Roundtable on (Cyber)Security for stakeholder inputs to GCCS2017

Roundtable on security
Internet Society India Chennai Roundtable for stakeholder inputs to cybersecurity policy

The Internet Society India Chennai  Round Table for Stakeholder inputs was held on the on October 22 at The Raj, Residency Towers, Chennai during 6-9 pm. This event on 22nd gains added importance as an event that was  organised as a Preparatory event to the Global Conference on Cyberspace to be held at New Delhi, as a High Level global diplomaticand policy event later this year.

The Round Table topic goes well beyond Internet Security, and broadly and loosely examined how Internet Security measures spill over to everyday life and how various security concerns, valid and real, sometimes translate into restrictions that alter the way we live our lives. The intention has been to see if diverse view points could contribute to Security design and help evolve good Security policies. The session was open for remote participation and recorded. The recording of the session is accessed from the link below:

Roundtable for stakeholder inputs to Cyber(Security)

This Roundtable event was in follow up an earlier Roundtable event during an ISOC Chennai DNSSEC/KSK rollover policy session at GRT Grand Hotel aur earlier event during June at Chennai. The Report on July 9, 2017.  A writeup based on the June event was sent to the Internet Governance Forum (IGF) Best Practices on Cybersecurity as inputs and attached below for context.

Reference Documents from the earlier (July9) event: (links below)

Internet Society India Chennai Response to the Questionairre from the IGF Best Practices Forum on Cyber Security

Report on Internet Society India Chennai Roundtable on the policy aspects of Cybersecurity:

ISOC Chennai – ICANN DNSSEC KSK event at Chennai

To reach another person on the Internet you have to type an address into your computer – a name or a number. That address has to be unique so computers know where to find each other.

ICANN coordinates these unique identifiers ( Names and Numbers) across the world.

When typing a name, that name must be first translated into a number by a system before the connection can be established. That system is called the Domain Name System (DNS) and it translates names like https://wikipedia.org into the numbers. These numbers are called Internet Protocol (IP) addresses.

ICANN coordinates the addressing system to ensure all the addresses are unique. Without that coordination we wouldn’t have one global Internet.

Recently vulnerabilities in the DNS were discovered that allow an attacker to hijack this process of looking some one up or looking a site up on the Internet using their name. The purpose of the attack is to take control of the session to, for example, send the user to the hijacker’s own deceptive web site for account and password collection.

A technology called DNS Security Extensions (DNSSEC) secures this part of the Internet’s infrastructure. You can read more about DNSSEC here:

https://www.icann.org/resources/pages/dnssec-qaa-2014-01-29-en

ICANN organises DNSSEC Training and Events worldwide. The Internet Society India Chennai Chapter would co-organize a DNSSEC event at Chennai on July 9, 2017. ICANN would host this event.

This would be a half-day session on DNSSEC with particular attention to the KSK rollover for the technical community in Chennai.  The event is open for ISPs, Network Operators, DNS Administrators and other Interested parties, preferably for those whose line of work relates to DNSSEC. Please reach out to the companies / organizations including educational institutions, Law and Order Agencies, Banks, ISPs, IT Companies and independent professionals you may know to be likely to have an interest in this topic.

The session would cover the following topics during 9 30 am – 1 pm, followed by Lunch

dnssec
Domain Name System Security Extensions

 

DNS and DNS Security Overview
Why DNSSEC?
Root Zone DNSSEC KSK Rollover

 

There is no Admission fee. However,  pre-registration is required as seats are limited to 30. The form is at page https://goo.gl/forms/YQO2KxCfTaVWul1X2 (short link)

( The above link points to: https://docs.google.com/forms/d/e/1FAIpQLSeT88T3jM5gn0Oyjk_cXTMI98xLwOa3jVbFNfN0rvkc7Ozlpw/viewform?usp=sf_link  )

After Lunch we will have an hour of discussions on the policy aspects of DNS.  This session would be for Business and Community Leaders who have an interest in Internet Policy, who would join us on invitation. If wish to recommend names of Business / Community Leaders whom you might have expertise and interest in the security aspects of DNS, please pass on the names by email to isocindiachennai AT gmail DOT com The invitees would join other participants for Lunch at 1 pm which would be followed by about 60 minutes or round table discussions on the policy aspects of DNS.

Y2K20: Opportunities in design and testing for freelance application developers, small IT companies, medium, large and huge.

It was not uncommon to find the earliest of the Web Application Developers to assume that all domain names would end in .com, all email addresses would follow the format @xyz.com. While developers took into account newer domain names such as .info in due course, most continued to design applications to accept Domain names and email addresses in ASCII just as software developers in the 80s assumed that it would be unnecessary to have any more than two digits to denote the year, which led to the famous Y2K issue towards the year 2000.

y2k20
Imaginary logo of y2k20, a name that does not exist

Now there are new Top Level Domain Names (such as .family and .game) and Internationalized Domain Names (in various native non-ascii scripts of India and the world, such as .??????? and .???? (I typed India in Tamil and Devanagiri, displays here as ???) as well as Internationalized email Internet Domain Names that would allow users to have addresses in their native scripts.

