Subject: [RPSEC] Threats Draft TBD sections

From: Tony Tauber <[email-masked]>
Date: Thu, 14 Aug 2003 16:08:44 -0400 (EDT)

Hi Abbie and others,

It looks like a few sections have "TBD" (To Be Determined) or some
other text indicating they need more definition from the group.
(Perhaps Abbie already has what he feels he needs?)

The sections in question are:

4.5.1.2 Underclaiming
TBD: Need to agree on the title and if it is a threat or not?

4.8 Byzantine Failures
Definition is needed.

It is not clear how to valid that a Byzantine failure has occurred

NOTE: More work is needed

4.9 Discarding of Control Packets
TBD: Not clear from the list the needed text here.

4.10 Network Mapping Threats
TBD

4.11 DoS and DDoS Attacks
TBD: Information to be collected from the list.

What's the sense now for these?  Can we fill in or remove them for the
next revision (which ought to be coming very soon)?

Tony

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Wed, 20 Aug 2003 06:43:10 -0400 (Eastern Daylight Time)

> It looks like a few sections have "TBD" (To Be Determined) or some other
> text indicating they need more definition from the group. (Perhaps Abbie
> already has what he feels he needs?)
>

I'm okay with dropping this section, if it's the feeling of the list that
we should. I think it is a threat, but that it's hard to define, and it's
hard to/impossible to defend against.

> It is not clear how to valid that a Byzantine failure has occurred

Agreed. We should state what a Byzantine failure is, and then point to
other parts of the doc that talk about them in more detail. It might be
better if it's actually a definition, rather than a separate section, as it
is now.

> TBD: Not clear from the list the needed text here.

I'm not certain we should include this?

> 4.10 Network Mapping Threats

I think this could be worth mentioning, but not as a threat source or
attack. It's only a possible precursor to a real attack. In fact, should we
just leave it out of this doc, and let someone come along and follow this
up with some other doc that defines, and explains in more detail, network
mapping, in case someone is interested in doing so? It would help move this
doc along, and since it pretty much falls outside the scope of the doc, it
might be more useful that way.

> TBD: Information to be collected from the list.

I'm not certain we should include these at all, other than as possible
attacks against peering relationships between routers? I'd probably pull
them, myself (?).

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone