Re: [nmrg] Re: [IRSG] review of draft-irtf-nmrg-snmp-measure-04.txt

[Juergen Schoenwaelder <[e-mail]>]

On Mon, May 19, 2008 at 09:15:49AM -0400, David B Harrington wrote:
 
> I think something should be said that this information could be used
> by an attacker (especially an attacker internal to the organization)
> to decide/pinpoint where and how to attack. This information might
> need to be anonymized, although that would seem to defeat the purpose
> of having the information. I don't really know what to suggest here
> other than to raise the point in the security considerations that such
> location information might be sensitive, and could aid an attacker.

I suggest to add the following text to the end of the security
considerations:

   The meta data associated with traces and in particular information
   about the organization owning a network and the description of the
   measurement point in the network topology where a trace was collected
   may be misused to decide/pinpoint where and how to attack a network.
   Meta data therefore needs to be properly protected.

In addition, I like to replace "generate XML traces" with "generate
CSV or XML traces" in the first sentence of the second paragraph of
the security considerations text since the rest of the paragraph
applies to both trace formats and not just XML.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
Fax:   [phone]         <http://www.jacobs-university.de/>