Subject: 7/16 turn-of-LINK-crank

From: Phil Karn <[email-masked]>
Date: Mon, 16 Jul 2001 23:59:17 -0700

It's up in the usual place

     http://people.qualcomm.com/karn/pilc.txt

We're coming down to the wire, and I've got some other deadlines this
week, so this is going to have to be it except for quickly fixed
typos.

Phil

---

From: Dan Grossman <[email-masked]>
Date: Tue, 17 Jul 2001 12:10:18 -0400

We are still working at cross-purposes here.  

 This assumption is frequently based on an expectation that the
   intranet subnetworks and routers are all physically secured. For
   ^      ^
Please remove this.  The point applies NOT only to intranets, but also (and as 
far as I'm concerned, especially) to the Internet. 
   example, an attack on point-to-point fibers or the public switched
   telephone network usually requires physical access.  Similarly,
   physical access is required to attack an Ethernet contained entirely
   in a single premises.  The assumption is that enough skill,
   determination and personal risk on the part of the attacker is
   required to render the likelihood of an attack to acceptable levels.
               ^
               reduce (given that you changed the end of the sentence)

   But such assumptions are dangerous. The Internet is specifically
   designed to provide a uniform, scalable network service that is
   independent of the underlying subnetwork technologies, physical
   topologies and physical location of its resources. A subnetwork that
   starts small (e.g., within a single office) may be easily secured,
   but small networks have a habit of growing.  And as a subnetwork
   grows, the opportunities for attack grow rapidly.

   There are two reasons for this. First, the risk of an insider attack
   increases with the number of insiders. Second, the "security
   perimeter" between "insiders" and "outsiders" that may have been well
   defined and easily enforced when the network was small invariably
   becomes much harder to define and enforce when the network grows or
   incorporates new technology.
This is a non-sequitir.  While it may be true, this  is supposed to be a set 
of recommendations for link designers, not a tutorial on Intranet security.  
Please remove this paragraph (and preferably the last two sentences of the 
previous paragraph).

   A prime example of new technology invalidating implicit assumptions
   about subnetwork security is the rapid deployment of 802.11 wireless
   LANs [IEEE80211].  802.11 includes a Wire Equivalent Privacy (WEP)
   scheme in which serious flaws were discovered after many wireless
   LANs had been deployed. [BGW]
Please remove this paragraph.  It is a non-sequitir, is redundant with our 
recommendations for properly securing subnets (below) and, in particular, 
tends to undermine our recommendation that subnets be secured.

---

From: Phil Karn <[email-masked]>
Date: Tue, 17 Jul 2001 11:46:32 -0700

>We are still working at cross-purposes here.  

Perhaps we are.

   ^      ^
>far as I'm concerned, especially) to the Internet. 

The assumption *is* primarily applicable to intranets. Anybody who makes
similar assumptions about the public Internet is simply a fool, no matter how
good the subnets may be.

>               reduce (given that you changed the end of the sentence)

Yes, thanks.

>Please remove this paragraph (and preferably the last two sentences of the 

I disagree. I think it quite relevant to the main issue of the relevance of
subnetwork security to protecting user data.

>tends to undermine our recommendation that subnets be secured.

Well, if it undermines our recommendation that subnets be secured,
then maybe it's the *recommendation* that should be removed! That's
been my entire point all along.

Phil