If a browser or a form in a webpage limits acceptance of domain names or email addresses with a rule such as “a domain name must be in English and end with .com, or .net or .org” or “an email address must be in English or numerals” then it is archaic.

It is a problem far larger in its dimensions than the Y2K problem of year 2000 which kept the IT community of the entire world talking. On this problem of “Universal Acceptance” there appears to be inadequate attention to the problem in global public interest as well as to the commercial opportunities it presents for enterprising Developers and Corporations. This might emerge to be a huge commercial vertical in itself in view of the Design changes to be brought about and in terms of the testing requirements. #Deity #NASSCOM #WIPRO #TiE #TCS #Cognizant (If you are from a different country, please feel free to rewrite this post to suit your country and publish it. This post is not copyrighted.)

For more information, follow the publicly archived, transparent discussions in the IETF forum, at ICANN and at the Internet Society on this issue. You could also write to isocindiachennai (At) gmail (dot) com for additional pointers or any clarification. Or ask your Executives at a higher level to take part in ICANN meetings that are open and held as multi-stakeholder global meetings. And also join the Internet Society India Chennai Chapter. Such participation would lead you to positive involvement in the global Internet and also connect you to business opportunities not only in the y2k20 (there is no such term, the term is coined to describe the issue and the opportunity) but also in DNSSEC, IPv6 transition, Internet of Things (IoT) and new gTLDs.

What does the phrase “Universal Acceptance” mean?

“Universal Acceptance of domain names and email addresses” (or just “Universal Acceptance”, or even “UA”, for short) means that all apps and online services should accept all Internet domain names and email addresses equally.

Universal Acceptance is an important concept these days because the Internet is changing. One way that it is changing is that addresses no longer need to be composed of ASCII characters. (ASCII characters are the 127 Latin-script letters, numerals and punctuation marks that are dominant on the Internet today. All the characters in this document so far have been ASCII characters.)

Most people on earth are not native speakers of languages which use the ASCII characters, so moving from a character set limited to 127 characters to an alternate which can support more than one million characters is essential for those people to fully use and benefit from the Internet. This alternate is called Unicode.

Another way that the Internet is changing is by allowing lots of new domain names. Not only are there simply more of them, but some are longer than any of the older domain names and many of them use the same Unicode system mentioned above.

Note: “Universal Acceptance” is sometimes confused with “Universal Access” or “Universal Accessibility”; those phrases refer to connecting everyone on earth to the Internet, and to building Internet-connected systems for all differently-abled people on earth, respectively. Universal acceptance is limited to domain names and email addresses.

A special group called “Universal Acceptance Steering group (UASG) has been created to work on issues related to Universal Acceptance. UASG doesn’t work on anything else (e.g. Universal Access or Universal Accessibility).

How does an app or an online service support Universal Acceptance?

Software and online services support Universal Acceptance when they offer the following capabilities:

A. Can accept any domain name or email name as an input from a user interface, from a document, or from another app or service

B. Can validate and process any domain name or email name

C. Can store any domain name or email name

D. Can output any domain name or email name to a user interface, to a document, or to another app or service

Unfortunately, older apps and online services don’t always offer those capabilities. Sometimes they lack support for Unicode; sometimes they make wrong assumptions about new domain names, or even assume they don’t exist. Sometimes they support Universal Acceptance in some features but not in all.

How can Universal Acceptance be measured?

Universal Acceptance can be measured in a few ways.

1. Source code reviews and unit testing

2. Manual testing

3. Automated testing

#1 means inspecting the source code and verifying that only the correct programming techniques, software libraries and interfaces (AKA “APIs”) have been used, then verifying that the app or service works by testing against specific test cases for the capabilities A-D listed above. #1 is only practical for app developers and online service providers.

UASG is reaching out directly to the community of app developers and the largest online service providers to encourage them to perform source code reviews and testing to determine the level of Universal Acceptance in their offerings. UASG is also providing a list of criteria which can be used to develop test cases for the capabilities A-D listed above.

#2 can be done by anyone, but it’s labor-intensive. Examples of #2 would include submitting an email address when registering for an online service and verifying that it has been accepted. Since there are lots of potential online services to sign up for, and lots of potential new email address combinations, one must pick and choose which combinations of app, services, email address and/or domain name to test.

UASG is developing a list of top web sites, apps, email addresses and domain names suitable for testing.

#3 requires up-front technical work, but is more scalable to large measuring and monitoring efforts. An example of #3 is the recent gTLD investigation performed by APNIC on behalf of ICANN. <http://www.potaroo.net/reports/Universal-Acceptance/UA-Report.pdf >

UASG is investigating methods of automated testing for Universal Acceptance and will share these as they are developed.

RoundTable at the Asia Internet Symposium: What can India bring to Internet Governace

Asia Internet Symposium Chennai, was organized around the theme “India in the Free and Open Global Internet” in two sessions.


