Subject: [RPSEC] RE: RPSEC digest, Vol 1 #157 - 3 msgs

From: "Ferrell, William" <[email-masked]>
Date: Mon, 2 Jun 2003 05:57:44 -0400

Stephen

1. When I mention Barry Green , the name barely needs justification for his
impact on the routing community. Are you familiar with Cisco press-ISP
essentials ?
2. The intent of my comment was for the technical perspective only to add
sound Technical value and discussion. Im a Routing-Security Engineer ,My
apologies if my english is a bit sketchy , I cant spend a lot of time
sparring with you on less valueable symantics and english compositon.
3. Would you like to lend any technical opinion to the documentation? it
would be more usefull in this forum. 

-----Original Message-----
From: [email-masked]
To: [email-masked]
Sent: 5/30/03 12:00 PM
Subject: RPSEC digest, Vol 1 #157 - 3 msgs

Send RPSEC mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via the World Wide Web, visit
	https://www1.ietf.org/mailman/listinfo/rpsec
or, via email, send a message with subject or body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of RPSEC digest..."

Today's Topics:

   1. RE: Initial comments on draft-ietf-rpsec-routing-threats
       -01.txt (Stephen Kent)
   2. Re: Comments on the Threats Draft.... (Piyush Bhatnagar)

--__--__--

Message: 1
Date: Wed, 28 May 2003 11:07:17 -0400
To: "Ferrell, William" <[email-masked]>,
   "[email-masked]'" <[email-masked]>
From: Stephen Kent <[email-masked]>
Subject: RE: [RPSEC] Initial comments on
draft-ietf-rpsec-routing-threats 
 -01.txt

--============_-1157877368==_ma============
Content-Type: text/plain; charset="us-ascii" ; format="flowed"

At 12:05 PM -0400 5/23/03, Ferrell, William wrote:
>
>
>
>Only a limited set of comments ,most are in reference to the editorials
>or comments to the original text/author
>
>1. This definition model is becoming widely used and
>well-known/well-understood in the industry. One of the major proponents
>of this model is Barry Green of Cisco. His work goes without
>explanation.

I assume this phrase is supposed to be a compliment, but in normal 
English usage that's not clear. Irrespective of quality of the 
material in question, to better make your point you should cite some 
body of peer-reviewed, published work (vs. company-published 
documents, slide sets, etc.) by Barry.

Steve
--============_-1157877368==_ma============
Content-Type: text/html; charset="us-ascii"

<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
 --></style><title>RE: [RPSEC] Initial comments on
draft-ietf-rpsec-routi</title></head><body>
<div>At 12:05 PM -0400 5/23/03, Ferrell, William wrote:</div>
<blockquote type="cite" cite>&nbsp;<br>
<br>
<br>
Only a limited set of comments ,most are in reference to the
editorials<br>
or comments to the original text/author<br>
<br>
1. This definition model is becoming widely used and<br>
well-known/well-understood in the industry. One of the major
proponents</blockquote>
<blockquote type="cite" cite>of this model is Barry Green of Cisco.<b>
His work goes without</b></blockquote>
<blockquote type="cite" cite><b>explanation.</b></blockquote>
<div><br></div>
<div>I assume this phrase is supposed to be a compliment, but in
normal English usage that's not clear. Irrespective of quality of the
material in question, to better make your point you should cite some
body of peer-reviewed, published work (vs. company-published
documents, slide sets, etc.) by Barry.</div>
<div><br></div>
<div>Steve</div>
</body>
</html>
--============_-1157877368==_ma============--

--__--__--

Message: 2
From: "Piyush Bhatnagar" <[email-masked]>
To: "Jeffrey Haas" <[email-masked]>, "Russ White" <[email-masked]>
Cc: <[email-masked]>
Subject: Re: [RPSEC] Comments on the Threats Draft....
Date: Fri, 30 May 2003 04:04:27 -0400

I tend to agree with Jeff. We should try and add such a section or point
to
a place that does so.

