Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)

Hi all,

I completely agree that our privacy considerations need to explicitly call out these issues and provide guidance that this information needs to be protected as any other PII would be protected.  

Rather than SACM getting into the details of what comprises that protection, I'd rather see us refer out to the work that's already been done by many other groups in characterizing that protection - such the two Kathleen mentions here, RFC6973 (great resource, thank you!) and the IAB statement, and possibly resources from other standards bodies such as the NIST guide to protecting PII (http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf - see http://csrc.nist.gov/publications/nistbul/april-2010_guide-protecting-pii.pdf for a summary).  No point in re-inventing the wheel when we can point to someone else's wheel instead. :)

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:sacm-bounces@ietf.org] On Behalf Of Kathleen Moriarty
Sent: Friday, August 07, 2015 11:35 AM
To: Ira McDonald <blueroofmusic@gmail.com>
Cc: sacmwg/draft-ietf-sacm-requirements <draft-ietf-sacm-requirements@noreply.github.com>; sacmwg/draft-ietf-sacm-requirements <reply+00a6c4d1129080622850c5e27de14219f5265ff1c931c67092cf0000000111dc5ac392a169ce05cd0b75@reply.github.com>; sacm <sacm@ietf.org>; Ron.Colvin@nasa.gov
Subject: Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)

Hello,

This is a good discussion and it seems that it is getting to the right set of points, that we do need to worry about index data and ways to correlate information back to systems and possibly to users of those systems or whose data crosses those systems.

Jim is right on the PM angle, but you can phrase this lots of ways.
In terms of privacy, we worry about indexes, anything considered sensitive that requires confidentiality related to privacy, and PII.
There are lots of ways to handle this and that will be up to the WG to decide how to provide such guidance.  We do have materials to help you from the view of developing protocols.

Here are some links from a slide I've been using in presentations (please do read the RFC listed, it's very helpful):
IETF Privacy Considerations for Internet protocols
  –https://datatracker.ietf.org/doc/rfc6973/
  –Data protection
     ▪Object level encryption
     ▪Determining when data is not necessary
     ▪Obscuring data or generalizing when possible
     ▪Protections on sensitive data and indexes to that data
  –Push for encrypted traffic
IAB Statement on Internet Confidentiality
  –https://www.iab.org/2014/11/14/iab-statement-on-internet-confidentiality/

Pervasive Monitoring is an Attack
  –RFC7258/BCP188 published after major IETF LC debate – sets the basis for further actions
  –https://www.rfc-editor.org/rfc/rfc7258.txt

In case you missed the tech plenary for IETF88 and you prefer video over reading (or in addition), this was a great plenary that gives background into these considerations for the IETF:
http://www.ietf.org/live/ietf88/text.html

Unofficial stuff:
Blog from Snowden Q&A in Prague:
https://www.mnot.net/blog/2015/07/20/snowden_meets_the_ietf

If you missed the Snowden Q&A on Sunday of Prague, here is a link:
https://www.youtube.com/watch?feature=youtu.be&v=0NvsUXBCeVA&app=desktop

We are also working with the IEEE on their privacy work.  This includes work to ensure MAC addresses can't be used to identify hosts (and thus users of the hosts).

Thanks,
Kathleen

On Fri, Aug 7, 2015 at 10:51 AM, Ira McDonald <blueroofmusic@gmail.com> wrote:
> Hi,
>
> When an enterprise network is breached by an outside attacker (using "if"
> no longer seems appropriate) or is compromised by an inside attacker, 
> the SACM components that have datastores of devices and associated 
> identity info as well as (often) associated user identities are 
> high-value targets of attacks for bulk theft of PII.
>
> By its fundamental nature, SACM increases the threat of exposure of 
> PII and therefore should address anonymization of individual device 
> identity info and strong controls on the dissemination of that info to subscribers.
>
> Cheers,
> - Ira
>
>
> Ira McDonald (Musician / Software Architect) Co-Chair - TCG Trusted 
> Mobility Solutions WG Chair - Linux Foundation Open Printing WG 
> Secretary - IEEE-ISTO Printer Working Group Co-Chair - IEEE-ISTO PWG 
> Internet Printing Protocol WG IETF Designated Expert - IPP & Printer 
> MIB Blue Roof Music / High North Inc 
> http://sites.google.com/site/blueroofmusic
> http://sites.google.com/site/highnorthinc
> mailto: blueroofmusic@gmail.com
> Winter  579 Park Place  Saline, MI  48176  734-944-0094 Summer  PO Box 
> 221  Grand Marais, MI 49839  906-494-2434
>
>
> On Fri, Aug 7, 2015 at 10:01 AM, Ron Colvin <Ron.Colvin@nasa.gov> wrote:
>>
>> My understanding on PII is that as soon as I associate a person with 
>> an email address, phone number or physical address I have PII that I 
>> need to protect. If we associate a user id, account or user 
>> provisioned PKI with a device including possibly a MAC address we probably have the same concerns.
>>
>> I think in many cases user certificates are used for device 
>> authentication and I thought that was an attribute that was highly desirable.
>>
>>
>> On 8/7/15 7:38 AM, adammontville wrote:
>>
>> I agree that privacy needs to be covered.
>>
>> Still, when we talk about identity or identification in this working 
>> group, we're talking about something different than PII data. As 
>> such, there's this other issue for the information model 
>> sacmwg/draft-ietf-sacm-information-model#21, which is seeking to get 
>> feedback on what a useful term other than identity might be. The 
>> present candidate seems to be designate. So, instead of "identify an 
>> endpoint" we would "designate an endpoint" or "collect AVPs from the 
>> designated set of endpoints".
>>
>> I also wouldn't go so far as to say that we're performing pervasive 
>> monitoring in the sense that mainstream media understands the term. 
>> Our scope has always been single-enterprise, and it remains that way.
>>
>> Again, privacy is important, but I don't think we're talking about 
>> PII as much as might be implied by our choice of terms.
>>
>> —
>> Reply to this email directly or view it on GitHub.
>>
>>
>>
>> _______________________________________________
>> sacm mailing list
>> sacm@ietf.org
>> https://www.ietf.org/mailman/listinfo/sacm
>>
>>
>> --
>>
>>
>> ********************************************************
>> Ron Colvin CISSP, CAP, CEH
>> Certified Security Analyst
>> NASA - Goddard Space Flight Center
>> <ron.colvin@nasa.gov>
>> Direct phone 301-286-2451
>> NASA Jabber (rdcolvin@im.nasa.gov) AIM rcolvin13 NASA LCS 
>> (ronald.d.colvin@nasa.gov)
>> ********************************************************
>>
>>
>> _______________________________________________
>> sacm mailing list
>> sacm@ietf.org
>> https://www.ietf.org/mailman/listinfo/sacm
>>
>
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
>

-- 

Best regards,
Kathleen

_______________________________________________
sacm mailing list
sacm@ietf.org
https://www.ietf.org/mailman/listinfo/sacm