Subject: [Nea] REQ: section 8

From: "Sanchez, Mauricio (ProCurve)" <[email-masked]>
Date: Mon, 26 Feb 2007 02:27:12 -0000

My comments on section 8:
1. Section 8.1, ".NEA client frequently is expected to trust the network
infrastructure not to misuse any disclosed Posture information." sentence:
Doesn't the client always need to trust that the network infrastructure
isn't going to misuse the posture information?  What are some examples where
it doesn't need to trust the infrastructure?
2. Section 8.1.3  - Isn't there a version of the "lying client" problem that
is applicable to servers?  What if my NEA server were compromised in a way
that it no longer could be trusted to function correctly? I'd say each
server component needs the same protection afforded to clients for the lying
client problem.

NITS
1. Missing comma after "However" in section 8.1.1, first paragraph, third
sentence.
2. Extra comma after "NEA" in section 8.1.1, second paragraph, second
sentence.

Cheers,
MS

--------------------------------------------
Mauricio Sanchez, CISSP
Network Security Architect
ProCurve Networking Business
Hewlett Packard
8000 Foothills Boulevard, ms 5557
Roseville CA, 95747-5557

916.785.1910 Tel
916.785.1815 Fax
[email-masked]
--------------------------------------------   

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "Paul Sangster" <[email-masked]>
Date: Mon, 26 Feb 2007 20:07:40 -0800

> -----Original Message-----
> From: Sanchez, Mauricio (ProCurve) [mailto:[email-masked]] 
> Sent: Sunday, February 25, 2007 6:27 PM
> To: [email-masked]
> Subject: [Nea] REQ: section 8
> 
> 1. Section 8.1, ".NEA client frequently is expected to trust 
> the network infrastructure not to misuse any disclosed 
> Posture information." sentence:
> Doesn't the client always need to trust that the network 
> infrastructure isn't going to misuse the posture information? 
>  What are some examples where it doesn't need to trust the 
> infrastructure?

We could make this absolute but their could be situations where the
client didn't disclose any sensitive information that it cares about
being disclosed to other parties (e.g. when it sends only Compliance
Claim Attributes.)  Another option might be that the employment
agreement the Endpoint User signed states that the Endpoint Owner (who
is also the network Owner) can make use of the information in any way it
sees fit.  In general, I agree with your comment but wanted to leave the
door open for (hopefully!) less common situations.  Maybe we should
change "frequently" to "normally"?

> 2. Section 8.1.3  - Isn't there a version of the "lying 
> client" problem that is applicable to servers?  What if my 
> NEA server were compromised in a way that it no longer could 
> be trusted to function correctly? I'd say each server 
> component needs the same protection afforded to clients for 
> the lying client problem.

Can you explain more?  In these examples the server isn't being assessed
by the client.  If it were being assessed, then this would be an issue.
What did you have in mind (is it the server being assessed)?  In this
case the NEA Server would run on the Endpoint and the NEA Client on the
"server".

> 
> NITS
> 1. Missing comma after "However" in section 8.1.1, first 
> paragraph, third sentence.
> 2. Extra comma after "NEA" in section 8.1.1, second 
> paragraph, second sentence.

Ah that's where the comma went :).