Through out the document we talk about threats to routing protocols by
using
multiple and at times overlaping classifications which lead to some
confusion.  I think it is also confusing to use different
classifications
interchangeably. I must agree that it is quite useful to describe the
different classifications in this document but then after the
description of
various classifications, we should choose one classification to be used
through the rest of the document for the sake of clarity.

Also, these threats result in various threat consequences. In my
opinion, it
might be useful quite to create a matrix of threats and threat
consequences
depicting what threats can result in which threat consequences. This
will be
a very good way to summarize the document as well.

Just my 2 cents.

-
Regards, Piyush
==========================
Piyush Bhatnagar, CISSP
[email-masked]
==========================

----- Original Message ----- 
From: "Jeffrey Haas" <[email-masked]>
To: "Russ White" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, May 27, 2003 12:40 PM
Subject: Re: [RPSEC] Comments on the Threats Draft....

> On Wed, May 21, 2003 at 09:19:31AM -0400, Russ White wrote:
> > by routing protocols, can make intelligent decisions when forwarding
> > traffic from one port to another.
>
> We might not want to say "port" here.
>
> > This work describes such attack methods in terms of threats,
including
> > threat sources and capabilities, threat actions, and threat
> > consequences.
>
> Given that the taxonomy beteween "security people" and "routing
security
> people" doesn't always seem to match, are we planning on doing
> either a section on taxonomy or pointing to somewhere else that does
so?
>
> -- 
> Jeff Haas
> NextHop Technologies
> _______________________________________________
> RPSEC mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/rpsec
>

--__--__--

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

End of RPSEC Digest
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Tony Tauber <[email-masked]>
Date: Mon, 2 Jun 2003 17:51:47 -0400 (EDT)

On Mon, 2 Jun 2003, Ferrell, William wrote:

> Stephen
>
> 1. When I mention Barry Green , the name barely needs justification
> for his impact on the routing community. Are you familiar with Cisco
> press-ISP essentials ?

I'm pretty sure Steve and Barry know each other as I had some hallway
conversation with both of them at the last IETF meeting.

> 2. The intent of my comment was for the technical perspective only
> to add sound Technical value and discussion. Im a Routing-Security
> Engineer ,My apologies if my english is a bit sketchy , I cant spend
> a lot of time sparring with you on less valueable symantics and
> english compositon.  3. Would you like to lend any technical opinion
> to the documentation? it would be more usefull in this forum.

[List-moderator hat on.]

OK folks, let's keep it clean out there.

To Steve's point, if your intent is to cite Barry's work as being
valuable to the threat definition modeling, it'd help more to provide
specific references (eg. URLs) so we could all see exactly which parts
you had in mind that would help the effort.
Beyond that, realize that some language mistakes rendered by
non-native speakers or by typos can actually render the meaning of the
words or intent of the author completely indeterminate.  Trying to
assume what people intend in these cases can lead to further
misunderstanding.

To William's point, let's keep the discussion as on-topic and as
constructive as may be possible.  We don't want to discourage the
input of people with less English facility, certainly.

Thanks,

Tony

> >editorials or comments to the original text/author
> >
> >proponents of this model is Barry Green of Cisco. His work goes
> >without explanation.
>
> > security people" doesn't always seem to match, are we planning on
> > doing either a section on taxonomy or pointing to somewhere else
> > that does so?
> >
> > --
> > Jeff Haas

---

From: Stephen Kent <[email-masked]>
Date: Mon, 2 Jun 2003 21:48:03 -0400

>impact on the routing community. Are you familiar with Cisco press-ISP

I tend not to read vendor-sponsored publications of this sort. That's 
why I mentioned refereed publications as a suitable basis for citing 
someone's credentials and relevant work.

>sparring with you on less valueable symantics and english compositon.

Words are the means by which we communicate ideas in document.  We 
need to pay close attention to the choice of words, or we run the 
risk of confusing readers.

>would be more usefull in this forum.

I have already sent an example of a threat model to assist in this work.

I also have also authored several papers on securing BGP, 
peer-reviewed papers of the sort I note above.  These provide 
potential inputs for the work of this WG.

Steve