Subject: [OPSEC] charter skeleton rev3 - your thoughts requested?

From: Joel Jaeggli <[email-masked]>
Date: Tue, 18 Dec 2007 16:42:59 -0800

Folks,

I thought I would share our thoughts thus far on what a new charter
might look like... feedback would be highly useful at this point.

Moreover I think we need to be thinking about what work will be accepted
under this charter, and are there any lose ends that need to be tied off
or finished.

Also I thought i would take advantage of the newly minted ietf mailing list.

joel

---

Goals:

The opsec working group will focus on work which will address relevant
issues facing the network operator community today. In particular an
effort will be made to clarify the reasons behind current operational
practice, address gaps in currently understood best practices for
forwarding, control plane, and management security and make clear the
liabilities inherent in security practices where they exist.

Scope:

The scope of the operations security working is intended to include the
protection and secure operation of The Forwarding, Control and
Management planes in internet networks.

Documentation of accepted wisdom, revision of existing practices
documents and proposals for new approaches to operational challenges are
in scope.

Method:

It is expected that most of the work product of the working group will
fall into the category of current practices documents. Taxonomy or
problem statement documents may provide a basis for current practices
documents.

Current Practices Document

A single document will be produced that attempts to capture
current practices related to secure operation. This will be
primarily based on operational experience. Each entry will
list:

* threats addressed,

* current practices for addressing the threat,

* protocols, tools and technologies extant at the time of 	
writing that are used to address the threat,

* the possibility that a solution does not exist within existing tools
or technologies.

Taxonomy and Problem Statement Documents

A document which attempts to describe the scope of particular
operational security challenge or problem space without necessarily
coming to a conclusion or proposing a solution. Such a document might be
a precursor to a common practices document.

The work product of the working group is intended principally for the
benefit of network operators rather than vendors.  It should be noted
that this represents a substantial break with the original charter.

Non-Goals:

The Operations security working group is not the place to do new
protocol elements or functionality requirements documents.

It is presumed that the appropriate place for vendor requirements is in
the form of an RFP; a document which is necessarily informed by
operational exegiences (and the documents that describe them) but is at
the discretion of the operator creating such a request.

New protocol development or requirements work should be addressed in a
working group chartered in the appropriate area or as individual
submissions. The opsec working group may take on documents related to
the practices of using such work.

_______________________________________________
OPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/opsec

---

From: Ron Bonica <[email-masked]>
Date: Wed, 19 Dec 2007 12:11:38 -0500

Comments inline....

Joel Jaeggli wrote:
> issues facing the network operator community today. 

s/The opsec working group will focus on work which will address relevant
issues facing the network operator community today / The OPSEC WG will
document best current practices with regard to network security. /

In particular an
> Management planes in internet networks.

s/The Forwarding, Control and Management planes in internet networks/the
forwarding, control and management planes./
> documents and proposals for new approaches to operational challenges are
s/accepted wisdom/best common practices/

---

From: "Tom Petch" <[email-masked]>
Date: Fri, 21 Dec 2007 11:16:35 +0100

----- Original Message -----
From: "Joel Jaeggli" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, December 19, 2007 1:42 AM
Subject: [OPSEC] charter skeleton rev3 - your thoughts requested?

> forwarding, control plane, and management security

/forwarding, control plane, and management security/the security of the
forwarding, control and management planes/

'management security' sounds a bit like a bunch of heavies surrounding the CEO.

Tom Petch
<snip>

---

From: George Jones <[email-masked]>
Date: Sat, 22 Dec 2007 08:10:29 -0500

> issues facing the network operator community today.

I think this is good.

Some thought should be given to defining "network operator community".
Does that mean people who do transport ?   ISPs ?  Large Enterprise ?
stub-sites ?  SOHO ?  Are "hosts" out of scope ?

> liabilities inherent in security practices where they exist.

See above.
> fall into the category of current practices documents.
Best Current Practice (http://www.ietf.org/rfc/rfc2026.txt)

> Taxonomy or

Good.
> that this represents a substantial break with the original charter.
Two comments here.   The last sentence, while true, probably
does not belong in the new charter.     Second,  if your target
is operators, you'll need to get them involved.   That, in my
view, was the biggest problem OPSEC faced.   They didn't
see the benefit, didn't contribute, could not be pulled away
from fighting the fires....you need to find a way to convince
them that participation is worth the time.
> protocol elements or functionality requirements documents.

Good.

s/protocol elements/protocols/
s/functionality//

> the practices of using such work.
While this is true, I think the charter can do without it.

---George Jones

---

From: George Jones <[email-masked]>
Date: Sat, 22 Dec 2007 06:15:19 -0500

I think this is good.

See above.

Good.

Good.

---George Jones