Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m ib-15.txt

From: "Sharon Chisholm" <[email-masked]>
Date: Wed, 8 Oct 2003 15:48:20 -0400

Hi

The following is the proposed resolution to Randy-75-2. Assuming no
objection, this item will is closed with no changes to the draft.

Assuming you referring to the following text:

"  Setting these objects may have disruptive effects on network
   operation that range from omission of alarm notifications to
   flooding of unwanted alarm notifications from the network.
   The consequence of suppressing or deferring the reporting
   of an alarm can prevent the timely delivery of important
   diagnostic information, including information that can help
   identify an attack."

This is not relevant in the case of the Alarm MIB since we neither suppress
or defer notifications. We have text about throttling in the 'normal' places
within the draft.

Sharon

-----Original Message-----
From: Randy Presuhn [mailto:[email-masked]] 
Sent: Thursday, October 02, 2003 6:56 PM
To: Disman (E-mail)
Subject: [Disman] Security considerations in
draft-ietf-disman-alarm-mib-15.txt

Hi -

WG chair hat on:

> From: "Sharon Chisholm" <[email-masked]>
> To: "Disman (E-mail)" <[email-masked]>
> Cc: <[email-masked]>; "Randy Presuhn" 
> <[email-masked]>; "Romascanu, Dan (Dan)"
<[email-masked]>
> Sent: Monday, September 29, 2003 7:34 AM
> Subject: [Disman] RE: Comments on draft-ietf-disman-alarm-mib-14.txt
...
> 75-2) This section should also mention throttling / DoS attacks based 
> on notification generation.
>
> Sharon->Neither of the examples given in the MIB Review Guidelines do
...

Given the IESG's comments on the ARC MIB, I believe we need to reconsider
this comment.

Randy Presuhn, disman WG chair

---

From: "Sharon Chisholm" <[email-masked]>
Date: Wed, 8 Oct 2003 16:09:09 -0400

Hi

While I understand how the ARC MIB could be used to cause the problems that
the IESG was concerned with, I don't really see where the Alarm MIB poses
any more risk than 'normal' notifications. Ok. Let me put on my imagination
hat: if a manager somehow sets up 323432 alarm models that alarm on the same
internal stimulus and use the Alarm MIB notifications and then makes that
internal stimulus happen, then 323432 notifications will get sent out on the
wire. Is this what we are trying to warn people against? 

Sharon

-----Original Message-----
From: Randy Presuhn [mailto:[email-masked]] 
Sent: Wednesday, October 08, 2003 3:58 PM
To: Disman (E-mail)
Subject: Re: [Disman] Security considerations in

Hi -

> Cc: "Randy Presuhn" <[email-masked]>
> Sent: Wednesday, October 08, 2003 12:48 PM
> Subject: RE: [Disman] Security considerations in 
..
> objection, this item will is closed with no changes to the draft.

I object, both as WG chair and as a technical contributor.

> This is not relevant in the case of the Alarm MIB since we neither 
> suppress or defer notifications. We have text about throttling in the 
> 'normal' places within the draft.

Technically:
Even with the throttling language that's there, this MIB can be used to
cause flooding, either due to an exessive number of resources going into
alarm (throttling is in part per resource type), oscillating (throttling is
on consecutive notifications), or distributed DoS (multiple systems
configured).

As Chair:
Given the IESG's comments on the ARC MIB, which show that they are well
aware of these issues, I believe we need to reconsider.

Randy

---

From: "Sharon Chisholm" <[email-masked]>
Date: Wed, 8 Oct 2003 16:19:57 -0400

Hi

I've just realized this is a bad example. The existing throttling text
ensures this doesn't happen.

Sharon

-----Original Message-----
From: Chisholm, Sharon [CAR:0S00:EXCH] 
Sent: Wednesday, October 08, 2003 4:09 PM
To: Disman (E-mail)
Cc: Randy Presuhn
Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m
ib-15.txt

Hi

Sharon

-----Original Message-----
From: Randy Presuhn [mailto:[email-masked]] 
Sent: Wednesday, October 08, 2003 3:58 PM
To: Disman (E-mail)
Subject: Re: [Disman] Security considerations in

Hi -

..

Technically:

As Chair:

Randy