Subject: Re: [OPSEC] draft minutes for opsec meeting today

From: Joe Abley <[email-masked]>
Date: Thu, 31 Jul 2008 13:46:43 +0100

On 30 Jul 2008, at 18:43, Fernando Gont wrote:

> At 02:32 p.m. 30/07/2008, Joe Abley wrote:
>
>> Please see attached. Please send comments/corrections to the list, or
>> to me directly.
>
> In a number of places the minutes say "Draft-gony-opsec-icmp- 
> filtering" instead of "Draft-gont-opsec-icmp-filtering" (that is, my  
> surname is "gont", and not "gony").

Fixed, thanks and sorry :-)

Joe

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: Joe Abley <[email-masked]>
Date: Thu, 31 Jul 2008 13:48:47 +0100

On 30 Jul 2008, at 18:32, Joe Abley wrote:

> Please see attached. Please send comments/corrections to the list,  
> or to me directly.

Second cut attached.

Joe

---

From: Joel Jaeggli <[email-masked]>
Date: Mon, 04 Aug 2008 08:23:54 -0700

minor changes attached.

joelja

Joe Abley wrote:
> ------------------------------------------------------------------------
> 
> 
> 
> 
> ------------------------------------------------------------------------
> 

Minutes of the OPSEC meeting
IETF 72, Dublin, Ireland
2008-07-30 1510 UTC+1

Note-taker: jabley
Jabber proxy: jabley (no jabber scribe)

The meeting opened at 1518 UTC+1.

1. Joel Jaeggli, OPSEC WG

Joel Jaeggli presented on the working group rechartering and document
status. There is fatigue on existing milestones, and abandonment
with recharter is a more pragmatic way forward than closing the
working group and chartering a new one.  

The new charter has passed working group last call and has been sent
to the IESG.

Milestones on the new charter are a bit thin. We want to keep the working
group around to bring problems from the network operations space into.

Ron Bonica: charter has changed -- no longer to do with requirements for
  vendors, now to do with BCP for operators. Old documents should be allowed
  to wither on the vine.

Joel: An alternative might be to fold this work into OPSAWG.

Dan Romanescu: conscious decision to keep opsec separate from opsawg in
  order to separate and maintain focus on the security aspects

There are two new potential work items from Warren Kumari on blackhole
communities.

Danny Mcpherson: comment on warren's blackhole draft; many isps use
  different communities for different kinds of blackholes, different
  places to drop packets, etc

draft-gont-opsec-icmp-filtering is a draft which has seen positive discussion
on the mailing list.

Mohacsi Janos: similar draft for v6 icmp fltering, around rfc 4890.
  I think the author should consider looking at this draft.

Joel: reconciling the two is desirable

There was a strong hum for adopting draft-gont-opsec-icmp-filtering
as a working group document. There was no hum in dissent. The author
was encouraged to resubmit the draft as an opsec working group
document.

2. SAVI Overview, Christian Vogt

Christian Vogt provided an overview of the problem space and approach
for work starting in the SAVI working group. There was no discussion
from the floor.

3. draft-savola-rtgwg-backbone-attacks-03, Pekka Savola

Pekka Savola provided a brief history of this draft.

Merike Kaeo: totally support this work, and think it would be perfect
  as an informational document

Joel Jaeggli: no hat, read this document the first time around, a
  little while ago, think it is a really useful document, some
  freshening required, but appropriate under our new charter

Christian Vogt: if not in opsec, where else?

Pekka: if not in opsec, probably not in IETF

Christian: I support it to be published in this group

Ron Bonica: thumbs up

Joel: will need to seek consensus on list

Lucy Lynch: I have read it a while ago, read it again this this
  morning, some of this is a moving target; may require regular
  refreshment

Joel: I wouldn't imagine it being more than informational.
  will require routine updates or an understanding that like fish
  security recommendations do start to smell bad after a while.

William Dixon: section 3.5 refers to ipsec and ike that is just
  really commentary, and I am not sure what to conclude from it.
  example of commentary. draft needs some work to provide concrete
  recommendations of work

Joel: also some things that require conclusions

Michael Behring: good work, stuff that people should read, find
  difficult that the purpose is a bit of threat, a bit of
  countermeasures. would be good to have a clearer idea of what the
  goal of the document is.

Joe Abley: seems to me there is room in the charter for informational
  travelogues on security as well as BCPs.

Merike: operational people are always told what to do but not why.
  I like Pekka's doc because it describes potential security issues
  along with tradeoffs for some solutions.  It will help operators
  pick appropriate solutions in their environments since none of
  them individually is a silver bullet to solve all problems.

Pekka: Intent, if it's 15 pages or more, if it's too long. some
  attack or countermeasure requires lengthy description, probably
  referred somewhere else. so tried to be concise.

Michael: I really like that. I also see Merike's point. the danger
  is that you take the countermeasures out and just leave the list,
  which means the list needs to be more concise.

Joel: Should close it here so we can get the remaining presentations
  in. when we look for consensus on the list, document might benefit
  from additional authors. People who like the document should
  consider helping out with it.

4. draft-ietf-rpsec-bgp-session-sec-req-01, Michael Behring

Michael Behring gave an overview of the structure of this document,
which was previously a work item in the RPSEG working group.

joel: Seems likely that opsec people would have things to say about
  this

Ron: this does give value, think it's appropriate

Merike: Think work is appropriate, but was involved in rpsec and
  don't think there are enough people in this group that understand
  enough bgp potentially to come up with requirements.

Joel: Agree with merike on that; control plane security is one
  element of that but the protocol itself is the other piece and I
  think that's slightly less core here.

Pekka: observation here is proposed charter, bcp problem statements,
  taxonomies, etc. requirements explicitly out of scope.

Sandy Murphy: I recall reading very long ago versions of your draft
  and versions of Pekka' sdraft, and saw in your outline some items
  that I thought might also be included in Pekka's. Infrastructure
  hiding, for example?

Michael: yeah, but really compeltely different scope.

Lucy: To follow up on what joel was saying, cross-area review
  and strong support that document should continue

Joe: advice to operators on how to secure routers would be a
  clearer fit for the charter 

Joel: maybe an additional document

Michael: I will continue in the routing area, and maybe return here
  with a BCP.

5. Any Other Business

There was no other business.

6. Adjournment

The meeting was closed at 1620 UTC+1.

--- opsec-ietf72-1.txt	2008-08-04 08:04:01.000000000 -0700
+++ opsec-ietf72-2.txt	2008-08-04 08:21:21.000000000 -0700
@@ -11,39 +11,41 @@
 
 1. Joel Jaeggli, OPSEC WG
 
-Joel Gaeggli presented on the working group rechartering and document
+Joel Jaeggli presented on the working group rechartering and document
 status. There is fatigue on existing milestones, and abandonment
 with recharter is a more pragmatic way forward than closing the
-working group and chartering a new one.
+working group and chartering a new one.  
 
 The new charter has passed working group last call and has been sent
 to the IESG.
 
 Milestones on the new charter are a bit thin. We want to keep the working
-group to bring problems from the network operations space into.
+group around to bring problems from the network operations space into.
 
-ron bonica: charter has changed -- no longer to do with requirements for
+Ron Bonica: charter has changed -- no longer to do with requirements for
   vendors, now to do with BCP for operators. Old documents should be allowed
   to wither on the vine.
 
-An alternative might be to fold this work into OPSAWG.
+Joel: An alternative might be to fold this work into OPSAWG.
 
-dan romanescu: conscious decision to keep opsec separate from opsawg in
+Dan Romanescu: conscious decision to keep opsec separate from opsawg in
   order to separate and maintain focus on the security aspects
 
 There are two new potential work items from Warren Kumari on blackhole
 communities.
 
-danny mcpherson: comment on warren's blackhole draft; many isps use
+Danny Mcpherson: comment on warren's blackhole draft; many isps use
   different communities for different kinds of blackholes, different
   places to drop packets, etc
 
-Draft-gont-opsec-icmp-filtering is a draft which has seen positive discussion
+draft-gont-opsec-icmp-filtering is a draft which has seen positive discussion
 on the mailing list.
 
-mohacsi janos: similar draft for v6 icmp fltering, around rfc 4890.
+Mohacsi Janos: similar draft for v6 icmp fltering, around rfc 4890.
   I think the author should consider looking at this draft.
 
+Joel: reconciling the two is desirable
+
 There was a strong hum for adopting draft-gont-opsec-icmp-filtering
 as a working group document. There was no hum in dissent. The author
 was encouraged to resubmit the draft as an opsec working group
@@ -61,63 +63,63 @@
 
 Pekka Savola provided a brief history of this draft.
 
-merike kaeo: totally support this work, and think it would be perfect
+Merike Kaeo: totally support this work, and think it would be perfect
   as an informational document
 
-joel jaeggli: no hat, read this document the first time around, a
+Joel Jaeggli: no hat, read this document the first time around, a
   little while ago, think it is a really useful document, some
   freshening required, but appropriate under our new charter
 
-christian vogt: if not in opsec, where else?
+Christian Vogt: if not in opsec, where else?
 
-pekka: if not in opsec, probably not in ietf
+Pekka: if not in opsec, probably not in IETF
 
-christian: I support it to be published in this group
+Christian: I support it to be published in this group
 
-ron bonica: thumbs up
+Ron Bonica: thumbs up
 
-joel: will need to seek consensus on list
+Joel: will need to seek consensus on list
 
-lucy lynch: I have read it a while ago, read it again this this
+Lucy Lynch: I have read it a while ago, read it again this this
   morning, some of this is a moving target; may require regular
   refreshment
 
-joel: I wouldn't imagine it being more than informational.
+Joel: I wouldn't imagine it being more than informational.
   will require routine updates or an understanding that like fish
   security recommendations do start to smell bad after a while.
 
-william dixon: section 3.5 refers to ipsec and ike that is just
+William Dixon: section 3.5 refers to ipsec and ike that is just
   really commentary, and I am not sure what to conclude from it.
   example of commentary. draft needs some work to provide concrete
   recommendations of work
 
-joel: also some things that require conclusions
+Joel: also some things that require conclusions
 
-michael behring: good work, stuff that people should read, find
+Michael Behring: good work, stuff that people should read, find
   difficult that the purpose is a bit of threat, a bit of
   countermeasures. would be good to have a clearer idea of what the
   goal of the document is.
 
-joe abley: seems to me there is room in the charter for informational
+Joe Abley: seems to me there is room in the charter for informational
   travelogues on security as well as BCPs.
 
-merike: operational people are always told what to do but not why.
+Merike: operational people are always told what to do but not why.
   I like Pekka's doc because it describes potential security issues
   along with tradeoffs for some solutions.  It will help operators
   pick appropriate solutions in their environments since none of
   them individually is a silver bullet to solve all problems.
 
-pekka: intent: if it's 15 pages or more, if it's too long. some
-  attack or countermeasure requires mengthy description, probably
+Pekka: Intent, if it's 15 pages or more, if it's too long. some
+  attack or countermeasure requires lengthy description, probably
   referred somewhere else. so tried to be concise.
 
-michael: I really like that. I also see merike's point. the danger
+Michael: I really like that. I also see Merike's point. the danger
   is that you take the countermeasures out and just leave the list,
   which means the list needs to be more concise.
 
-joel: should close it here so we can get the remaining presentations
+Joel: Should close it here so we can get the remaining presentations
   in. when we look for consensus on the list, document might benefit
-  from additional authors. people who like the document should
+  from additional authors. People who like the document should
   consider helping out with it.

@@ -126,38 +128,38 @@
 Michael Behring gave an overview of the structure of this document,
 which was previously a work item in the RPSEG working group.
 
-joel: seems likely that opsec people would have things to say about
+joel: Seems likely that opsec people would have things to say about
   this
 
-ron: this does give value, think it's appropriate
+Ron: this does give value, think it's appropriate
 
-merike: think work is appropriate, but was involved in rpsec and
+Merike: Think work is appropriate, but was involved in rpsec and
   don't think there are enough people in this group that understand
   enough bgp potentially to come up with requirements.
 
-joel: agree with merike on that; control plane security is one
+Joel: Agree with merike on that; control plane security is one
   element of that but the protocol itself is the other piece and I
-  think that's slightly less core here
+  think that's slightly less core here.
 
-pekka: observation here is proposed charter, bcp problem statements,
+Pekka: observation here is proposed charter, bcp problem statements,
   taxonomies, etc. requirements explicitly out of scope.
 
-sandy murphy: I recall reading very long ago versions of your draft
-  and versions of pekka' sdraft, and saw in your outline some items
-  that I thought might also be included in pekka's. infrastructure
+Sandy Murphy: I recall reading very long ago versions of your draft
+  and versions of Pekka' sdraft, and saw in your outline some items
+  that I thought might also be included in Pekka's. Infrastructure
   hiding, for example?
 
-michael: yeah, but really compeltely different scope.
+Michael: yeah, but really compeltely different scope.
 
-lucy: to follow up on what joel was saying, cross-area review
+Lucy: To follow up on what joel was saying, cross-area review
   and strong support that document should continue
 
-joe: advice to operators on how to secure routers would be a
+Joe: advice to operators on how to secure routers would be a
   clearer fit for the charter 
 
-joel: maybe an additional document
+Joel: maybe an additional document
 
-michael: I will continue in the routing area, and maybe return here
+Michael: I will continue in the routing area, and maybe return here
   with a BCP.

---

From: Joe Abley <[email-masked]>
Date: Tue, 5 Aug 2008 11:26:13 -0400

>> Please see attached. Please send comments/corrections to the list,  

Third cut attached.

This incorporates comments from Dan and Joel. If people could take the  
time to read through it and send me any further suggestions in the  
next couple of days, that would be appreciated.

Thanks,

Joe