Subject: Re: draft-fang-ppvpn-security-framework-01

From: Mark Duffy <[email-masked]>
Date: Tue, 12 Aug 2003 23:22:45 -0400

Hi Ron, thanks for the comments!  Responses below...   --Mark

At 09:52 PM 7/26/2003 -0400, Ron Bonica wrote:
>Authors,
>
>Two more comments on the draft follow:
>
>1) In Section 3, as you enumerate threat classes, you include "traffic
>pattern analysis". You expand upon the concept of traffic pattern analysis
>in section 3.1.4. I wonder if this shouldn't be identified as a second order
>threat, as its consequences are not so severe as the other threats. Also, it
>is very difficult to protect against.

done.

>2) In Section 3, you identify the following threat source:
>
>- Persons within the organization which is the PPVPN user with respect to a
>particular PPVPN
>
>Does the SP need to protect against threats from this source, as the source
>and target are contained by the same trusted zone?

Good point.  Section 2 of the document places these out of scope.
I'd like to leave that line in for completeness but add a note that such 
threats are out of scope here.

>                           Ron
>                           /individual contributor