Re: [MIB-DOCTORS] Fix of Security Guidelines for IETF MIB Modules

[Randy Presuhn <[e-mail]>]

Hi -


On 9/30/2018 5:59 AM, Glenn Mansfield Keeni wrote:
> 
> Hi,
>  >         What
>  >         is the point of limiting read access and then sending the
>  >         information in the clear?
> Total agreement. Sending info in the clear is by default NG and must
> be strongly discouraged.
> It will help to have some proposed replacement text for
>  > OLD:  It is thus important to control even GET and/or NOTIFY access to
>  >        these objects and possibly to even encrypt the values of these
>  >        objects when sending them over the network via SNMP.
...

As I wrote previously, this would be editorially tricky since the
paragraph currently conflates "sensitive" (which I take to mean
"that which should be protected from disclosure") with "vulnerable"
(which I take to mean "that which should be protected from
modification").  It *is* possible to have something which one wants
to protect from modification, but there's no need to protect it from
disclosure.  For example, consider a hostname.  Are we willing to
do major surgery on this paragraph, probably splitting it into two,
and thus affecting the structure of these security considerations?

Randy