PUBLICCOMMENTCLOSE
2020-03-20 00:00:00.0 UTC
STATEMENTNAME
<p><a href="https://www.icann.org/public-comments/ssr2-rt-draft-report-2020-01-24-en">Second<span> </span><abbr class="" style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>,<span> </span><abbr class="" style="text-decoration: none;" title="Security, Stability and Resiliency">Stability</abbr>, and<span> </span><abbr class="" style="text-decoration: none;" title="Security Stability & Resiliency (SSR)">Resiliency</abbr><span> </span>(SSR2) Review Team Draft Report</a></p><p><br /></p>
STATEMENTSTATUS
<p><ac:structured-macro ac:name="status" ac:schema-version="1" ac:macro-id="ad5163de-eed9-4d5e-a952-cfe6f7d75d3f"><ac:parameter ac:name="colour">Red</ac:parameter><ac:parameter ac:name="title">VOTE</ac:parameter></ac:structured-macro></p>
STATEMENTASSIGNEE
<p><ac:link><ri:user ri:userkey="8aa0802249f42f260149f4308adb0311" /></ac:link></p><p><ac:link><ri:user ri:userkey="8aa0802249f42f260149f4308aaf028e" /></ac:link></p>
STAFFCONTACT
<p>Negar Farzinnia<br /><a href="mailto:negar.farzinnia@icann.org" style="text-decoration: none;">negar.farzinnia@icann.org</a></p>
STATEMENTNUMBER
PUBLICCOMMENTINFO
<h2 style="text-align: start;">Brief Overview</h2><p><strong><em>Purpose:</em></strong><span> </span>This Public Comment proceeding is on behalf of the second<span> </span><abbr class="" style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>,<span> </span><abbr style="text-decoration: none;" title="Security, Stability and Resiliency">Stability</abbr>, and<span> </span><abbr class="" style="text-decoration: none;" title="Security Stability & Resiliency (SSR)">Resiliency</abbr><span> </span>(SSR2) Review Team. The<span> </span><abbr style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>,<span> </span><abbr style="text-decoration: none;" title="Security, Stability and Resiliency">Stability</abbr>, and<span> </span><abbr style="text-decoration: none;" title="Security Stability & Resiliency (SSR)">Resiliency</abbr><span> </span>Review is mandated by<span> </span><abbr class="" style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr>'s Bylaws (<a href="https://www.icann.org/resources/pages/governance/bylaws-en/#article4.6" style="text-decoration: none;">Article 4, Section 4.6(c)</a>) to review<span> </span><em>"<abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr>'s execution of its commitment to enhance the operational stability, reliability, resiliency, security, and global interoperability of the systems and processes, both internal and external, that directly affect and/or are affected by the Internet's system of unique identifiers that<span> </span><abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr><span> </span>coordinates."</em></p><p><strong><em>Current Status:</em></strong><span> </span>The SSR2 Review Team seeks to solicit input on its<span> </span><a href="https://www.icann.org/en/system/files/files/ssr2-review-24jan20-en.pdf" style="text-decoration: none;">draft report</a>.</p><p><strong><em>Next Steps:</em></strong><span> </span>The SSR2 Review Team will carefully consider comments received and amend the report as it deems appropriate and in the public interest before submitting its final report to the Board. The final report will be published for Public Comment in advance of the Board's consideration.</p><h2 style="text-align: start;">Section I: Description and Explanation</h2><p>This Public Comment proceeding is on behalf of the second<span> </span><abbr style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>,<span> </span><abbr style="text-decoration: none;" title="Security, Stability and Resiliency">Stability</abbr>, and<span> </span><abbr style="text-decoration: none;" title="Security Stability & Resiliency (SSR)">Resiliency</abbr><span> </span>(SSR2) Review Team who seeks to solicit input on its<span> </span><a href="https://www.icann.org/en/system/files/files/ssr2-review-24jan20-en.pdf" style="text-decoration: none;">draft report</a>. The report contains findings and recommendations in four key areas:</p><ul><li>Implementation and impact of recommendations from the<span> </span><a href="https://www.icann.org/resources/pages/ssr1-progress-milestones-2019-08-07-en" style="text-decoration: none;">first SSR review</a>.</li><li>Key stability issues within<span> </span><abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr>.</li><li><abbr style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>, stability, and resilience of the<span> </span><abbr style="text-decoration: none;" title="Domain Name">Domain Name</abbr><span> </span>System (<abbr style="text-decoration: none;" title="Domain Name System">DNS</abbr>).