Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)

Hello,

This is a good discussion and it seems that it is getting to the right
set of points, that we do need to worry about index data and ways to
correlate information back to systems and possibly to users of those
systems or whose data crosses those systems.

Jim is right on the PM angle, but you can phrase this lots of ways.
In terms of privacy, we worry about indexes, anything considered
sensitive that requires confidentiality related to privacy, and PII.
There are lots of ways to handle this and that will be up to the WG to
decide how to provide such guidance.  We do have materials to help you
from the view of developing protocols.

Here are some links from a slide I've been using in presentations
(please do read the RFC listed, it's very helpful):
IETF Privacy Considerations for Internet protocols
  –https://datatracker.ietf.org/doc/rfc6973/
  –Data protection
     ▪Object level encryption
     ▪Determining when data is not necessary
     ▪Obscuring data or generalizing when possible
     ▪Protections on sensitive data and indexes to that data
  –Push for encrypted traffic
IAB Statement on Internet Confidentiality
  –https://www.iab.org/2014/11/14/iab-statement-on-internet-confidentiality/

Pervasive Monitoring is an Attack
  –RFC7258/BCP188 published after major IETF LC debate – sets the
basis for further actions
  –https://www.rfc-editor.org/rfc/rfc7258.txt

In case you missed the tech plenary for IETF88 and you prefer video
over reading (or in addition), this was a great plenary that gives
background into these considerations for the IETF:
http://www.ietf.org/live/ietf88/text.html

Unofficial stuff:
Blog from Snowden Q&A in Prague:
https://www.mnot.net/blog/2015/07/20/snowden_meets_the_ietf

If you missed the Snowden Q&A on Sunday of Prague, here is a link:
https://www.youtube.com/watch?feature=youtu.be&v=0NvsUXBCeVA&app=desktop

We are also working with the IEEE on their privacy work.  This
includes work to ensure MAC addresses can't be used to identify hosts
(and thus users of the hosts).

Thanks,
Kathleen

On Fri, Aug 7, 2015 at 10:51 AM, Ira McDonald <blueroofmusic@gmail.com> wrote:
> Hi,
>
> When an enterprise network is breached by an outside attacker (using "if"
> no longer seems appropriate) or is compromised by an inside attacker, the
> SACM components that have datastores of devices and associated identity
> info as well as (often) associated user identities are high-value targets of
> attacks for bulk theft of PII.
>
> By its fundamental nature, SACM increases the threat of exposure of PII
> and therefore should address anonymization of individual device identity
> info and strong controls on the dissemination of that info to subscribers.
>
> Cheers,
> - Ira
>
>
> Ira McDonald (Musician / Software Architect)
> Co-Chair - TCG Trusted Mobility Solutions WG
> Chair - Linux Foundation Open Printing WG
> Secretary - IEEE-ISTO Printer Working Group
> Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
> IETF Designated Expert - IPP & Printer MIB
> Blue Roof Music / High North Inc
> http://sites.google.com/site/blueroofmusic
> http://sites.google.com/site/highnorthinc
> mailto: blueroofmusic@gmail.com
> Winter  579 Park Place  Saline, MI  48176  734-944-0094
> Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434
>
>
> On Fri, Aug 7, 2015 at 10:01 AM, Ron Colvin <Ron.Colvin@nasa.gov> wrote:
>>
>> My understanding on PII is that as soon as I associate a person with an
>> email address, phone number or physical address I have PII that I need to
>> protect. If we associate a user id, account or user provisioned PKI with a
>> device including possibly a MAC address we probably have the same concerns.
>>
>> I think in many cases user certificates are used for device authentication
>> and I thought that was an attribute that was highly desirable.
>>
>>
>> On 8/7/15 7:38 AM, adammontville wrote:
>>
>> I agree that privacy needs to be covered.
>>
>> Still, when we talk about identity or identification in this working
>> group, we're talking about something different than PII data. As such,
>> there's this other issue for the information model
>> sacmwg/draft-ietf-sacm-information-model#21, which is seeking to get
>> feedback on what a useful term other than identity might be. The present
>> candidate seems to be designate. So, instead of "identify an endpoint" we
>> would "designate an endpoint" or "collect AVPs from the designated set of
>> endpoints".
>>
>> I also wouldn't go so far as to say that we're performing pervasive
>> monitoring in the sense that mainstream media understands the term. Our
>> scope has always been single-enterprise, and it remains that way.
>>
>> Again, privacy is important, but I don't think we're talking about PII as
>> much as might be implied by our choice of terms.
>>
>> —
>> Reply to this email directly or view it on GitHub.
>>
>>
>>
>> _______________________________________________
>> sacm mailing list
>> sacm@ietf.org
>> https://www.ietf.org/mailman/listinfo/sacm
>>
>>
>> --
>>
>>
>> ********************************************************
>> Ron Colvin CISSP, CAP, CEH
>> Certified Security Analyst
>> NASA - Goddard Space Flight Center
>> <ron.colvin@nasa.gov>
>> Direct phone 301-286-2451
>> NASA Jabber (rdcolvin@im.nasa.gov) AIM rcolvin13
>> NASA LCS (ronald.d.colvin@nasa.gov)
>> ********************************************************
>>
>>
>> _______________________________________________
>> sacm mailing list
>> sacm@ietf.org
>> https://www.ietf.org/mailman/listinfo/sacm
>>
>
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
>

-- 

Best regards,
Kathleen