Subject: RE: what is a threat analysis?

From: "Christian Huitema" <[email-masked]>
Date: Tue, 16 Aug 2005 06:54:41 -0700

> The reason I brought this to this list is because there's
> no clarity about what is meant by a "threat analysis", though
> it seems to be cropping up more and more in the IETF process
> (look ma! no hoops!). If it's going to be part of our process,
> then I think its incumbent on those who want to impose the
> process to be clear about what they're asking for, and for
> that process to not be an idiosyncratic. The waste of time
> here is not the process per se, but the work on drafts,
> etc, that are not what the person making the demand is asking
> for. Do you have an objection to clarity in process?

I personally consider threat analysis an integral part of protocol
design. A well written security consideration should read very much as a
threat analysis: what are the system's assets that need protection; what
are the possible interfaces through which attacks can be conducted;
enumerate the likely attacks through those interfaces; ensure that all
these attacks are properly mitigated. Doing that at design time is much
easier than trying to retrofit security when attacks are found in the
wild.

As Eric Fleischman pointed out, doing good security analyses requires
training.  In particular, the enumeration of possible attacks looks very
much like a brainstorming session, and relies on the expertise of
working group members. However, members of an engineering organization
like the IETF ought to be eager to acquire such training. I mean, do you
really want to design insecure protocols?

For those interested in self training, I recommend the book "Writing
Secure Code, Second Edition" by Michael Howard and David LeBlanc
(http://www.microsoft.com/mspress/books/5957.asp).

-- Christian Huitema

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Marc Manthey <[email-masked]>
Date: Tue, 16 Aug 2005 16:36:39 +0200

On Aug 16, 2005, at 3:54 PM, Christian Huitema wrote:
> For those interested in self training,

hello christian, hello experts

i saw that you are involed in IVS  with Thierry Turletti from the  
early days  on

A set of four Internet-Drafts specifying the RTP protocol were issued in
December 1992, and an Internet-Draft on packetization of H.261 coded
video was issued in March, 1993.  In addition, RTP has been implemented
to varying degrees in the following programs:
...........
IVS              Thierry Turletti and Christian Huitema
Maven            Charley Kline
........
http://mirror.switch.ch/ftp/doc/ietf/avt/avt-minutes-93mar.txt

Whitch drafts your  talking about ? And where can i find something  
about MAVEN ?

any pointers would be  greatly appreciatet

best regards

marcM.

http://www.wjt2005.de/