</li><li>Future challenges.</li></ul><h2 style="text-align: start;">Section II: Background</h2><p>The<span> </span><abbr style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>,<span> </span><abbr style="text-decoration: none;" title="Security, Stability and Resiliency">Stability</abbr>, and<span> </span><abbr style="text-decoration: none;" title="Security Stability & Resiliency (SSR)">Resiliency</abbr><span> </span>Review is mandated by<span> </span><abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr>'s Bylaws (<a href="https://www.icann.org/resources/pages/governance/bylaws-en/#article4.6" style="text-decoration: none;">Article 4, Section 4.6(c)</a>) to review<span> </span><em>"<abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr>'s execution of its commitment to enhance the operational stability, reliability, resiliency, security, and global interoperability of the systems and processes, both internal and external, that directly affect and/or are affected by the Internet's system of unique identifiers that<span> </span><abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr><span> </span>coordinates."</em></p><p>Per the<span> </span><a href="https://www.icann.org/resources/pages/governance/bylaws-en/#article4.6" style="text-decoration: none;">Bylaws</a>, the issues that the review team for the SSR Review ("SSR Review Team") may assess are the following:</p><p>(A) security, operational stability and resiliency matters, both physical and network, relating to the coordination of the Internet's system of unique identifiers;</p><p>(B) conformance with appropriate security contingency planning framework for the Internet's system of unique identifiers; and</p><p>(C) maintaining clear and globally interoperable security processes for those portions of the Internet's system of unique identifiers that<span> </span><abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr><span> </span>coordinates.</p><p>(iii) The SSR Review Team shall also assess the extent to which<span> </span><abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr><span> </span>has successfully implemented its security efforts, the effectiveness of the security efforts to deal with actual and potential challenges and threats to the security and stability of the<span> </span><abbr style="text-decoration: none;" title="Domain Name System">DNS</abbr>, and the extent to which the security efforts are sufficiently robust to meet future challenges and threats to the security, stability and resiliency of the<span> </span><abbr style="text-decoration: none;" title="Domain Name System">DNS</abbr>, consistent with<span> </span><abbr style="text-decoration: none;" title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr>'s Mission.</p><p>(iv) The SSR Review Team shall also assess the extent to which prior SSR Review recommendations have been implemented and the extent to which implementation of such recommendations has resulted in the intended effect.</p><h2 style="text-align: start;">Section III: Relevant Resources</h2><p style="text-align: start;"><br /></p><ul><li>Second<span> </span><abbr style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>,<span> </span><abbr style="text-decoration: none;" title="Security, Stability and Resiliency">Stability</abbr>, and<span> </span><abbr style="text-decoration: none;" title="Security Stability & Resiliency (SSR)">Resiliency</abbr><span> </span>(SSR2) Review Team<span> </span><a href="https://www.icann.org/en/system/files/files/ssr2-review-24jan20-en.pdf" style="text-decoration: none;">Draft Report</a></li></ul><p><br /></p><h2 style="text-align: start;">Section IV: Additional Information</h2><p><br /></p><ul><li>SSR2 Review Team wiki space:<span> </span><a href="https://community.icann.org/x/AE6AAw" style="text-decoration: none;">https://community.icann.org/x/AE6AAw</a></li><li><abbr style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>,<span> </span><abbr style="text-decoration: none;" title="Security, Stability and Resiliency">Stability</abbr>, and<span> </span><abbr style="text-decoration: none;" title="Security Stability & Resiliency (SSR)">Resiliency</abbr><span> </span>Review page on <a href="http://icann.org">icann.org</a>:<span> </span><a href="https://www.icann.org/resources/reviews/specific-reviews/ssr" style="text-decoration: none;">https://www.icann.org/resources/reviews/specific-reviews/ssr</a></li><li>Final Report of the first<span> </span><abbr