Re: [Detnet] WG adoption poll draft-sdt-detnet-security-01

["Maik Seewald (maseewal)" <[e-mail]>]

Hello Ethan,

Only a few comments on the use cases for the industries, especially in the
utility environment:

- Especially in power automation, there is more and more regulation
including standards (e.g.: NERC CIP in North America)
- Availability and integrity are the most important security objectives
(and requirements), confidentiality and privacy are relevant if customer
or market data is involved
- Along these lines, there is a requirement for end-to-end security which
is already standardised (and implemented) for many automation and control
protocols (protecting the app layer and/or transport[typically using TLS])
- Another security control which is also standardised and implemented is
segmentation (zones and conduits including access control)
- These are two trends any communication architecture need to deal with
- The requirements in industrial automation are quite similar, especially
in new scenarios such as Industry 4.0/Digital Factory where workflows and
protocols cross zones, segments, and entities
- IEC 62443 (ISA99) defines security for Industrial Automation and Control
Systems (IACS), typically for installations in the critical infrastructure
- It comprises domains such as industrial automation, oil&gas, and
electricity transmission and distribution; the foundational requirements
are a great source for industrial security

Regarding the Detnet specifics, IMHO, it is imperative to protect the
network controller (wherever a controller is used) using strong security
controls and mitigation technologies.
A hacked/compromised controller would allow any disastrous (attack)
scenario.

Cheers,
Maik 
 



On 12.09.17, 19:21, "detnet on behalf of Grossman, Ethan A."
<[e-mail] on behalf of [e-mail]> wrote:

>Thanks Lou, 
>Yes/support. 
>
>On behalf of the DetNet Security Design Team, we are pleased and excited
>about achieving workgroup adoption, and we look forward to input from the
>broader DetNet community. Below is our current list of items which we
>would like to address next in the draft - if anyone has additional
>suggestions or would like to help with the next release of the draft,
>which we are planning for IETF 100, please reply.
>
>1) We need to make another pass through every section to clean up loose
>ends, unify the writing style and flesh out some of the statements.
>2) Given that the Data Plane has been basically established, we need to
>extend the draft to address these specifics (e.g. implied by use of IPv6
>and/or MPLS-PW).
>3) We believe it would be helpful to establish solid requirements before
>we can expect external reviewers to review this draft, so our intent is
>to take the various use case statements in the appendix and turn them
>into more formal statement of requirements that a reviewer could measure
>our draft against.
>4) We need to review and improve our threat model to reduce our chances
>of being blind-sided by threats we haven't addressed.
>5) The current structure of the document has some "unusual" things about
>it, for example the section about use cases in which there are statements
>that are phrased as questions (like "does the threat attack the timely
>arrival of packets?") - we need to come up with a better way to phrase
>this information.
>
>Best,
>Ethan Grossman
>DetNet Security Draft editor
>
>-----Original Message-----
>From: detnet [mailto:[e-mail]] On Behalf Of Lou Berger
>Sent: Tuesday, September 12, 2017 5:14 AM
>To: DetNet WG <[e-mail]>
>Cc: DetNet Chairs <[e-mail]>
>Subject: [Detnet] WG adoption poll draft-sdt-detnet-security-01
>
>All,
>
>This is start of a two week poll on making draft-sdt-detnet-security-01 a
>working group document. Please send email to the list indicating
>"yes/support" or "no/do not support".  If indicating no, please state
>your reservations with the document.  If yes, please also feel free to
>provide comments you'd like to see addressed once the document is a WG
>document.
>
>The poll ends Sep 26.
>
>Thanks,
>
>Lou (and Pat)
>
>_______________________________________________
>detnet mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/detnet
>
>_______________________________________________
>detnet mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/detnet