Subject: [Netconf] Security Considerations sections of YANG modules documents

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 10 Mar 2010 10:59:53 +0100

While reading draft-ietf-netconf-monitoring-12.txt in preparation for
the AD review I observed that the Security Considerations section is
pretty 'thin', containing much less that can be found in the similar
sections of documents that include MIB modules. The security experts
will almost certainly consider that important information is missing and
the document will not pass the SEC-DIR and Security AD reviews. This
being the first document with a YANG module in the normative section, it
will also set kind of a model to be followed by other. I suggest that we
prepare a set of guidelines similar to the ones we have for MIB
documents at http://www.ops.ietf.org/mib-security.html and we run them
with the Security Directorate and AD's. 

Comments? Volunteers? 

Dan

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 11 Mar 2010 06:58:12 -0800

>>>>> On Wed, 10 Mar 2010 10:59:53 +0100, "Romascanu, Dan (Dan)" <[email-masked]> said:

DR> I suggest that we prepare a set of guidelines similar to the ones we
DR> have for MIB documents at http://www.ops.ietf.org/mib-security.html
DR> and we run them with the Security Directorate and AD's.

You're talking about two different things here though.

For the security guidelines for the yang language, shouldn't it be
similar to what smiv2 has in it's document?

And for new yang modules, yes a template would be good but that wouldn't
go into the yang base?
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 11 Mar 2010 16:22:11 +0100 (CET)

> similar to what smiv2 has in it's document?

Isn't it pretty similar?

SMIv2:

  This document defines a language with which to write and read
  descriptions of management information.  The language itself has no
  security impact on the Internet.

YANG:

  This document defines a language with which to write and read
  descriptions of management information. The language itself has no
  security impact on the Internet.

  Data modeled in YANG might contain sensitive information. RPCs
  or notifications defined in YANG might transfer sensitive information.

  Security issues are related to the usage of data modeled in
  YANG. Such issues shall be dealt with in documents describing the
  data models and documents about the interfaces used to manipulate
  the data e.g., the NETCONF documents.

  Data modeled in YANG is dependent upon:
  - the security of the transmission infrastructure used
     to send sensitive information
  - the security of applications which store or release
     such sensitive information.
  - adequate authentication and access control mechanisms
     to restrict the usage of sensitive data.

/martin

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 11 Mar 2010 09:56:51 -0800

>>>>> On Thu, 11 Mar 2010 16:22:11 +0100 (CET), Martin Bjorklund <[email-masked]> said:

MB> SMIv2:

MB> This document defines a language with which to write and read
MB> descriptions of management information.  The language itself has no
MB> security impact on the Internet.

Yeah, that should be rewritten ;-)

If I were writing a clause, I'd be tempted to at least mention the
fairly obvious: "Exposing any configuration objects to the network
invariably offers an avenue for attack and must be mitigated through
good network access policies and software robustness" or something like that.
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: "Ersue, Mehmet (NSN - DE/Munich)" <[email-masked]>
Date: Thu, 11 Mar 2010 19:16:13 +0100

Hi Dan,

yes, we need to get it right. I hope we can get 
some help from MIB security experts.

Isn't the best place to give such a template and 
guidance the document draft-ietf-netmod-yang-usage ?

BTW: The first and much bigger YANG module we 
have is in draft-ietf-ipfix-configuration-model,
which has also a somewhat limited security 
considerations section.

Cheers,
Mehmet

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of ext Romascanu, 
> Dan (Dan)
> Sent: Wednesday, March 10, 2010 11:00 AM
> To: [email-masked]; [email-masked]
> Subject: [Netconf] Security Considerations sections of YANG 
> modules documents
> 
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>

---

From: Andy Bierman <[email-masked]>
Date: Thu, 11 Mar 2010 10:34:21 -0800

> good network access policies and software robustness" or something like that.

The YANG Usage draft has this text, which might be appropriate
for the YANG draft instead.

3.4.  Security Considerations Section

   Each specification that defines one or more modules MUST contain a
   section that discusses security considerations relevant to those
   modules.  This section MUST be patterned after the latest approved
   template (available at [ed: URL TBD]).

   In particular, writable module objects that could be especially
   disruptive if abused MUST be explicitly listed by name and the
   associated security risks MUST be spelled out; similarly, readable
   module objects that contain especially sensitive information or that
   raise significant privacy concerns MUST be explicitly listed by name
   and the reasons for the sensitivity/privacy concerns MUST be
   explained.

There aren't any specific security concerns with the data modeling
language, but the YANG spec also contains normative mappings between
the YANG syntax and NETCONF protocol behavior, and that certainly is
within scope of the SC section.

Andy

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 15 Mar 2010 00:55:41 +0100

> From: Ersue, Mehmet (NSN - DE/Munich) [mailto:[email-masked]] 

> 
> BTW: The first and much bigger YANG module we have is in 
> draft-ietf-ipfix-configuration-model,
> which has also a somewhat limited security considerations section.
> 
> Cheers,
> Mehmet
> 

The IPFIX document was not yet submitted to the IESG. 

Dan

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 15 Mar 2010 07:01:30 -0700

>>>>> On Thu, 11 Mar 2010 10:34:21 -0800, Andy Bierman <[email-masked]> said:

AB> The YANG Usage draft has this text, which might be appropriate
AB> for the YANG draft instead.

I think that'd be good text to include.
-- 
Wes Hardaker
Cobham Analytic Solutions