style="text-decoration: none;" title="Security – Security, Stability and Resiliency (SSR)">Security</abbr>,<span> </span><abbr style="text-decoration: none;" title="Security, Stability and Resiliency">Stability</abbr>, and<span> </span><abbr style="text-decoration: none;" title="Security Stability & Resiliency (SSR)">Resiliency</abbr><span> </span>of the<span> </span><abbr style="text-decoration: none;" title="Domain Name System">DNS</abbr><span> </span>Review Team (SSR1):<span> </span><a href="https://www.icann.org/en/system/files/files/final-report-20jun12-en.pdf" style="text-decoration: none;">https://www.icann.org/en/system/files/files/final-report-20jun12-en.pdf</a></li><li>SSR1 Review implementation wiki page:<span> </span><a href="https://community.icann.org/x/tYdCAw" style="text-decoration: none;">https://community.icann.org/x/tYdCAw</a></li></ul><h2 style="text-align: start;">Section V: Reports</h2>
FINALVERSION
FINALDRAFT
FIRSTDRAFT
<p>Draft submitted by Alan Greenberg and Jonathan Zuck, 25 February 2020, 16:20 UTC</p><p>Minor correction (confirming reference to CCT Review) and correcting a typo, 26 February 2020.</p><p>New text added in response to comments, shown in BLUE, added by Alan Greenberg, 19 March 2020, 20:48 UTC.</p><hr /><p>The ALAC appreciates the opportunity to comment on the Second Security, Stability, and Resiliency (SSR2) Review Team Draft Report.</p><p>Ensuring the security, stability and resiliency of the DNS is arguably ICANN's single most important role.</p><p>SSR1 issued 28 recommendations. The ICANN Org reports indicated the Board judged all to be relevant and implementable and that all were fully implemented. The SSR2 analysis was that of the 28 recommendations, 2 were not implemented at all, 26 were partially implemented and none fully implemented. Of these 27 of the 28 were found to still be relevant. That is an astounding analysis 8 years after the acceptance of the SSR1 recommendations.</p><p>The ALAC has a particular interest in the recommendations related to domain name abuse, and notes that several of the recommendations overlap with and complement those issued by the RDS-WHOIS2-RT and the CCT RT.</p><p>The ALAC also notes that in the opinion of the SSR2 RT, many of the recommendations are deemed to be of high priority. Given the current interest in ICANN of prioritizing activities with the implicit effect of not addressing those lower on the list, this could lead to not addressing issues critical to the SSR of the DNS. DNS Security, stability and resiliency is not something that we can afford to ignore. The lead item in ICANN's Strategic Plan is <strong><em>"Strengthen the security of the Domain Name System and the DNS Root Server System."</em></strong>. This must be taken into account when allocating resources and we trust that this will be taken into account when the Board works with the RT Implementation Shepherds on deciding how to prioritize the recommendation implementation.</p><p><span style="color: #0000ff;">The ALAC has a particular focus on and interest in DNS Abuse. To address this may require contractual changes to facilitate Contractual Compliance action. Such changes require either negotiations with the contracted parties or a PDP. A PDP will take considerable time and the ALAC does not advocate such a path, but rather it is time for ICANN Org and specifically Contractual Compliance to meet with those contracted parties who have shown an interest in DNS Abuse mitigation, and come to an agreement on needed contractual changes, factoring in not only penalties but any incentives that can be reasonably provided to encourage compliance.</span></p><p><span style="color: #0000ff;">Given the potential for rejection or deferral of the large number of high priority items, the ALAC encourages the review team to strengthen the justification on the high priority items.</span></p><p><strong>Summary:</strong></p><p>We are living in a world where many parties seem to have a interest in destabilizing critical infrastructure and the Internet in particular. The fact that our systems have been sufficiently robust in the past is not an indication that this is sustainable moving forward. ICANN needs to take seriously the need to professionally and rigorously ensure the SSR of its DNS operations. In particular, known vulnerabilities need to be corrected with the utmost haste.</p>
CALLOPEN
2020-02-26 00:00:00.0 UTC
CALLCLOSE
2020-03-19 00:00:00.0 UTC
VOTEOPEN
2020-03-20 00:00:00.0 UTC
VOTECLOSE
2020-03-25 00:00:00.0 UTC
SUBMISSION
2020-03-20 00:00:00.0 UTC