Subject: [nvo3] Q about draft-ietf-nvo3-security-requirements-04.txt

From: Sowmini Varadhan <[email-masked]>
Date: Tue, 16 Jun 2015 10:07:58 -0400

Hi,

I'm somewhat puzzled by the distinction between an "Insider Attack"
and the "Compromised TS" in this draft. Also, it looks like
Section 4.2 is almost identical to Section 4.3..

Could you elaborate a bit more about the difference, and especially,
when that difference impacts security requirements?

Thanks,
--Sowmini

---

From: Sowmini Varadhan <[email-masked]>
Date: Tue, 16 Jun 2015 12:38:06 -0400

On Tue, Jun 16, 2015 at 10:34 AM, Sam Hartman
<[email-masked]> wrote:
>
> So, NVO3 is supposed to provide isolation for a TS.
> TSes aren't really trusted as I understand it.
>
> However, we'd like to provide the ability to secure some parts of the
> system against compromises that affect more than just a TS.  In
> particular, we'd like to prevent a compromise of one node in the
> virutalization environment from giving you a network-wide compromise.
> You will doubtless be able to affect everything going through/hosted on
> that node, but this shouldn't imply a compromise of the mapping layers
> or data center.

Understood, but the document says (Section 4):
".. attacks are classifed ..  into three
   categories: the attacks from compromised NVO3 devices (inside
   attacks), the attacks from compromised tenant systems, and the
   attacks from underlying networks (outside attacks)."

Seems like a compromised TS is also an inside attacker (and
vice-versa?) so the protection measures for both of these should
always be the same? If they are not always the same, it might help
to have the doc explain when they would be different, and what
differences to take into account, when coming up with the security
protections.

--Sowmini

---

From: Sowmini Varadhan <[email-masked]>
Date: Tue, 16 Jun 2015 18:12:15 -0400

On Tue, Jun 16, 2015 at 2:24 PM, Sam Hartman
<[email-masked]> wrote:
>>>>>> "Sowmini" == Sowmini Varadhan <[email-masked]> writes:

> I don't think of a TS as an nvo3 device in that sense, no.
> And no, I don't think the protection would be the same.
> As an example, VLAN tags and the like can isolate TSes from each other
> but cannot defend against insiders.

Ok, that disticintion wasnt obvious to me from reading the doc.
thanks for the clarification.

--Sowmini