[Maprg] Draft on Quantitative Analysis of Security Considerations

[[e-mail]]

All:

Knowing that MAPRG is not going to meet for IETF 108, I wanted to bring your
attention to a piece of work a colleague and I are doing. Our interest is
how security considerations sections have changed over time.

RFC3552 provides guidance to authors in crafting RFC text on Security
Considerations. The RFC is more than fifteen years old. With the threat
landscape and security ecosystem significantly changed since the RFC was
published, RFC3552 is a candidate for update. 

Our draft proposes that, prior to drafting an update to RFC3552, an
examination of recent, published Security Considerations sections be carried
out as a baseline for how to improve RFC3552. It suggests a methodology for
examining Security Considerations sections in published RFCs and the
extraction of both quantitative and qualitative information that could
inform a revision of the older guidance. It also reports on a recent
experiment on textual analysis of sixteen years of RFC Security
Consideration sections.

The draft is available at:
https://datatracker.ietf.org/doc/draft-mcfadden-smart-rfc3552-textual-resear
ch/

I would welcome comments and would be interested in presenting at the joint
interim with RIPE MATWG in August.

mark

Mark McFadden