Subject: [Netconf] Consensus: A, B, C, D, E, F Security Considerations

From: "Sharon Chisholm" <[email-masked]>
Date: Mon, 26 May 2008 09:17:46 -0400

Hi

There were a large number of choices provided to replace that paragraph
in the security considerations section. They all seemed to agree that
authorization models were out of scope of the document so we should be
careful what we said and that they should only talk about the contents
of the notification, not the other operations (although there was some
disagreement on the relationship of notification authorization model to
that used for all other content, this is beyond the scope of this
discussion). They seemed to differ then mainly on the strength of the
language and how detailed things got.

--
I think we agreed on these two sentences:

- The contents of notifications as well as the names of event streams
may contain sensitive information and care should be taken to ensure
that they are viewed only by authorized users. 

- If a user is not authorized to view all elements in the content of the
notification, the notification is not sent to that user.

It wasn't clear there was agreement to add this one:

- It is an administrative policy decision to determine who (or what) is
authorized to have access to the information contained in notifications.

---

I went back and reread the DISCUSS comment and I think this still
clarifies the information they wanted clarified.

I propose then that we replace the appropriate text in the security
section with the two sentences identified above. I'll send out a draft
update so people will be able to read the text in coFrom [email-masked]  Mon May 26 06:17:56 2008
Content-class: urn:content-classes:message
Date: Mon, 26 May 2008 09:17:46 -0400
From: "Sharon Chisholm" <[email-masked]>
To: <[email-masked]>
Subject: [Netconf] Consensus: A, B, C, D, E, F Security Considerations
Sender: [email-masked]

Hi

There were a large number of choices provided to replace that paragraph
in the security considerations section. They all seemed to agree that
authorization models were out of scope of the document so we should be
careful what we said and that they should only talk about the contents
of the notification, not the other operations (although there was some
disagreement on the relationship of notification authorization model to
that used for all other content, this is beyond the scope of this
discussion). They seemed to differ then mainly on the strength of the
language and how detailed things got.

--
I think we agreed on these two sentences:

- The contents of notifications as well as the names of event streams
may contain sensitive information and care should be taken to ensure
that they are viewed only by authorized users. 

- If a user is not authorized to view all elements in the content of the
notification, the notification is not sent to that user.

It wasn't clear there was agreement to add this one:

- It is an administrative policy decision to determine who (or what) is
authorized to have access to the information contained in notifications.

---

I went back and reread the DISCUSS comment and I think this still
clarifies the information they wanted clarified.

I propose then that we replace the appropriate text in the security
section with the two sentences identified above. I'll send out a draft
update so people will be able to read the text in context.ntext.

----------
Old Text

The contents of notifications as well as the name of event streams may
contain sensitive information and care should be taken to ensure that it
is viewed only by authorized users.  If a user does not have permission
to view content via other NETCONF operations, she must not have access
to that content via Notifications.  If a user is not permitted to view
one element in the content of the  notification, the notification is not
sent to that user.

-------

New Text

The contents of notifications as well as the names of event streams may
contain sensitive information and care should be taken to ensure that
they are viewed only by authorized users. If a user is not authorized to
view all elements in the content of the notification, the notification
is not sent to that user.

Sharon Chisholm
Nortel 
Ottawa, Ontario
Canada
_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf

----------
Old Text

The contents of notifications as well as the name of event streams may
contain sensitive information and care should be taken to ensure that it
is viewed only by authorized users.  If a user does not have permission
to view content via other NETCONF operations, she must not have access
to that content via Notifications.  If a user is not permitted to view
one element in the content of the  notification, the notification is not
sent to that user.

-------

New Text

The contents of notifications as well as the names of event streams may
contain sensitive information and care should be taken to ensure that
they are viewed only by authorized users. If a user is not authorized to
view all elements in the content of the notification, the notification
is not sent to that user.

Sharon Chisholm
Nortel 
Ottawa, Ontario
Canada
_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf