Subject: [Nea] Comments on Section 1 - Introduction

From: "Susan Thomson \(sethomso\)" <[email-masked]>
Date: Wed, 20 Jun 2007 16:01:28 -0400

Below are review comments of Section 1 of the -02 reqts I-D.

Thanks
Susan
---------------------

Section 1. Introduction

First para, pg 3:
I suggest removing the first paragraph. I don't believe the content in
this paragraph is necessary, and could be problematic. For example, the
first paragraph can be read to imply that NEA will protect the network
from infected hosts (even though I don't think you intend it this way).

Second para, pg 3: 
Given removal of the first paragraph, the paragraph can be modified as
follows. This is a combination of the current text in the I-D and text
in the charter. 

NEA protocols are used to proactively assess the state of systems
joining or present on the network to determine their status relative to
network compliance policies.  For example, if a system is determined to
be out of compliance because it is lacking proper defensive mechanisms
such as firewalls, anti-virus software or the absence of critical
security patches, the NEA protocols provide a mechanism to detect this
fact and indicate appropriate remediation actions to be taken.  The
intent of NEA is to facilitate corrective actions to address known
vulnerabilities before a host is exposed to potential attack. Note that
an endpoint that is deemed compliant may still be vulnerable to threats
that may exist on the network. The network may thus continue to be
exposed to such threats as well as the range of other threats not
addressed by maintaining endpoint compliance.

Third para, pg 4:
Re the last 2 sentences starting "Some systems may be incapable ...".  I
don't think this document needs to be saying anything about the policies
used for endpoints that do not run the client software. Either say such
endpoints are out of scope of the document, or don't mention them at
all. I prefer the latter.

Fourth para, pg 4:
I would suggest replacing this paragraph with this slightly modified
version from the charter to make the various deployment options clearer.

An organization may make a range of network access policy decisions
based on the
compliance of an endpoint. Supported deployment scenarios include, but
are not
limited to, providing normal access regardless of compliance result
along with any recommendations for remediation ("advisory mode"), as
well as providing restricted access sufficient for remediation purposes
and any essential services until an endpoint is in compliance
("mandatory mode"). Specifying mechanisms for providing restricted
access is outside the scope of the NEA WG.

Fifth para, pg 4:
I think the industry architectures should be omitted. These are not
relevant to this document which needs to stand on its own.

Last para, pg 4:
This paragraph could be made more precise. Something like:

The priority of the NEA working group is to develop standard protocols
that can be used to communicate compliance information between a NEA
client and a NEA  server. This document describes terminology,
applicability, problem statement, reference model, and use cases. It
then identifies requirements for the protocols used to communicate
between a NEA client and NEA server.   

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea