks from the parts of the plan that are OK’ed by the Board, some inputs are needed from those parts that they have identified as inadequate for the mission that this RT has. Basically I agree, having in mind short time left until LA meeting, that we continue as planned, and work with staff, Legal Dept. and the Board what should be in our final report and what is out of scope. Anyway, those findings that are not within RT mission, as stated in bylaws, may be useful for future improvements of the security and stability of ICANN internal systems and processes. Zarko *From:* Bernard Turcotte [mailto:turcotte.bernard@gmail.com] *Sent:* Wednesday, October 4, 2017 12:53 AM *To:* Žarko Kecić <Zarko.Kecic(a)rnids.rs> *Subject:* Re: [Ssr2-review] Board letter on Subgroup 2's scope email was empty Zarko. B. 2017-10-03 18:50 GMT-04:00 Žarko Kecić <Zarko.Kecic(a)rnids.rs>: _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

Re: [Ssr2-review] SSR2 RT
by Osterweil, Eric Oct. 3, 2017

Oct. 3, 2017

Sorry to be losing you, Cathy. Take care. Eric From: <ssr2-review-bounces(a)icann.org> on behalf of James Gannon <james(a)cyberinvasion.net> Date: Tuesday, October 3, 2017 at 3:50 PM To: Cathy Handley <chandley(a)arin.net> Cc: Brad Verd <bverd(a)verisign.com>, SSR2 <ssr2-review(a)icann.org> Subject: [EXTERNAL] Re: [Ssr2-review] SSR2 RT Sorry to see you go Cathy. It was a pleasure working with you. Sent from my iPhone On 3 Oct 2017, at 21:49, Cathy Handley <chandley(a)arin.net<mailto:chandley@arin.net>> wrote: SSR2 RT and associated ICANN Staff, Effective today, I am stepping down from the Review Team and all associated activities. I am copying Brad Verd, as chair of the RSSAC and the organization that sponsored me. Regards, Cathy Cathy Handley Executive Director Government Affairs American Registry for Internet Numbers (ARIN) Mobile: +1 703 341 7996 Fax: +1 703 263 0111 Email: chandley(a)arin.net<mailto:chandley@arin.net> Confidentiality Notice: This message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please delete.. Thank you. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

1 0