Subject: Re: [OPSEC] revised opsec charter working-group last call

From: "Jones, George" <[email-masked]>
Date: Thu, 10 Jul 2008 06:18:01 -0400

Looks. Good.

Only comment/question is on scope.
Do you intend that evey device implementing
IP be in scope (that's how I read this draft)
Or do you think it would be useful 
To try to limit the scope to devices
Providing transit (eg isp/nsp/enterprise 
Core/edge devices) ?  

---george jones

----- Original Message -----
From: [email-masked] <[email-masked]>
To: [email-masked] <[email-masked]>
Sent: Wed Jul 09 23:22:46 2008
Subject: [OPSEC] revised opsec charter working-group last call

Hi all,

The charter of the opsec working group saw some active review some  
time ago, and the result was the text included below.

You'll note that we have deliberately included a near-empty set of  
milestones. It is the opinion of the chairs that a working group with  
a charter such as this is by its very nature open-ended, and that  
assembling a detailed set of waypoints on a journey that is guaranteed
to have no final destination makes no sense. It is entirely possible  
that the IESG will disagree, and that we will have to revisit this;  
however, our ADs are supportive of this approach.

Joel and I would like to request a one week working-group last-call on
this revised charter,

We would very much like to hear active responses from people here  
about the text below, to confirm that we have consensus and not just a
broken list. However, we also encourage people to review previous  
discussions on this list through its archive to avoid re-hashing old  
discussions unnecessarily.

   http://www.ietf.org/mail-archive/web/opsec/current/maillist.html

The last-call will end on Thursday 2008-07-17 0400 UTC.

Thanks,

Joe and Joel

> Goals:
>
> The OPSEC WG will document best current practices with regard to  
> network security. In particular an effort will be made to clarify  
> the rational supporting current operational practice, address gaps  
> in currently understood best practices for forwarding, control  
> plane, and management plane security and make clear the liabilities  
> inherent in security practices where they exist.
>
> Scope:
>
> The scope of the OPSEC WG is intended to include the protection and  
> secure operation of the forwarding, control and management planes.
>
> Documentation of best common practices, revision of existing  
> operational security practices documents and proposals for new  
> approaches to operational challenges are in scope.
>
> Method:
>
> It is expected that the work product of the working group will fall  
> into the category of best current practices documents. Taxonomy or  
> problem statement documents may provide a basis for best current  
> practices documents.
>
> Best Current Practices Document
>
> For each topic addressed, a document will be produced that attempts  
> to capture current practices related to secure operation. This will  
> be primarily based on operational experience. Each entry will list:
>
> * threats addressed,
> * current practices for addressing the threat,
> * protocols, tools and technologies extant at the time of writing  
> that are used to address the threat,
> * the possibility that a solution does not exist within existing  
> tools or technologies.
>
> Taxonomy and Problem Statement Documents
>
> A document which attempts to describe the scope of particular  
> operational security challenge or problem space without necessarily  
> coming to a conclusion or proposing a solution. Such a document  
> might be a precursor to a  best common practices document.
>
> While the principal input of the Working Group are operational  
> experience and needs, the output should be directed both to provide  
> guidance to the operators community as well as to Working Groups  
> that develop protocols or the community of protocol developers at  
> large, as well as to the implementers of these protocols.
>
> Non-Goals:
>
> The Operations security working group is not the place to do new  
> protocols or requirements documents.
>
> New protocol development or requirements work should be addressed in
> a working group chartered in the appropriate area or as individual  
> submissions. The OPSEC WG may take on documents related to the  
> practices of using such work.
>
> Goals and Milestones:
>
> July 2008 Complete charter
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: Joe Abley <[email-masked]>
Date: Thu, 10 Jul 2008 08:25:12 -0400

> Providing transit (eg isp/nsp/enterprise

Speaking with no hat, I see no need to limit the scope to particular  
types of devices.

If someone has work that is of sufficient quality to interest the  
working group such that there is consensus to adopt it as a work item,  
I am not convinced we do anybody any favours by turning them away on  
the grounds that the device in question was not considered important  
back when the charter was written.

There's also the problem of how to characterise different kinds of  
device, which sounds to me like a deep rat-hole.

Joe

---

From: Joel Jaeggli <[email-masked]>
Date: Thu, 10 Jul 2008 09:33:11 -0700

> Providing transit (eg isp/nsp/enterprise

I think that the current scope limitations substantially rules out 
application layer issues on end-systems from being in scope for this 
working group...

A document like the icmp filtering document obviously has some relevance 
to end systems so a blanket statement that end-systems are out of scope 
is I think not so desirable.

> ------------------------------------------------------------------------
>

---

From: "Smith, Donald" <[email-masked]>
Date: Thu, 10 Jul 2008 12:13:09 -0600

Security through obscurity WORKS against some worms and ssh attacks:)
[email-masked] giac 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Joel Jaeggli
> Sent: Thursday, July 10, 2008 10:33 AM
> To: Jones, George
> Cc: [email-masked]
> Subject: Re: [OPSEC] revised opsec charter working-group last call
> 
> Jones, George wrote:
> > Looks. Good.
> > 

Routers or network elements as end-systems should certainly be included.
So a router with any service enabled (ssh, telnet, ntp, etc...) acts as
an end-system in my mind.

> >  > July 2008 Complete charter

This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly 
prohibited and may be unlawful.  If you have received this communication 
in error, please immediately notify the sender by reply e-mail and destroy 
all copies of the communication and any attachments.
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec