RE: [nmrg] Re: [IRSG] review of draft-irtf-nmrg-snmp-measure-04.txt

["David B Harrington" <[e-mail]>]

 

> -----Original Message-----
> From: [e-mail] 
> [mailto:[e-mail]] On Behalf Of Karen R. Sollins
> Sent: Monday, May 19, 2008 12:05 AM
> To: [e-mail]; Karen R. Sollins
> Cc: Internet Research Steering Group; [e-mail]
> Subject: [nmrg] Re: [IRSG] review of 
> draft-irtf-nmrg-snmp-measure-04.txt
> 
[...]
> >>  3. Next paragraph: this is where the location question arises.
> >>  Without some completely standardized and self explanatory 
> capturing
> >>  of location information, any data set will be incomparable to
any
> >>  other.
> >
> >I expanded "where the trace was collected" to "where the trace was
> >collected (name of the network and/or name of the organization
owning
> >the network, description of the measurement point in the network
> >topology where the trace was collected)".
> 
> Good.
> 

I think something should be said that this information could be used
by an attacker (especially an attacker internal to the organization)
to decide/pinpoint where and how to attack. This information might
need to be anonymized, although that would seem to defeat the purpose
of having the information. I don't really know what to suggest here
other than to raise the point in the security considerations that such
location information might be sensitive, and could aid an attacker.

Personally, I do not know that one needs to know the organization and
the network within the organization unless you are planning to do
regression testing or correlating the data with information available
via other means. To compare the data with data sets from different
networks, then I think the measurement point in the network topology
and knowing the network topology is far more important (and unlikely
to be available). Given the dynamic nature of network topologies,
especially in any sort of virtualized environment (Virtual LANs,
routers, servers, etc.), I doubt any data set even from the same
network is likely to be directly comparable over time unless an
attempt is made to make the data collections directly comparable by
deliberately not changing the topology. I think a statement to that
effect might be more useful to those doing analyses than adding
organization/network information.

David Harrington
[e-mail]
[e-mail]
[e-mail]