Re: [sacm] WGLC for draft-ietf-sacm-ecp

Hello all:

I agree with Ira’s comments and I see EPCP as one of many potential collection architectures that may exist within the wider SACM architecture. Therefore, I believe this draft is ready for publication.

Kind regards,

Adam

> On Jul 2, 2019, at 11:07 AM, Ira McDonald <blueroofmusic@gmail.com> wrote:
> 
> Hi,
> 
> Ira's comments on <draft-ietf-sacm-ecp-05>
> 
> 3.2.1.  Provisioning
> 
> - Describes one-time setup examples of serial numbers (immutable), 
> hardware certificates (long-lived), and device MAC addresses, which
> are NOT immutable and *should* be changing for Random MAC address
> usage over time, per recent IEEE 1609 (WAVE), IEEE 802.11 (Wi-Fi), 
> and Common Criteria protection profile recommendations.
> 
> - Recommend removing the MAC address example from this clause.
> 
> 6.  Future Work
> 
>    "Reassess the use of MAC addresses, including market research to
>    determine if MAC addresses continue to be a widely implemented
>    device identifier among network tools."
> 
> - Market research showing the continued unwise use of fixed MAC
> addresses in Enterprise networks is not a valid criteria.  This is
> one of many bad security practices that are hard to stamp out.
> 
> - Recommend changing to:
>    "Reassess the use of MAC addresses, based on technical research
>    into current security best practices in IoT, automotive, mobile,
>    and other privacy sensitive market domains."    
> 
> 10.  Privacy Considerations
> 
>    "The EPCP specifically addresses the collection of posture data from
>    enterprise endpoints by an enterprise network.  As such, privacy is
>    not going to often arise as a concern for those deploying this
>    solution."
> 
> - Stongly disagree.  If enterprise (or cloud) servers with endpoint
> posture metadata are successfully hacked (they're an attractive target),
> then major privacy issues arise with location/time-of-day association
> with PII for mobile users.  In the EU, GDPR protections definitely do
> apply to enterprise networks.
> 
> - Recommend changing to:
> 
>    "The EPCP specifically addresses the collection of posture data from
>    enterprise endpoints by an enterprise network.  As such, privacy is
>    a fundamental concern for those deploying this ECP solution, given
>    EU GDPR, California CCPA, and many other privacy regulations.  The
>    enterprise SHOULD implement and enforce their duty of care."
> 
>    "An enterprise network should limit access to endpoint posture and
>    identification information to authorized users."
> 
> - Very weak statement.  Potentially large number of network admins and
> IT support people may have access to endpoint posture metadata.  They
> should always have training about the importance of protecting this
> endpoint posture metadata.
> 
> - Recommend changing to:
> 
>    "An enterprise network SHOULD limit access to endpoint posture and
>    identification information to authorized users and SHOULD enforce 
>    policies that prevent export of endpoint posture metadata to third 
>    parties (except duly authorized law enforcement personnel)."
> 
> 
> Cheers,
> - Ira
> 
> Ira McDonald (Musician / Software Architect)
> Co-Chair - TCG Trusted Mobility Solutions WG
> Co-Chair - TCG Metadata Access Protocol SG
> Chair - Linux Foundation Open Printing WG
> Secretary - IEEE-ISTO Printer Working Group
> Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
> IETF Designated Expert - IPP & Printer MIB
> Blue Roof Music / High North Inc
> http://sites.google.com/site/blueroofmusic <http://sites.google.com/site/blueroofmusic>
> http://sites.google.com/site/highnorthinc <http://sites.google.com/site/highnorthinc>
> mailto: blueroofmusic@gmail.com <mailto:blueroofmusic@gmail.com>
> PO Box 221  Grand Marais, MI 49839  906-494-2434
> 
> 
> 
> On Thu, Jun 27, 2019 at 4:34 PM Karen O'Donoghue <odonoghue@isoc.org <mailto:odonoghue@isoc.org>> wrote:
> Folks,
> 
> As discussed at our virtual interim on Tuesday, this begins a three week working group last call for: 
> Endpoint Posture Collection Profile
> https://datatracker.ietf.org/doc/draft-ietf-sacm-ecp/ <https://datatracker.ietf.org/doc/draft-ietf-sacm-ecp/>
> 
> Please reply to this email thread with an indication that you have read the document, any comments you may have, and your assessment of whether or not it is ready to proceed to publication. 
> 
> DEADLINE: Please reply by Friday 19 July 2019. 
> 
> Thanks!
> Karen and Chris
> 
> _______________________________________________
> sacm mailing list
> sacm@ietf.org <mailto:sacm@ietf.org>
> https://www.ietf.org/mailman/listinfo/sacm <https://www.ietf.org/mailman/listinfo/sacm>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm