Subject: [sacm] review of draft-ietf-sacm-architecture-05

From: Leif Johansson <[email-masked]>
Date: Wed, 4 Nov 2015 05:56:23 +0100

So here are some first observations on the SACM architecture that I
promised to provide during the meeting yesterday.

I'm a tourist in this WG but my $dayjob sometimes involves distributed
system design and deployment.

My main gripe with the architecture as described is that while the whole
thing reads like the IETF specification for a botnet (central c&c infra
serving clients with little or no control over posture collection and
remediation) the security controls follow the usual IETF model of "just
use authn and authz judiciously" - i.e security at the transport level.

The following passage from the security considerations section is a fair
illustration of what I think is wrong with the approach (at least as I
understand it):

   "... It is presumed that once authenticated
   and authorized, the Provider, Controller or Consumer is deemed
   trustworthy; though note that it is possible that the modules or
   devices hosting the SACM components may be compromised as well (e.g.
   due to malware or tampering); however, addressing that level of
   trustworthiness is out of scope for SACM."

My problem with a system based on this architecture is that I can't
see how I could ever recover or even determine the extent of a
hacked control point.

When I deploy distributed systems with some form of central control
I make sure to protect not only access to the control points but also
and even more important I make sure there is integrity and non-
repudiation for all objects and changes.

This is not just varnish on the architecture (so I'll hold off on
suggesting text for now) but a fundamentally different approach to
security that imo is needed in any system with the amount of control
that a SACM deployment will have.

	Cheers Leif

---

From: Adam Montville <[email-masked]>
Date: Wed, 4 Nov 2015 15:44:24 +0900

Leif,

Thanks for your review and for your perspective, which I believe we should seriously consider.

What we are hoping to accomplish is to produce specifications implemented by security assurance tools, which seems to make your perspecitve that much more important.

Kind regards,

Adam

> On Nov 4, 2015, at 1:56 PM, Leif Johansson <[email-masked]> wrote:
> 
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm