Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m ib-15.txt

From: "Sharon Chisholm" <[email-masked]>
Date: Tue, 11 Nov 2003 13:44:34 -0500

Hi

The following is the proposed resolution to 75-2.  Assuming no objection,
this item will be considered closed conditional on the proposed edit being
done.

Add the following text to the security considerations section.

" Setting these objects may have disruptive effects on network
  operation by the flooding of unwanted alarm notifications 
  from the network. It is possible to define multiple alarm that
  are triggered from the same frequently occurring internal stimulus and
  uses the alarmActiveState notification to inform interested managers.
  Since it is not possible to delete alarm models when it has active alarms,
  and the defined alarm throttling mechanism is limited to a single alarm,
  this could result in a continuous stream alarm notifications that there
  is no mechanism defined within this memo to control."

Sharon

-----Original Message-----
From: Chisholm, Sharon [CAR:0S00:EXCH] 
Sent: Wednesday, October 08, 2003 4:09 PM
To: Disman (E-mail)
Cc: Randy Presuhn
Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m
ib-15.txt

Hi

While I understand how the ARC MIB could be used to cause the problems that
the IESG was concerned with, I don't really see where the Alarm MIB poses
any more risk than 'normal' notifications. Ok. Let me put on my imagination
hat: if a manager somehow sets up 323432 alarm models that alarm on the same
internal stimulus and use the Alarm MIB notifications and then makes that
internal stimulus happen, then 323432 notifications will get sent out on the
wire. Is this what we are trying to warn people against? 

Sharon

-----Original Message-----
From: Randy Presuhn [mailto:[email-masked]] 
Sent: Wednesday, October 08, 2003 3:58 PM
To: Disman (E-mail)
Subject: Re: [Disman] Security considerations in
draft-ietf-disman-alarm-mib-15.txt

Hi -

> From: "Sharon Chisholm" <[email-masked]>
> To: "Disman (E-mail)" <[email-masked]>
> Cc: "Randy Presuhn" <[email-masked]>
> Sent: Wednesday, October 08, 2003 12:48 PM
> Subject: RE: [Disman] Security considerations in
> draft-ietf-disman-alarm-mib-15.txt
..
> The following is the proposed resolution to Randy-75-2. Assuming no
> objection, this item will is closed with no changes to the draft.

I object, both as WG chair and as a technical contributor.

> Assuming you referring to the following text:
>
> "  Setting these objects may have disruptive effects on network
>    operation that range from omission of alarm notifications to
>    flooding of unwanted alarm notifications from the network.
>    The consequence of suppressing or deferring the reporting
>    of an alarm can prevent the timely delivery of important
>    diagnostic information, including information that can help
>    identify an attack."
>
> This is not relevant in the case of the Alarm MIB since we neither
> suppress or defer notifications. We have text about throttling in the 
> 'normal' places within the draft.

Technically:
Even with the throttling language that's there, this MIB can be used to
cause flooding, either due to an exessive number of resources going into
alarm (throttling is in part per resource type), oscillating (throttling is
on consecutive notifications), or distributed DoS (multiple systems
configured).

As Chair:
Given the IESG's comments on the ARC MIB, which show that they are well
aware of these issues, I believe we need to reconsider.

Randy

---

From: "Sharon Chisholm" <[email-masked]>
Date: Tue, 11 Nov 2003 13:44:34 -0500

Hi

Sharon

-----Original Message-----
From: Chisholm, Sharon [CAR:0S00:EXCH] 
Sent: Wednesday, October 08, 2003 4:09 PM
To: Disman (E-mail)
Cc: Randy Presuhn
Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m
ib-15.txt

Hi

Sharon

-----Original Message-----
From: Randy Presuhn [mailto:[email-masked]] 
Sent: Wednesday, October 08, 2003 3:58 PM
To: Disman (E-mail)
Subject: Re: [Disman] Security considerations in

Hi -

..

Technically:

As Chair:

Randy

---

From: Randy Presuhn <[email-masked]>
Date: Wed, 12 Nov 2003 09:25:37 -0600 (GMT-06:00)

Hi -

Though I'd prefer to permit deletion of an alarm model (causing deletion
of any corresponding alarms), this text would be ok with the original
approach.  A couple of typos:
  "multiple alarm" -> "multiple alarms"
  "uses the alarmActiveState" -> "use the alarmActiveState"
  "models when it has" -> "models when they have"

Randy

-----Original Message-----
From: Sharon Chisholm <[email-masked]>
Sent: Nov 11, 2003 12:44 PM
To: "Disman (E-mail)" <[email-masked]>
Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m	 ib-15.txt

Hi

Sharon

-----Original Message-----
From: Chisholm, Sharon [CAR:0S00:EXCH] 
Sent: Wednesday, October 08, 2003 4:09 PM
To: Disman (E-mail)
Cc: Randy Presuhn
Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m
ib-15.txt

Hi

Sharon

-----Original Message-----
From: Randy Presuhn [mailto:[email-masked]] 
Sent: Wednesday, October 08, 2003 3:58 PM
To: Disman (E-mail)
Subject: Re: [Disman] Security considerations in

Hi -

..

Technically:

As Chair:

Randy

---

From: Randy Presuhn <[email-masked]>
Date: Wed, 12 Nov 2003 09:25:37 -0600 (GMT-06:00)

Hi -

Randy

-----Original Message-----
From: Sharon Chisholm <[email-masked]>
Sent: Nov 11, 2003 12:44 PM
To: "Disman (E-mail)" <[email-masked]>
Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m	 ib-15.txt

Hi

Sharon

-----Original Message-----
From: Chisholm, Sharon [CAR:0S00:EXCH] 
Sent: Wednesday, October 08, 2003 4:09 PM
To: Disman (E-mail)
Cc: Randy Presuhn
Subject: RE: [Disman] Security considerations in draft-ietf-disman-alarm-m
ib-15.txt

Hi

Sharon

-----Original Message-----
From: Randy Presuhn [mailto:[email-masked]] 
Sent: Wednesday, October 08, 2003 3:58 PM
To: Disman (E-mail)
Subject: Re: [Disman] Security considerations in

Hi -

..

Technically:

As Chair:

Randy