Subject: [Nea] Comments on Section 8,9: Security/Privacy Considerations

From: "Susan Thomson \(sethomso\)" <[email-masked]>
Date: Wed, 20 Jun 2007 16:49:28 -0400

Section 8. Security Considerations
General comment: I think there needs to be a clear and explicit
statement upfront of what NEA does and what it does not do in terms of
security. This was an important point made in the charter discussions.
For example, something along the lines of the following: "the intent of
NEA is to facilitate corrective actions before a host is exposed to
potential attack. Endpoints that are deemed compliant may still be
vulnerable to threats. Hence, the network may still be exposed to such
threats as well as any others not addressed by maintaining endpoint
compliance".

Section 8.1 Trust

1st para, 2nd sentence p37: Suggest rewording to:
"Therefore, there is an implied distrusting of endpoints until there is
reason to believe (based on posture information) that they are
*protected from threats addressed by the compliance policy*."

Section 8.1.2 Network Communications

3rd para beginning "Second", p39: 
omit "given to them by the NEA Server" since the role of NEA server as
defined in this document is not as a network authorization server.
Replace with 'when NEA is being deployed in a mode such that an endpoint
has restricted access until the endpoint is deemed to be in compliance.'
or some such.

4th para beginning "Third", p39: 
Suggest removing the example in this paragraph. I think the paragraph is
clear on its own and the draft up till this point has not mentioned
protocol choices so this appears to come out of the blue. 

Section 8.1.3 NEA Server Components

General comment: I would avoid the use of the term "enforce" in the
context of the NEA server since it is often used within the context of
network access control. While the NEA server may provide input into a
network authorization decision, the NEA server itself is not defined in
this draft to be a network authorization server.

1st sentence, 1st para, p40: Use word "apply" instead of "enforce".

2nd para, p 40: Omit "or enforcements".

3rd para, p40: Omit this paragraph since not in scope.

Section 8.2 Protection Mechanisms at Multiple Layer

3rd para, p41: "enforcing" -> "providing"

Section 9: Privacy Considerations

3rd para: The overall point here is valid. However, it would be good to
generalize this text and the term "owner" a bit to be cognizant of the
fact that corporate assets are not necessarily purchased and owned -
they could be leased, for example. Also, assets are not necessarily
managed by enterprise itself, but could be an organization they hire to
do so. Using the term "managed" may be better than "owned".
    
Section 9.2: Is the intent that this subsection be updated based on
discussions at the last IETF? It is not clear to me we need this
section. I don't think this draft needs to get into how the privacy
policy is distributed.

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "todd glassey" <[email-masked]>
Date: Wed, 20 Jun 2007 13:57:25 -0700

----- Original Message ----- 
From: "Susan Thomson (sethomso)" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, June 20, 2007 1:49 PM
Subject: [Nea] Comments on Section 8,9: Security/Privacy Considerations

security.

TSG: AMEN!

This was an important point made in the charter discussions.
For example, something along the lines of the following: "the intent of
NEA is to facilitate corrective actions before a host is exposed to
potential attack.

TSG: WHAT LEVELS OF ATTACK - i.e. before DHCP assigns an address for it 
or? - see what I mean? there needs to be a statement of where NEA starts to 
be effective in its standards docs.

Endpoints that are deemed compliant may still be
vulnerable to threats. Hence, the network may still be exposed to such
threats as well as any others not addressed by maintaining endpoint
compliance".

Section 8.1 Trust

TSG: If you are enumerating COMPLIANCE POLICY - this has new meaning for 
many organizations and so it needs to be properly framed.