RE: [nmrg] Re: [IRSG] review of draft-irtf-nmrg-snmp-measure-04.txt

["David B Harrington" <[e-mail]>]

Thanks,
dbh 

> -----Original Message-----
> From: Juergen Schoenwaelder 
> [mailto:[e-mail]] 
> Sent: Monday, May 19, 2008 2:31 PM
> To: David B Harrington
> Cc: 'Karen R. Sollins'; 'Internet Research Steering Group'; 
> [e-mail]
> Subject: Re: [nmrg] Re: [IRSG] review of 
> draft-irtf-nmrg-snmp-measure-04.txt
> 
> On Mon, May 19, 2008 at 09:15:49AM -0400, David B Harrington wrote:
>  
> > I think something should be said that this information could be
used
> > by an attacker (especially an attacker internal to the
organization)
> > to decide/pinpoint where and how to attack. This information might
> > need to be anonymized, although that would seem to defeat 
> the purpose
> > of having the information. I don't really know what to suggest
here
> > other than to raise the point in the security 
> considerations that such
> > location information might be sensitive, and could aid an
attacker.
> 
> I suggest to add the following text to the end of the security
> considerations:
> 
>    The meta data associated with traces and in particular
information
>    about the organization owning a network and the description of
the
>    measurement point in the network topology where a trace 
> was collected
>    may be misused to decide/pinpoint where and how to attack 
> a network.
>    Meta data therefore needs to be properly protected.
> 
> In addition, I like to replace "generate XML traces" with "generate
> CSV or XML traces" in the first sentence of the second paragraph of
> the security considerations text since the rest of the paragraph
> applies to both trace formats and not just XML.
> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
> Fax:   [phone]         <http://www.jacobs-university.de/>
>