<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:TimesNewRomanPSMT;}
@font-face
{font-family:TimesNewRomanPS;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:392123146;
mso-list-template-ids:-509737580;}
@list l0:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-IE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Mikey<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">I’d have to disagree with you about the hosting providers<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">A LOT of them are not registrars<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">And a LOT of them do not qualify for ISPCP membership<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">This is something that people like Elliot Noss have raised in the past ..
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">M<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">--<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Mr Michele Neylon<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Blacknight Solutions<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hosting & Colocation, Domains<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">http://www.blacknight.co/<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">http://blog.blacknight.com/<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">http://www.technology.ie<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Intl. +353 (0) 59 9183072<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Locall: 1850 929 929<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Direct Dial: +353 (0)59 9183090<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Fax. +353 (0) 1 4811 763<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Twitter: http://twitter.com/mneylon<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">-------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Road,Graiguecullen,Carlow,Ireland Company No.: 370845<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Mike O'Connor [mailto:mike@haven2.com]
<br>
<b>Sent:</b> Monday, March 3, 2014 1:01 PM<br>
<b>To:</b> Michele Neylon - Blacknight<br>
<b>Cc:</b> GNSO SSR List<br>
<b>Subject:</b> Re: [Gnso-ssr] SAC065 - DDoS Attacks Leveraging DNS<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">hi Michele,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">hm. a couple points. SAC65 isn’t just talking about ISPs and hosting providers — it’s really talking about network operators. all the way from individuals running their home networks up to content distribution networks, corporate networks,
ISPs, hosting providers, the works. i’d love to see a strengthening of the relationships between the ICANN community and that broadly-defined network-operator community — this last series of SSAC reports just reminds me of that.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">the ISPCP is definitely in the game here. we actually has a very broad worldwide reach, which we’ve been refining as some of the more “operational” issues associated with the new gTLD program have come up. Name Collisions really got us
going — we now publish a weekly email of the newly-delegated TLDs, aimed at non-members of the ISPCP (you can subscribe by going here —
<a href="http://ispcp.info/mailman/listinfo/gtld-delegations">http://ispcp.info/mailman/listinfo/gtld-delegations</a> ). i’m planning to post all these SSAC reports to our next “issue” at the end of the week. so fersure, the ISPCP is willing and able to help
— but we’re probably not the best group to *lead* a worldwide communications campaign. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">i will gently push back on the “truly representative” comment. most of our members are either from very large ISPs or represent regional ISP associations - so while our number is relatively small, we speak to a pretty large international
audience (that is actually quite biased towards regions outside North America). we could always use help with outreach and recruiting, since most of us are focused more on policy-making than sales and marketing the ISPCP. but i would contend that we *are*
pretty representative.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">and i’ll also push back a bit on the lack of a home for hosting providers. it seems to me that they have three choices. if they are registrars (like you are), they can hang out in the Registrar SG. i would bet that just about every registrar
has more money coming in from hosting than they do from sponsoring domain names. if they’re ISPs, they are welcome in the ISPCP. some of Christian Dawson’s members fall in this category and that’s why he’s representing those folks in our gang. if neither
of those pertain, the Business Constituency could be the place to go. there’s a pretty strong “operations oriented, large corporate network operator” subgroup in the BC (Jeff Brueggeman and Bill Smith come to mind as an examples).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">so back to the main point that i think we agree on — there’s a real need to provide a clear channel for recommendations like the ones in this report and all the others to find an audience in the larger community of people who operate networks,
yes? i’d love to help with that.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">mikey<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mar 3, 2014, at 3:38 AM, Michele Neylon - Blacknight <<a href="mailto:michele@blacknight.com">michele@blacknight.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Mikey</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Well there’s a couple of things ..
</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">First off, if the ISPs were truly representative of ISPs around the globe, wouldn’t that group be the one to share this kind of information
far and wide within their member organisations?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Though, as others have mentioned in the past, there’s no real “home” for hosting providers etc., within ICANN at the moment and maybe
they’re the real audience for this .. </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Regards</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US">Michele</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">--</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Mr Michele Neylon</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Blacknight Solutions</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hosting & Colocation, Domains</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="http://www.blacknight.co/">http://www.blacknight.co/</a></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="http://blog.blacknight.com/">http://blog.blacknight.com/</a></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="http://www.technology.ie">http://www.technology.ie</a></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Intl. +353 (0) 59 9183072</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Locall: 1850 929 929</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Direct Dial: +353 (0)59 9183090</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Fax. +353 (0) 1 4811 763</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Twitter:
<a href="http://twitter.com/mneylon">http://twitter.com/mneylon</a></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">-------------------------------</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Road,Graiguecullen,Carlow,Ireland Company No.: 370845</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">
<a href="mailto:gnso-ssr-bounces@icann.org">gnso-ssr-bounces@icann.org</a> [<a href="mailto:gnso-ssr-bounces@icann.org">mailto:gnso-ssr-bounces@icann.org</a>]
<b>On Behalf Of </b>Mike O'Connor<br>
<b>Sent:</b> Monday, March 3, 2014 12:31 AM<br>
<b>To:</b> GNSO SSR List<br>
<b>Subject:</b> [Gnso-ssr] SAC065 - DDoS Attacks Leveraging DNS</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">hi all,<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">here’s the second new SSAC report — SAC065 - DDoS Attacks Leveraging DNS<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span class="apple-tab-span"> </span><a href="http://www.icann.org/en/groups/ssac/documents/sac-065-en.pdf">http://www.icann.org/en/groups/ssac/documents/sac-065-en.pdf</a><o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">please read the report in it’s original form and don’t rely on this extract — the detailed recommendations are great. i’d have included them, but my cut/paste skills resulted in a format-mess. so i’ve just included the one-line summary
recommendations in the Executive Summary.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">this report is another call to action — in this case, as an ISP, i feel that i’m included directly in this. i’m wondering how the ISP Constituency can join the effort that is being called for in this report, and would like to be put on
the “interested in helping out list” if one is ever created.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">again, the question. who does what? where do the resources come from? John Crain’s Security gang is hopelessly and woefully underfunded as it is. the ISP constituency raised the underfunding issue last year in our comments on the budget
— and got roundly ignored, along with all the rest of the community input i saw. do we just shout again? shout louder? shout at somebody else? it’s ridiculous to think that his tiny gang can do much about this without more support from above.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">meanwhile ICANN has multiple millions of dollars aimed at “Outreach” — shouldn’t a big slice of that be aimed at topics like this one, towards the network-operator and DNS-operator audiences described in this report?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><rant ends><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">thoughts?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">mikey<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<div>
<div>
<div>
<div>
<p><b><span style="font-size:16.0pt">Executive Summary </span></b><o:p></o:p></p>
<p><span style="font-family:TimesNewRomanPSMT">This document is intended for the Internet technical community, particularly authoritative and recursive Domain Name System (DNS) operators, network operators, the Internet Corporation for Assigned Names and Numbers
(ICANN), and policy makers. It explores several </span><i><span style="font-family:TimesNewRomanPS">unresolved
</span></i><span style="font-family:TimesNewRomanPSMT">critical design and deployment issues that have enabled increasingly large and severe Distributed Denial of Service (DDoS) attacks using the DNS. While DDoS attacks can exploit multiple characteristics
of network infrastructure and operations, the prevalence and criticality of the DNS means that securing it is both challenging and urgent. These unresolved DNS issues and related DDoS attacks pose a real and present danger to the security and stability of
the Internet. </span><o:p></o:p></p>
<p><span style="font-family:TimesNewRomanPSMT">The first recommendation below is made to ICANN, while others are made to operators of Internet infrastructure and manufacturers. While in many instances they reflect actions not under ICANN’s control and actors
not necessarily within ICANN’s usual community, they are meant to address the overall responsibilities of the multi-stakeholder community and encourage ICANN to take action where it is relevant to do so. In particular, this means ICANN should be looking for
ways to increase the effectiveness of steps already being taken against DNS abuse and promoting the participation of others as well as pursuing the measures suggested here.
