SSAC Overview May 23, 2006 Steve Crocker

2 SSAC Role Security and stability expertise Advice to… –ICANN board –ICANN staff –ICANN advisory committees –ICANN supporting organizations –Community at large Advice only -- no formal authority Both responsive and proactive

3 History Exploratory meeting in Nov 2001 Decision to form committee Recruiting, kick off in spring 2002 Same chair from beginning Periodic review of membership

4 Structure Advisory committee of experts –Registries, Registrars, Address, Security, Research –Geographic breadth –No bureaucrats, attorneys, politicians Volunteer, unpaid –Staff support -- SSAC Fellow, Exec

5 SSAC Members (1) Alain Aina Jaap Akkerhuis KC Claffy Steve Crocker, chair Johan Ihren Rodney Joffe

6 SSAC Members (2) Mark Kosters Allison Mankin Ram Mohan Russ Mundy Frederico Neves Jon Peterson

7 SSAC Members (3) Ray Plzak, vice chair Mike St. Johns Doron Shikmoni Bruce Tonkin Paul A Vixie Suzanne Woolf

8 Others Dave Piscitello - ICANN Fellow Jim Galvin - Exec Daniel Karrenberg - Invited Guest Patrik Fältström - Invited Guest Lyman Chapin - Invited Guest, SPE Chair Stefano Trumpy - GAC Liaison Olaf Kolkman - IAB Point of Contact

9 Operation & Recruiting Weekly conference calls Team reports –Staff assistance, consensus Presentations at ICANN meetings Looking for experienced, committed experts…

10 SSAC Reports, Advisories Usually related to specific incident/issue –Findings, Recommendations Opportunity for explanation of an area –Useful beyond specific incident/issue Broad sense of security and stability –Protection of registrants, users, end- systems

11 Past Efforts DNSSEC -- spun off separate initiative Wild card (SiteFinder) episode Domain Name Hijacking Alternate Roots Amplified Distributed Denial of Service (DDoS) Attacks Address filtering at edge

12 Current Efforts Whois privacy mechanisms Repurposed domains names

13 Other Concerns Integration of IDNs Address validation, routing security

14... Attacker Target name server at IP = Open recursive servers Name server bar. (3) Open resolvers ask bar. for record foo (4) bar. responds with record foo (4000 byte DNS TXT RR) (5) Open resolvers send DNS response with (4000 byte DNS TXT RR) to target name server (1) Attacker directs zombies to begin attack (2) All zombies send DNS query for record foo in domain bar. to open recursive servers and set source IP= Zombies Anatomy of the DDoS Attack

15 DDoS Recommendations Not just a DNS issue Stop forged return IP addresses –Prior advice -- BCP 38, SAC 004, etc. Take protective action as needed