- Ssr2-review - lists.icann.org

Security Framework now available
by Jennifer Bryce Oct. 23, 2017

Oct. 23, 2017

Hi all, FYI, the Security Framework for Registry Operator's Response to Security Threats is now available: https://www.icann.org/news/announcement-2-2017-10-20-en We are in the process of scheduling a briefing for the SSR2 in Abu Dhabi. A public session to present the Framework is scheduled for Sunday 29th October at 17:00 - 18:30. (View the session on the schedule: http://sched.co/CbGb) Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [Ext] [Ianatransition-ssr2-rt] Proposed times for meeting w/Kim Davies
by Jennifer Bryce Oct. 19, 2017

Oct. 19, 2017

Hi Geoff, Thanks for the clarification. Per our discussion, you will remain a member of the IANA Transition and DNS SSR subgroups only. Best, Jennifer -----Original Message----- From: Geoff Huston <gih902(a)gmail.com> Date: Wednesday, October 18, 2017 at 6:26 PM To: Jennifer Bryce <jennifer.bryce(a)icann.org> Cc: Alice Jansen <alice.jansen(a)icann.org> Subject: Re: [Ext] [Ianatransition-ssr2-rt] Proposed times for meeting w/Kim Davies ahhh - my mistake. I assume that the IANA transition is not asking me to sign an NDA, and under that assumption I am happy to remain a member of this (IANA Transition) sub group. my apologies for the confusion here. Geoff >> -----Original Message----- >> From: Geoff Huston <gih902(a)gmail.com> >> Date: Tuesday, October 17, 2017 at 6:26 PM >> To: Jennifer Bryce <jennifer.bryce(a)icann.org> >> Cc: "IANAtransition-SSR2-RT(a)icann.org" <IANAtransition-SSR2-RT(a)icann.org> >> Subject: [Ext] Re: [Ianatransition-ssr2-rt] Proposed times for meeting w/Kim Davies >> >> Hi Jennifer, >> >> I'm no longer a member of the IANA subteam, so I’m unsure why you are asking me this question. >> >> thanks, >> >> Geoff >> >> >> >>> On 18 Oct 2017, at 4:10 am, Jennifer Bryce <jennifer.bryce(a)icann.org> wrote: >>> >>> Hi IANA subteam, >>> >>> Below are some suggested time slots to meet with Kim Davies in Abu Dhabi. As a reminder, the meeting was requested by Cathy to “answer questions on PGP alternatives to progress the IANA transition subteam's work” (Item 141 on the tracker). >>> >>> Eric and Geoff, can you please advise if you will both attend the meeting in-person and if any of the below proposed 60-minute slots are suitable? >>> >>> (GST local time) >>> • 9am Tuesday >>> • 9am Wednesday >>> • 3pm Wednesday >>> >>> Thanks, >>> Jennifer >>> -- >>> Jennifer Bryce >>> Senior Reviews Coordinator >>> Internet Corporation for Assigned Names and Numbers (ICANN) >>> >>> Email: jennifer.bryce(a)icann.org >>> Skype: jennifer.bryce.icann >>> www.icann.org >>> _______________________________________________ >>> IANATransition-SSR2-RT mailing list >>> IANATransition-SSR2-RT(a)icann.org >>> https://mm.icann.org/mailman/listinfo/ianatransition-ssr2-rt >> >> >> > > > > <Mail Attachment.eml>

1 0

Subgroup ICANN SSR: Fact-Finding Meeting 9-10 Oct. in LA
by Boban Krsic Oct. 18, 2017