</span><o:p></o:p></p>
<p><span style="font-family:TimesNewRomanPSMT">The Security and Stability Advisory Committee (SSAC) strongly recommends that
</span><i><span style="font-family:TimesNewRomanPS">all </span></i><span style="font-family:TimesNewRomanPSMT">types of DNS operators and network operators take immediate steps to mitigate the design and deployment issues that make large scale DDoS attacks
possible. </span><o:p></o:p></p>
<p><span style="font-family:TimesNewRomanPSMT">Specifically, the SSAC strongly recommends that:
</span><o:p></o:p></p>
<p style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo2"><![if !supportLists]><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]><span style="font-family:TimesNewRomanPSMT">ICANN should help facilitate an Internet-wide community effort to reduce the number of open resolvers and networks that allow network spoofing. This effort should involve measurement efforts
and outreach. </span><o:p></o:p></p>
<p style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo2"><![if !supportLists]><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]><span style="font-family:TimesNewRomanPSMT">All network operators should take immediate steps to prevent network address spoofing.
</span><o:p></o:p></p>
<p style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo2"><![if !supportLists]><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]><span style="font-family:TimesNewRomanPSMT">Recursive DNS server operators should take immediate steps to secure open recursive DNS servers.
</span><o:p></o:p></p>
<p style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo2"><![if !supportLists]><span style="mso-list:Ignore">4.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]><span style="font-family:TimesNewRomanPSMT">Authoritative DNS server operators should support efforts to investigate authoritative response rate limiting.
</span><o:p></o:p></p>
<p style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo2"><![if !supportLists]><span style="mso-list:Ignore">5.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]><span style="font-family:TimesNewRomanPSMT">DNS server operators should put in place operational processes to ensure that their DNS software is regularly updated and communicate with their software vendors to keep abreast of the latest
developments. </span><o:p></o:p></p>
<p style="margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo2"><![if !supportLists]><span style="mso-list:Ignore">6.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]><span style="font-family:TimesNewRomanPSMT">Manufacturers and/or configurators of customer premise networking equipment, including home networking equipment, should take immediate steps to secure these devices and ensure that they are
field upgradable when new software is available to fix security vulnerabilities, and aggressively replace the installed base of non-upgradeable devices with upgradeable devices. </span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<p><b><span style="font-size:16.0pt">2. Why Is This Important? </span></b><o:p></o:p></p>
<p><span style="font-family:TimesNewRomanPSMT">Critically, basic controls for network access and DNS security have not been as widely implemented as is necessary to maintain and grow a resilient Internet. When increasingly higher-speed Internet connections
are combined with the growing power of individual end user devices, an unintended result is an extraordinary and growing capacity for conducting extremely large scale and highly disruptive DDoS attacks using unsecured DNS infrastructure. Paradoxically, the
networks that fail to implement the best current security practices are the sources, not the destinations, of attack data flows. Defenders are powerless to influence the design and implementation of the attackers’ preferred networks. It takes only a relatively
modest number of end-user devices, for example, to build or rent as a botnet for an attacker to generate significant attack traffic using only a very few, generally well-managed DNS authoritative servers operated by entirely innocent third parties.
</span><o:p></o:p></p>
<p><span style="font-family:TimesNewRomanPSMT">These attacks have been growing in size over time, and are disrupting individual businesses;</span><span style="font-size:6.0pt;font-family:TimesNewRomanPSMT;position:relative;top:-5.0pt;mso-text-raise:5.0pt">3
</span><span style="font-family:TimesNewRomanPSMT">entire networks, critical applications and services;</span><span style="font-size:6.0pt;font-family:TimesNewRomanPSMT;position:relative;top:-5.0pt;mso-text-raise:5.0pt">4
</span><span style="font-family:TimesNewRomanPSMT">and entire countries.</span><span style="font-size:6.0pt;font-family:TimesNewRomanPSMT;position:relative;top:-5.0pt;mso-text-raise:5.0pt">5
</span><span style="font-family:TimesNewRomanPSMT">The scale of attacks will continue to grow if the Internet community takes no further action. </span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">PHONE: 651-647-6109, FAX: 866-280-2356, WEB:
<a href="http://www.haven2.com/">www.haven2.com</a>, HANDLE: OConnorStP (ID for Twitter, Facebook, LinkedIn, etc.)</span>
<o:p></o:p></p>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">PHONE: 651-647-6109, FAX: 866-280-2356, WEB:
<a href="http://www.haven2.com">www.haven2.com</a>, HANDLE: OConnorStP (ID for Twitter, Facebook, LinkedIn, etc.)</span>
<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>