Subject: [OPSEC] revised opsec charter working-group last call

From: Joe Abley <[email-masked]>
Date: Wed, 9 Jul 2008 23:22:46 -0400

Hi all,

The charter of the opsec working group saw some active review some  
time ago, and the result was the text included below.

You'll note that we have deliberately included a near-empty set of  
milestones. It is the opinion of the chairs that a working group with  
a charter such as this is by its very nature open-ended, and that  
assembling a detailed set of waypoints on a journey that is guaranteed  
to have no final destination makes no sense. It is entirely possible  
that the IESG will disagree, and that we will have to revisit this;  
however, our ADs are supportive of this approach.

Joel and I would like to request a one week working-group last-call on  
this revised charter,

We would very much like to hear active responses from people here  
about the text below, to confirm that we have consensus and not just a  
broken list. However, we also encourage people to review previous  
discussions on this list through its archive to avoid re-hashing old  
discussions unnecessarily.

   http://www.ietf.org/mail-archive/web/opsec/current/maillist.html

The last-call will end on Thursday 2008-07-17 0400 UTC.

Thanks,

Joe and Joel

> Goals:
>
> The OPSEC WG will document best current practices with regard to  
> network security. In particular an effort will be made to clarify  
> the rational supporting current operational practice, address gaps  
> in currently understood best practices for forwarding, control  
> plane, and management plane security and make clear the liabilities  
> inherent in security practices where they exist.
>
> Scope:
>
> The scope of the OPSEC WG is intended to include the protection and  
> secure operation of the forwarding, control and management planes.
>
> Documentation of best common practices, revision of existing  
> operational security practices documents and proposals for new  
> approaches to operational challenges are in scope.
>
> Method:
>
> It is expected that the work product of the working group will fall  
> into the category of best current practices documents. Taxonomy or  
> problem statement documents may provide a basis for best current  
> practices documents.
>
> Best Current Practices Document
>
> For each topic addressed, a document will be produced that attempts  
> to capture current practices related to secure operation. This will  
> be primarily based on operational experience. Each entry will list:
>
> * threats addressed,
> * current practices for addressing the threat,
> * protocols, tools and technologies extant at the time of writing  
> that are used to address the threat,
> * the possibility that a solution does not exist within existing  
> tools or technologies.
>
> Taxonomy and Problem Statement Documents
>
> A document which attempts to describe the scope of particular  
> operational security challenge or problem space without necessarily  
> coming to a conclusion or proposing a solution. Such a document  
> might be a precursor to a  best common practices document.
>
> While the principal input of the Working Group are operational  
> experience and needs, the output should be directed both to provide  
> guidance to the operators community as well as to Working Groups  
> that develop protocols or the community of protocol developers at  
> large, as well as to the implementers of these protocols.
>
> Non-Goals:
>
> The Operations security working group is not the place to do new  
> protocols or requirements documents.
>
> New protocol development or requirements work should be addressed in  
> a working group chartered in the appropriate area or as individual  
> submissions. The OPSEC WG may take on documents related to the  
> practices of using such work.
>
> Goals and Milestones:
>
> July 2008 Complete charter
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: "David Harrington" <[email-masked]>
Date: Thu, 10 Jul 2008 12:32:37 -0400

Hi,

I don't believe much in charters with no deliverables. I think ther WG
should decide there is something specific to work on and set a
deadline to complete it.

There was a draft BCP on logging and another on filtering. Is there a
reason you do not have those listed as deliverables/milestones? They
have already been started; why not plan to finish the work?

Just so you know, I tried to look at the archive to see if this had
been discussed. I cannot find the archives. The link from
http://tools.ietf.org/wg/opsec/ doesn't work. The link in the charter
munges two links together.

David Harrington
[email-masked]
[email-masked]
[email-masked]

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Joe Abley
> Sent: Wednesday, July 09, 2008 11:23 PM
> To: [email-masked]
> Subject: [OPSEC] revised opsec charter working-group last call
> 
> Hi all,
>

---

From: Joe Abley <[email-masked]>
Date: Thu, 10 Jul 2008 15:28:11 -0400

> have already been started; why not plan to finish the work?

It is not clear to me that there is enthusiasm to complete existing  
documents, in all cases. Ensuring that there is available energy in  
the author and reviewer roles for documents to proceed in a timely  
fashion seems prudent before they are memorialised in the charter.  
That would seem to imply either proceeding with a charter which lists  
minimal deliverables (as posted), or delaying introduction of a new  
charter until the status and ambitions of all work items can be  
established. The latter approach seems to risk conflict between  
chickens and eggs.

I am certainly not arguing against the idea of laying out our project  
plan on a rolling basis for the next three or four meetings. However,  
it seems to me that we ought to be able to agree on the meat of the  
charter first as a basis for building that plan.

> munges two links together.

A small amount of cut-and-paste might be needed, or you could just use  

>>   http://www.ietf.org/mail-archive/web/opsec/current/maillist.html

Joe

---

From: Joe Abley <[email-masked]>
Date: Mon, 21 Jul 2008 12:10:38 -0400

On 21 Jul 2008, at 12:05, Joe Abley wrote:

> The new charter will now be sent to the IESG. I plan to include a  
> note which will explain briefly our thinking with regard to the near- 
> empty g'n'm section.

Oops, process clarification -- it will, in fact, now be sent to our  
ADs according to the process documented in RFC 2418.

Joe

---

From: Joe Abley <[email-masked]>
Date: Mon, 21 Jul 2008 12:05:51 -0400

Hi again,

This (below) last-call for the revised opsec charter ended a few days  
ago.

Joel and I have discussed the list traffic that resulted, and have  
reviewed the earlier discussion from which the charter text below  
emerged. We are prepared to declare that we observe consensus on this  
text.

The new charter will now be sent to the IESG. I plan to include a note  
which will explain briefly our thinking with regard to the near-empty  
g'n'm section.

Many thanks for your consideration.

Joe

On 9 Jul 2008, at 23:22, Joe Abley wrote:

> milestones. It is the opinion of the chairs that a working group  
> with a charter such as this is by its very nature open-ended, and  
> that assembling a detailed set of waypoints on a journey that is  
> guaranteed to have no final destination makes no sense. It is  
> entirely possible that the IESG will disagree, and that we will have  
> to revisit this; however, our ADs are supportive of this approach.
>
> Joel and I would like to request a one week working-group last-call  
> on this revised charter,
>
> about the text below, to confirm that we have consensus and not just  
> a broken list. However, we also encourage people to review previous  
>> New protocol development or requirements work should be addressed  
>> in a working group chartered in the appropriate area or as  
>> individual submissions. The OPSEC WG may take on documents related  
>> to the practices of using such work.
>>
>> Goals and Milestones:
>>