Oct. 18, 2017

Dear all, The ICANN SSR Subgroup had a very productive two-day, fact-finding meeting at ICANN headquarter. The subgroup met with a number of ICANN staff subject matter experts (SME) and discussed a range of issues relating to the completeness and effectiveness of ICANN’s security processes and the effectiveness of the ICANN security framework (including activities connected to the SSR2 ToR and implementation of SSR1 recommendations). Topics were covered to varying degrees of detail as warranted; some topics were covered sufficiently and some will require follow-on discussions. The subgroup will update its contribution to the SSR2 work plan and post more fulsome documentation of how the subgroup’s work has advanced and issues that we’re preparing to bring to the full SSR2 Team for consideration. Note that some topics/discussions will be cross-referenced for other SSR2 subgroups (e.g. Security Framework and emerging threats apply to the Future Challenges Subgroup). Meanwhile, here’s a high-level summary of the fact-finding meeting. The subgroup reviewed, submitted questions & information requests about, and discussed early observations about: * ICANN’s Security Framework and emerging threats * ICANN’s Risk Management Framework * ICANN’s Business Continuity strategies, objectives, plans and procedures * ICANN’s operational planning and controls, and prioritized activity recovery strategy * ICANN’s Incident Response Structure * ICANN’s root server operations * ICANN’s Domain Division activities that relate to SSR objectives, including: * New gTLD program SSR-related safeguards * Emergency Back-End Registry Operator (EBERO), and related processes, and testing * Registry Data Escrow (RyDE) program and Data Escrow Agents (DEA) * Centralized Zone Data Service (CZDS) compliance, failures, plans * Vetting of registrar and registry operators as relates to SSR, and measurement & impact of malicious conduct by contracted parties, data breaches, etc. * SLA Monitoring System (SLAM) * Abuse reports, including SADAG and DAAR (Statistical Analysis of DNS Abuse & Domain Abuse Activity Reporting) * SSR objectives in ICANN’S standard operating procedures (SOP). As rapporteur and member of the subgroup ICANN SSR I would like to thank all SSRT2 members, ICANN staff and SME's for investing their time, preparing and attend at the meeting in LA. Thank you very much - we have taken a significant step forward in our subgroup and our related topics. Best regrads, - Boban. -- Boban Kršić Chief Information Security Officer DENIC eG, Kaiserstraße 75-77, 60329 Frankfurt am Main, GERMANY E-Mail: krsic(a)denic.de, Fon: +49 69 272 35-120, Fax: -248 Mobil: +49 172 67 61 671 https://www.denic.de X.509 Key-ID: 00A54FCB79884413A4 Fingerprint: 9D37 F593 AF9A D766 FAB4 8B88 D49A 2716 PGP Key-ID: 0x43C89BA9 Fingerprint: B974 E725 FEF7 CB3A E452 BEE0 5B80 73E9 43C8 9BA9 Angaben nach § 25a Absatz 1 GenG: DENIC eG (Sitz: Frankfurt am Main) Vorstand: Helga Krüger, Martin Küchenthal, Andreas Musielak, Dr. Jörg Schweiger Vorsitzender des Aufsichtsrats: Thomas Keller Eingetragen unter Nr. 770 im Genossenschaftsregister, Amtsgericht Frankfurt am Main

2 2

FYI: Operating Standards webinar
by Jennifer Bryce Oct. 18, 2017

Oct. 18, 2017

Hi all, Operating Standards for ICANN’s specific reviews are now open for public comment<https://www.icann.org/public-comments/reviews-standards-2017-10-17-en>. A webinar on the Operating Standards will take place on Thursday 19 October at 21:00 UTC. During the webinar, the ICANN organization will provide an overview of the draft, explain the underlying principals, and highlight the existing review best practices and processes on which these draft Operating Standards are based. You can learn more about the webinar and how to join here: https://www.icann.org/news/announcement-2-2017-10-12-en -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2 schedule at ICANN60
by Jennifer Bryce Oct. 17, 2017

Oct. 17, 2017

Hi all, Please find below a list of the SSR2 sessions currently confirmed for ICANN60, including outreach meetings. Calendar invites for these sessions have been distributed already. Please also find attached a list of sessions that the SSR2 may be interested in attending. Please let us know if you have any questions. Note all times are GST. Friday 27 October * 09:00 – 17:30 | SSR2 Review Team Face-to-Face Meeting| Capital Suite 01 (not on public schedule as prior to ICANN60) Saturday 28 October * 15:15 - 15:45 | At-Large Advisory Committee (ALAC) | Hall A, Sec B. | http://sched.co/CbJ0 * 17:30 - 18:00 | Root Server System Advisory Committee (RSSAC) | Capital Suite 05 | http://sched.co/CbFT (invite to follow) Sunday 29 October * 13:30 – 15:00 | SSR2 Review Team Community Engagement Session| Capital Suite 14 | http://sched.co/CbGX Monday 30 October * 08:30 - 09:00 | Governmental Advisory Committee (GAC) | Hall 3 | http://sched.co/CbI8 Tuesday 31 October * 08:30 - 08:55 | Registries Stakeholder Group (RySG) | Hall A, Sec. B/C | http://sched.co/CbKA * 10:30 - 11:00 | Non-Commercial Users Constituency (NCUC) | Capital Suite 07 | http://sched.co/CbG2 * 11:30 - 12:00 | Security & Stability Advisory Committee (SSAC) | Capital Suite 19 | http://sched.co/CbGx * 14:00 - 14:30 | Not-for-Profit Operational Concerns (NPOC)| Capital Suite 07 | http://sched.co/CbG3 Thursday 2 November * 13:45 – 15:00 | SSR2 Review Team Meeting with Board Caucus Group| Hall A, Sec. B/C | http://sched.co/CbKJ Friday 3 November * 09:00 – 17:30 | SSR2 Review Team Face-to-Face Meeting| Capital Suite 01 | http://sched.co/CbF7 -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 2

