Subject: RE: policy enforcement points and management [RE: Last Call: 'NAT Behavioral Requirements for Unicast UDP' to BCP (draft-ietf-behave-nat-udp)]

From: "Romascanu, Dan \(Dan\)" <[email-masked]>
Date: Tue, 16 May 2006 10:15:04 +0300

> -----Original Message-----
> From: Pekka Savola [mailto:[email-masked]] 
> Sent: Tuesday, May 16, 2006 8:04 AM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]; Keith Moore; [email-masked]; 
> [email-masked]; Jeffrey Hutzelman
> Subject: policy enforcement points and management [RE: Last 
> Call: 'NAT Behavioral Requirements for Unicast UDP' to BCP 
> (draft-ietf-behave-nat-udp)]
> 
> On Mon, 15 May 2006, Hallam-Baker, Phillip wrote:
> >> From: Jeffrey Hutzelman [mailto:[email-masked]]
> >
> >> Sure.  But a policy enforcement point must necessarily be 
> configured; 
> >> otherwise, how is it going to know what policy to enforce?
> >
> > The policy can be generated automatically from the network 
> > configuration and the authorized hosts and applications 
> authorized to 
> > run on those hosts.
> ...
> 
> I think the discussion about policy enforcement points and 
> their management is out of scope for this work.
> 
> On the other hand, there is a proposed WG (they had a BoF at the last
> IETF) -- NEA (Network End-point Assessment) which aims to do 
> something about this space.
> 
> I'd recommend folks interested in it go take a look:
> 
>    http://www1.ietf.org/mailman/listinfo/nea
> 
> -- 
> Pekka Savola                 "You each name yourselves king, yet the
> Netcore Oy                    kingdom bleeds."
> Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
> 
> 

Is not NEA dealing with a different set of problems mainly related
assessing the hardware or software configuration of an endpoint as it
pertains to an organization's security policy for access control
purposes - called 'posture' in the NEA language? I am not sure how this
would apply. 

Dan

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 16 May 2006 06:54:32 -0700

>    http://www1.ietf.org/mailman/listinfo/nea

Perhaps this is the solution. But we seem to be constantly working as if we were a confederation of independent watchmakers independently producing designs for cogs and springs with nobody proposing a way to put them together.

This is what one might imagine the IAB would be doing. In practice the IAB appears to be deliberately constituted to make any attempt to claim such a role impossible. For any group to make a claim to providing an overarching architectural framework it must have the active support and engagement of the working groups.