[Last-Call] draft-ietf-opsawg-rfc5706bis-09 ietf last call Secdir review

[Jacqueline McCall via Datatracker <[e-mail]>]

Document: draft-ietf-opsawg-rfc5706bis
Title: Guidelines for Considering Operations and Management in IETF
Specifications Reviewer: Jacqueline McCall Review result: Ready

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These comments
were written primarily for the benefit of the security area directors. Document
editors and WG chairs should treat these comments just like any other last call
comments.

The summary of the review is Ready

Purely through a security lens, the document provides solid guidance for
protocol designers to consider which will be useful from both an operational
and security point of view. Since the initial early review, I appreciate the
updates that have been made to the security sections. By removing the bulk of
content from the Security Considerations (9) to Security Management (5.8) has
helped focus the aim of the security discussions to the relevant operational
objectives. The Impact on Security Operations (4.5) section has also been built
out and is quite comprehensive, serving as a useful resource. Highlighting the
tension between privacy and visibility is a welcome addition and very relevant
to modern times. From a Security perspective, the document content combined
with the “Operational Considerations Checklist” is relevant and refined to
provide genuine guidance to protocol designers.

From a non-security perspective, I do want to acknowledge the discussion’s
happening around the requirement for "Operational Considerations" inclusion in
future documents and interested to see how these concerns will be addressed.