Re: [Ssr2-review] [Ext] Re: SSR2
by Julie Hedlund Oct. 17, 2017

Oct. 17, 2017

Denise, I’ve worked with Jennifer to schedule a new time. It will be on Tuesday, 31 October from 11:30 to Noon. Best, Julie On 10/17/17, 11:51 AM, "Denise Michel" <denisemichel(a)fb.com> wrote: Great. Thanks. Denise Michel On 10/17/17, 7:59 AM, "Patrik Fältström" <paf(a)frobbit.se> wrote: On 17 Oct 2017, at 15:59, Denise Michel wrote: > The cancelation notice we received for the SSAC/SSR2 meeting at ICANN 60 was disappointing and surprising. Dear Denice, The cancelation notice is a misunderstanding. My Staff tells me it was due to the fact SSAC could not meet at the specified time. Not that we would not be interested in meeting. The contrary. Julie Hedlund is coordinating the SSAC agenda, and I know we are working on finding some time to meet. Best, Patrik Fältström SSAC Chair

2 1

Re: [Ssr2-review] SSR2
by Denise Michel Oct. 17, 2017

Oct. 17, 2017

Hi Patrik, Thank you for your (below) email on what you and the SO/AC chairs are doing. The SSR2 Review Team (SSR2) (cc’d) has been making progress and has cleared several milestones, but we certainly welcome any additional resources that the SO/AC chairs want to offer. We are more than happy to point out and/or provide any additional information from SSR2 to illustrate these activities, so please let us know if that would be helpful. The SSR2 Review Team has made public all of its plans, information review, deliberations, and activities. The Review Team has been (and remains) open to comments, advice, and critiques of its work from the entire ICANN community during its entire period of operation because we believe that transparency is critical to our success. Naturally, a part of that includes clear lines of communication. In addition to sending all of the ICANN constituencies, SOs, and ACs regular updates and links to our work, we are eager to meet with each of them in Abu Dhabi at ICANN 60. We continue to appreciate the contributions of SSAC’s appointees to SSR2 and we also think that both SSAC and the full SSR2 will benefit from an opportunity for direct face-to-face discussions at ICANN 60. The cancelation notice we received for the SSAC/SSR2 meeting at ICANN 60 was disappointing and surprising. In particular, considering the amount of progress SSR2 has made, the points raised to the Board and in the email below seem to illustrate an inaccurate assessment of the SSR2’s progress and direction, in our opinion. We request that you please put the SSR2 meeting back on SSAC’s calendar at ICANN 60 so all the Review Team members can get clarity on SSAC’s views and objectives. Sincerely, Denise Michel and Eric Osterweil Co-Chairs, Security, Stability & Resiliency of the DNS Review Team On 10/11/17, 10:04 PM, "Patrik Fältström" <paf(a)frobbit.se> wrote: Hi, I wanted to bring you up to speed on what myself and the SOAC chairs are doing. We have since already when SSR2 team was to be appointed have some issues with the appointment process. We where tasked to appoint people that had self-nominated themselves, asking for endorsement from the various SOAC groups. And do it before the scope and charter for the SSR2 team was created, so in reality it was a bit unclear what we where looking for. On top of this, we appointed people individually, while at the same time we had a responsibility to try to ensure the aggregate had the skills and diversity required and sought for. A very difficuly task. Specifically as it at that point in time was confusing what the difference is between SO/AC Chairs and the larger group that also included the various leaders of for example ALAC RALOs and GNSO SGs. For pure administrative reasons. As simple things as not having separate mailing lists / aliases for the two different, but overlapping groups did not help. This is something we have been discussing since then, and we have had since a while back scheduled a session Friday before Abu Dhabi to discuss this meta issue. After being contacted by the Organizational Effectiveness Committee of the Board we started to reach out to our respective groups on the situation in SSR2. Within SSAC we already (as you understand) had a discussion ongoing as our appointed members in SSR2 had in their reporting rised dissatisfaction with the process as a whole which included the view that you in the leadership do very hard work, but did not get much help. We SO/AC chairs had a call Monday this week to talk about the situation and we reconfirmed the session in Abu Dhabi. Our hope is to be able to help you get forward movement with more active, and more happy members of the SSR2 team. If you have any questions, do not hesitate reaching out to me. That said, we SO/AC chairs do not want having us do end-run around the communication channel we already have between SSR2 and us via our respective appointed/endorsed members. Best, Patrik Fältström SSAC Chair Cc: Rod Rasmussen, on Jan 1 2018 incoming chair of SSAC

