Subject: Re: [OPSEC] charter skeleton rev4 - your thoughts requested...

From: Jeffrey Hutzelman <[email-masked]>
Date: Sun, 06 Jan 2008 08:07:03 -0500

--On Tuesday, December 25, 2007 11:17:37 PM -0800 Joel Jaeggli 
<[email-masked]> wrote:

> The OPSEC WG will document best current practices with regard to network
> security.

That sounds a quite a bit broader than I think is intended.  In particular, 
"with regard to network security" can be read as meaning anything to do 
with security of network devices, traffic, nodes attached to the network, 
applications running over it, users using it, etc.  Perhaps it would be 
better to use a more targeted phrase like "with regard to security of 
network infrastructure" or something.

Just my $0.02.

-- Jeff

_______________________________________________
OPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/opsec

---

From: George M Jones <[email-masked]>
Date: Mon, 07 Jan 2008 06:01:33 -0500

> network infrastructure" or something.

Make that $0.04.

---George Jones

---

From: Joel Jaeggli <[email-masked]>
Date: Mon, 07 Jan 2008 11:33:02 -0800

sorry for the delayed response... I think these are valid points and
that another rev is in order.

I'd also like to address what work we we have to bring immediately under
the character, I have some ideas that currently don't have champions yet.

joelja

---

From: Joel Jaeggli <[email-masked]>
Date: Wed, 09 Jan 2008 14:05:20 -0800

Danny McPherson wrote:

<snip>
>>
>> * protocols, tools and technologies extant at the time of    
>> writing that are used to address the threat,
> 
> Could 'extant' be augmented with envisioned here?  Given the
> 'Scope' section above, 'proposals for new approaches' are
> explicitly within scope.

I think the following bullet addresses the possibility that present
tools are inadequate... provided of course that the bullets are
evaluated on a first match basis... ;)

>> * the possibility that a solution does not exist within existing tools
>> or technologies.

<SNIP>

>> New protocol development or requirements work should be addressed in a
>> working group chartered in the appropriate area or as individual
>> submissions. The OPSEC WG may take on documents related to
>> the practices of using such work.
> 
> I think it's perfectly reasonable (desirable?) for OPSEC to provide
> requirements to other WGs, be it folks like BMWG or folks designing
> protocols.  Perhaps the above text should allude to this.

I think the comments is related to the above one as well. we were
specifically trying to avoid the issue of producing requirements
documents that cause implementors to have go work on new features. That
was a place where documents under the previous charter got bogged down.

While I think the WG should be engaged supporting requirements and
features work done elsewhere I don't think it's there that we should be
forging a new path. (I'm prepared to be wrong on that)...

in my mind for example this might result in something the the bgp ttl
hack implementation be in scope while sBGP implementation might not be
(until you get ot operational considerations)