Subject: Re: [OPSEC] revised opsec charter working-group last call

From: "Jones, George" <[email-masked]>
Date: Fri, 11 Jul 2008 09:29:01 -0400

Ok

Just as long as your making a conscious
Decision to be that broas in scope.

With earlier work I found it useful 
To tightly limit scope as an aid to
Keeping documents from expanding
Infinitly every time someone 
Brought up something new

----- Original Message -----
From: Joel Jaeggli <[email-masked]>
To: Jones, George
Cc: [email-masked] <[email-masked]>; [email-masked]
<[email-masked]>
Sent: Thu Jul 10 12:33:11 2008
Subject: Re: [OPSEC] revised opsec charter working-group last call

Jones, George wrote:
> Looks. Good.
> 
> Only comment/question is on scope.
> Do you intend that evey device implementing
> IP be in scope (that's how I read this draft)
> Or do you think it would be useful
> To try to limit the scope to devices
> Providing transit (eg isp/nsp/enterprise
> Core/edge devices) ? 

I think that the current scope limitations substantially rules out 
application layer issues on end-systems from being in scope for this 
working group...

A document like the icmp filtering document obviously has some
relevance 
to end systems so a blanket statement that end-systems are out of scope
is I think not so desirable.

> ---george jones
> 
> ----- Original Message -----
> From: [email-masked] <[email-masked]>
> To: [email-masked] <[email-masked]>
> Sent: Wed Jul 09 23:22:46 2008
> Subject: [OPSEC] revised opsec charter working-group last call
> 
> Hi all,
> 
> The charter of the opsec working group saw some active review some 
> time ago, and the result was the text included below.
> 
> You'll note that we have deliberately included a near-empty set of 
> milestones. It is the opinion of the chairs that a working group with
> a charter such as this is by its very nature open-ended, and that 
> assembling a detailed set of waypoints on a journey that is
guaranteed 
> to have no final destination makes no sense. It is entirely possible 
> that the IESG will disagree, and that we will have to revisit this; 
> however, our ADs are supportive of this approach.
> 
> Joel and I would like to request a one week working-group last-call
on 
> this revised charter,
> 
> We would very much like to hear active responses from people here 
> about the text below, to confirm that we have consensus and not just
a 
> broken list. However, we also encourage people to review previous 
> discussions on this list through its archive to avoid re-hashing old 
> discussions unnecessarily.
> 
>    http://www.ietf.org/mail-archive/web/opsec/current/maillist.html
> 
> The last-call will end on Thursday 2008-07-17 0400 UTC.
> 
> Thanks,
> 
> 
> Joe and Joel
> 
>  > Goals:
>  >
>  > The OPSEC WG will document best current practices with regard to 
>  > network security. In particular an effort will be made to clarify 
>  > the rational supporting current operational practice, address gaps
>  > in currently understood best practices for forwarding, control 
>  > plane, and management plane security and make clear the
liabilities 
>  > inherent in security practices where they exist.
>  >
>  > Scope:
>  >
>  > The scope of the OPSEC WG is intended to include the protection
and 
>  > secure operation of the forwarding, control and management planes.
>  >
>  > Documentation of best common practices, revision of existing 
>  > operational security practices documents and proposals for new 
>  > approaches to operational challenges are in scope.
>  >
>  > Method:
>  >
>  > It is expected that the work product of the working group will
fall 
>  > into the category of best current practices documents. Taxonomy or
>  > problem statement documents may provide a basis for best current 
>  > practices documents.
>  >
>  > Best Current Practices Document
>  >
>  > For each topic addressed, a document will be produced that
attempts 
>  > to capture current practices related to secure operation. This
will 
>  > be primarily based on operational experience. Each entry will
list:
>  >
>  > * threats addressed,
>  > * current practices for addressing the threat,
>  > * protocols, tools and technologies extant at the time of writing 
>  > that are used to address the threat,
>  > * the possibility that a solution does not exist within existing 
>  > tools or technologies.
>  >
>  > Taxonomy and Problem Statement Documents
>  >
>  > A document which attempts to describe the scope of particular 
>  > operational security challenge or problem space without
necessarily 
>  > coming to a conclusion or proposing a solution. Such a document 
>  > might be a precursor to a  best common practices document.
>  >
>  > While the principal input of the Working Group are operational 
>  > experience and needs, the output should be directed both to
provide 
>  > guidance to the operators community as well as to Working Groups 
>  > that develop protocols or the community of protocol developers at 
>  > large, as well as to the implementers of these protocols.
>  >
>  > Non-Goals:
>  >
>  > The Operations security working group is not the place to do new 
>  > protocols or requirements documents.
>  >
>  > New protocol development or requirements work should be addressed
in 
>  > a working group chartered in the appropriate area or as individual
>  > submissions. The OPSEC WG may take on documents related to the 
>  > practices of using such work.
>  >
>  > Goals and Milestones:
>  >
>  > July 2008 Complete charter
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
> 
> 
>
-----------------------------------------------------------------------
-
> 
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: Warren Kumari <[email-masked]>
Date: Fri, 11 Jul 2008 09:24:09 -0700

I hereby move that
Future OpSec Working Group docs
All be in Haiku form.

;-)
W

On Jul 11, 2008, at 6:29 AM, Jones, George wrote:

> Cc: [email-masked] <[email-masked]>; [email-masked] <[email-masked] 
> >
> > Joel and I would like to request a one week working-group last- 
> call on
> > this revised charter,
> >
> > about the text below, to confirm that we have consensus and not  
> just a
> >  > New protocol development or requirements work should be  
> addressed in
> ------------------------------------------------------------------------
> >