Full Playlist starts with the inaugural introduction to the Event, followed by the recordings of speeches by the Invitees including the Key Note Speaker, in turn followed by the recording of Round Table Session ( bit.ly/aischennai  look for the video titled “AIS Chennai 2014 – Roundtable: What can India bring to Internet Governance?”) followed by Closing Remarks on the intended follow up.

 

The event brought together local Community Leaders from different stakeholder groups and created awareness on the participation opportunities and the receptiveness of the Internet Governance process for global participation. The event also aimed to bring in committed participants to the multi-stakeholder process in India for Internet Governance Policy and programs.

AIS Internet Society India Chennai
Asia Internet Symposium Internet Society India Chennai Key Note by Shri Bharat Epur

The event started with a short duration inaugural session  on India’s concern with a Key Note Address by Bharat Epur, Director, Epur Investments and Talks on Internet Governance by David Appasamy, Founder, Raising iBrows, Samiran Gupta, Head of ICANN for India and Rajnesh Singh, Director, Asia Pacific Regional Bureau of the Internet Society.  This session was followed a very broad Round Table with the these invitees and visionary Business Leaders from TiE Chennai, spiritual leaders from Art Of Living, Students from MOP Vaishnav College, Anna Universtiy and Loyolla College as also several member of Internet Society India Chennai. The discussions went beyond India’s concerns as a Nation, and endeavored to bring up higher thoughts on ways of strengthening Internet Governance in a manner that is fair for the whole world. This was to MAKE A START of a process of generating broad thinking on positive ways by which different cultures could broadly contribute to further the evolution of the Free and Open Internet.

Internet is Global and the process of Internet Governance has enormous responsibilities as it has the well being of all the people of the world at stake. This makes it necessary for the Internet Governance Institutions to look beyond the existing models that happen to be more based on corporate governance models and strengthen it further as a larger and higher governance framework for universal good, broadened with values that are far more profound.

At the moment this is largely an undefined exercise, would get defined as it takes shape further.

AIS Chennai RoundTable
Internet Round Table at Chennai

The RoundTable with participants from India brought up the idea of “Vasu Deva Kudumbakam” – the world as one family – any notion of separation is superficial, but on a deeper level the whole world is an undivided unity. Especially among people of India, this notion of the world as an undivided family is deep rooted. India has the inherent psychological strength to awaken this notion, discuss and nudge others to embrace this idealistic notion.

AIS Internet Society India Chennai
Asia Internet Symposium Internet Society India Chennai Table of Students from MOP Vaishnav College and Anna University

The Round Table brought up thoughts that included abstract ideas of such as the concept of five elements as also ideas drawn from the Constitution of India that could be relevant to global Internet Governance. Other ideas mentioned included the Indian concept of a “Guru” or “RajaGuru” and possible modernization of such a concept into that of an enhanced Advisory Body so as to keep Governance on the path of broader justice. Participants also sought to explore the Indian concept of “Dharma” and its relevance as a component of the existing foundation of Internet Governance.

Follow up

Organized as a session of the Asia Internet Symposium, this Round Table discussion on this theme is the first of the two or more discussions planned at Chennai.The Chennai meeting was a START for this process and the thoughts brought up at this first meeting form a minuscule part of the ideas from the wealth of wisdom from this region, from past and present. There is a plan to organize a larger event with expert participation as a larger round table, possibly with the participation of some Internet Community leaders. Some of the ideas – many more to be identified – to be explored in follow up meetings in Chennai and possibly in certain other parts of the world are:

  • concepts from business including the ISO model of creating an overall propensity to standards across the organization, rather than by inspection of individual products or service components;
  • governance models from large, global Charitable or Non-Governmental or Regional Organizations such as the Tata Trust, Virgin Atlantic, various Foundations or the Council of Europe.
  • concept of Trusteeship as conceived in India.
  • concept of Non-confrontational conflict resolution
  • notions of Commitment and Justice from earlier cultures
  • North African cross cultural notions of do’s and don’ts, right and wrong.
  • notions on various advisory / governance bodies such as the Council of Elders or the seat of a RajaGuru, placed on par or above the Seat of Governance
  • notions of division of powers/ balance in governance from earlier governance models or from National constitutions.
  • ideas on common good by fair governance from Eastern and Western philosophers

Internet Society India Chapter intends to write to other Chapters with a suggestion to replicate this event in their regions as also intends to work on a few jointly organized meetings in one or two locations. (Even this meeting benefited from collaboration, as Joly MacFie of the Internet Society of New York spent ample time guiding Hostmacro Web Services who sponsored Technical Support in-kind for the Webcast, and post event, Joly MacFie received the 12 GB video file, reviewed and edited it upload this Playlist in YouTube.)

The recommendations from this Round Table and follow up events are to be shared with the Internet Community Staff and possibly with any Community working groups exploring topics related to this theme.

Archives

Youtube : http://bit.ly/aischennai (a playlist of seven videos)
blog : http://isocindiachennai.org/?p=1915
Twitter: http://twitter.com/isocchennai

Contact

isocindiachennai (aT) gmail {dot} com