2 2

My analysis of the current situation of the SSR2
by ALAIN AINA Oct. 17, 2017

Oct. 17, 2017

Hello, Just to make sure what i tried to say on the call last Thursday is understood as the communication was not easy. For me it was time for a break to assess progress and realign. I see the board and SSAC letters as additional motivations to this. It is good community voicing concerns now and not later... Below is my assessment of things. I may be wrong. =========================== 1- We were appointed as team from different constituencies and backgrounds and cultures. Some familiar with ICANN, some not. 2- We got together to know each other and try to understand the assigned tasks from the bylaws 3- We selected co-chairs and adopted a ToR which we shared with the board and promised we sill share detailed workplan. 4- We got some random briefings on ICANN, SSR1, etc.. Some concerned were raised about: - What ICANN does, ICANN/IANA/PTI relationship, ICANN and the community, etc... - The scope of the work - Usefulness of all the briefings when the team was setting up - Required competencies. - What shall (can) the volunteer team do and what to outsource and how - Team member relationship to their constituencies - Etc... All of these were not addressed appropriately to make the team converged to a common understanding of the tasks, scope and methods. We seem progressing but with different understandings. 5- We brainstormed, identified topics for sub-groups 6- A detailed workplace was proposed 7- Team members were invited to choose Sub-groups they want to serve. 8 - Sub-groups started working 9- We lost 2 team members( one cochair) 10- Weekly sub-groups and global calls issued pop'ed up Some concerns were also raised about : - How to better conduct the brainstorming sticking to the scope and the ToR - The scope and work plan for the sub-groups, number of sub-groups and their composition - How to compose the sub-groups, better use the expertise available and balance the work load - How to define and manage priorities... These too were not addressed as expected and combined with the points above, have not created favorable environment and conditions. We have seen low participation and Interaction at the sub-group level as well as the global level, limited email discussions while we all agreed that the 1-hour weekly call not enough to discuss everything and make progress. I don't know if what i describe here alone explains what we have seen. They may be other factors... ============================== Suggestions: - review the team composition ? - review work scope, ToR and work plan ? - review sub-groups scope, work plan, composition and progress ? - seek formal internal consensus - make necessary adjustments considering time limits - meet board and SSAC - Communicate any changes and new plans to board, SSAC and the community? I assume some of these were discussed on the call( i missed part of the call). So what are the plans ? Can we do this before Abu Dhabi ? Hope this helps —Alain

3 2

Connectivity - SSR2 Review Team - Meeting #31 | 14:00 UTC | Thursday, 12 October 2017
by MSSI Secretariat Oct. 12, 2017

Oct. 12, 2017

Hello SSR2 Review Team - Good day. I just wanted to touch base regarding connectivity for our next SSR2 Review Team - Meeting #31 | 14:00 UTC | Thursday, 12 October 2017. We have conquered many of the noise disturbances previously present and would like to ensure continued connectivity on future calls. For the best results in regions with connectivity, we suggest doing the following... * Connect to the Adobe Connect (https://participate.icann.org/ssrreview) 20-30 minutes before the scheduled call - the Adobe Connect room will be open and I will be available to assist you - in addition we can resolve any microphone/static/connection issues ahead of time - including connecting with international operators if need be. The goal is to have all connection concerns resolved by the top of the hour for the benefit of the team. * Be located (if possible) in an area that has proper broadband connection and is quiet - thus creating a strong signal connection, making it possible to see and hear in the Adobe Connect Room. * Feel free to Skype me either before, during or after the call - my skype address is yvette.guigneaux.icann - this way I can respond to you almost immediately for whatever you may need - including having the Adobe Connect Room dial out to you if need be. As your SSR2 Review Team Secretariat, I am determined to create an atmosphere where you can clearly participate in the Adobe Connect Room. Thank you everyone and I look forward to seeing you all on our upcoming call. :) Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D342BA.63B2AA40]

2 1

FYI: Draft PTI and IANA FY19 Operating Plans and Budgets
by Jennifer Bryce Oct. 11, 2017

Oct. 11, 2017

Hi all, The public comment period is now open for the above through 26 November. Here’s the link to more info: https://www.icann.org/public-comments/draft-pti-iana-fy19-2017-10-09-en -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0