Subject: [OPSEC] I-D Action:draft-ietf-opsec-efforts-13.txt

From: [email-masked]
Date: Thu, 11 Nov 2010 08:30:01 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF.

	Title           : Security Best Practices Efforts and Documents
	Author(s)       : C. Lonvick, D. Spak
	Filename        : draft-ietf-opsec-efforts-13.txt
	Pages           : 35
	Date            : 2010-11-11

This document provides a snapshot of the current efforts to define or
apply security requirements in various Standards Developing
Organizations (SDO).

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-opsec-efforts-13.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: "Natale, Bob" <[email-masked]>
Date: Fri, 12 Nov 2010 01:14:31 -0500

Hi Chris and David,

I wanted to publicize this draft in some other venues, but have some reservations at the moment ... based on an admittedly brief "quality check" of the information in the I-D.

For example, I wanted to review the security management work cited for the DMTF in your document, but both DMTF resources you point us to returned "Page not found" for me (at this time):

	http://www.dmtf.org/about/committees/spamWGCharter.pdf
	http://www.dmtf.org/about/committees/userWGCharter.pdf

I'm guessing that maybe those might be valid URLs but member login might be required to reach them...?

A similar thing happens with the ATIS TMOC pointer, http://www.atis.org/0130/index.asp ... as soon as you get more than one layer deep in trying to track down what they might be doing in security management, you hit a member login roadblock.  

I might be asking for too much, but it seems to me that an IETF OPSEC WG review of relevant security management solutions should secure open access to at least the fundamental OPSEC-related guidance published by the advertised SDOs.  I think your I-D has substantial value, pending availability of the referenced information.

Finally, the work underway in the TM Forum to enrich their Frameworx specifications with cyber-era security management coverage (see http://www.tmforum.org/SecurityManagement/9152/home.html) is missing from your document.  This work is distinguished by the fact that some data models in the network defense domain were contributed by a US Government agency to seed expansion of the TM Forum's Information Framework (formerly known as the SID, Shared Information & Data Model).  It is anticipated that this work will eventually tie in with NIST SCAP support in the Information Framework.

Cheers,
BobN

---

From: Chris Lonvick <[email-masked]>
Date: Tue, 16 Nov 2010 11:16:10 -0800 (PST)

Hi Bob,

Yes - I've let it get out of date.  :-(

I'm planning on spending some time with it over the end-of-year holiday 
season.  I appreciate the pointers you've given and I'll check through the 
rest as well.  Please do send me more pointers to relevent work if you 
have any.

Thanks,
Chris