Criteria

1 Summary

1.1 From whose perspective???

1.1.1

1.1.2 Different issues, depending on point of view

1.1.2.1 Availability of DNS as a service

1.1.2.1.1 Secondary servers

1.1.2.2 Data consistency

1.1.2.3 (1) Availability - n/a

1.1.2.3.1 DNS data accuracy -- 100%

1.1.2.3.2 Data integrity

1.1.2.3.3 Process integrity

1.1.2.3.4 System integrity

1.1.2.4 (2) Availability - 90%

1.1.2.4.1 DNS data accuracy -- 100%

1.1.2.4.2 Data integrity

1.1.2.4.3 Process integrity

1.1.2.4.4 System integrity

1.1.2.5 (3) Availability --

1.1.2.5.1 DNS data accuracy -- 100%

1.1.2.5.2 Data integrity

1.1.2.5.3 Process integrity

1.1.2.5.4 System integrity

1.1.2.6 (4) Availability -- 100%

1.1.2.6.1 DNS data accuracy -- 100%

1.1.2.6.2 Data integrity

1.1.2.6.3 Process integrity

1.1.2.6.4 System integrity

1.2 Criteria

1.2.1 Availability

1.2.1.1 Availability of data/system

1.2.2 Capacity

1.2.3 Accuracy (e.g. errors/typos in names/IPs/etc.

1.2.3.1 Correctness/accuracy

1.2.4 Security

1.2.4.1 Integrity of data

1.2.4.1.1 Authenticity

1.2.4.1.2 Trustworthy

1.2.4.2 Data consistency

1.2.4.3 Confidence

1.2.4.4 Resistant to attack

1.2.4.5 Manage threats effectively

1.2.4.6 Attribution/zone data?

1.2.4.7 WHOIS problem?

1.2.5 Stable

1.2.5.1 Works and continues to work in a highly predictable way

1.2.5.2 Changes can be implemented with a predictable impact on services

1.2.5.3 Consistency

1.2.5.4 Acceptable performance for all actors

1.2.5.5 DNS is (by definition) an End-to-End service -- not just the protocol between client and server, but has boundaries that go far beyond that

1.2.6 Timely response

1.3 Physical Security

2 Action items

2.1 Ask Mark to clarify the "DNSSEC" part of that group's work

2.2 Scott -- expand on:

2.2.1 WHOIS problem?

2.2.2 Threats and defenses

2.2.2.1 Operational criteria

2.2.2.1.1 Roles and responsibilities

2.2.2.1.2 Physical/procedural/process

2.2.2.1.3 3rd party suppliers of services/SLA's

2.2.2.2 Institutional confidence

2.2.2.3 Accountability and transparency

3 Threats and defenses

3.1 Operational criteria

3.1.1 Roles and responsibilities

3.1.2 Physical/procedural/process

3.1.3 3rd party suppliers of services/SLA's

3.2 Institutional confidence

3.3 Accountability and transparency

4 Enablers

4.1 Diversity

4.1.1 Operator (people, location, funds, experience)

4.1.2 Infrastructure (brand, spec, location)

4.2 Skill

4.2.1 Design

4.2.2 Operation

4.3 Expertise

4.3.1 DNS

4.3.2 Security

4.3.3 Networking

4.4 Technology

4.4.1 DNSSEC

4.4.1.1 Recursive resolver

4.4.1.2 DNSSEC taxonomy

4.4.1.3 Hard to determine health of DNS based on unknown but exploited holes in DNS

4.4.1.4 Healthy DNS needs good incident management and good network operations

4.4.1.5 Threat warning and recommendations of mitigation based on the warning

4.4.1.6 Need of service level of DNS (dashboard)

4.5 Procedures

5 Metrics

5.1 Uptime

5.1.1 Reachability

5.1.1.1 At multiple ports

5.1.1.2 Unintended

5.1.1.3 Officially intentional

5.1.1.4 Malicious

5.1.2 Note -- WW CGI.hR, SIMET

5.2 Infrastructure (Mikey's suggestion for topic-header)

5.2.1 Hardware

5.2.2 Software

5.2.3 Connection

5.2.3.1 Bandwidth

5.2.3.2 Connectivity

5.2.3.3 Latency

5.2.3.4 Resilience?

5.3 Content (Mikey's suggestion for topic-header)

5.3.1 Configuration

5.3.2 Data integrity

5.3.2.1 Transit

5.3.2.2 Submission/registration