Re: [sacm] minor comments on draft-lin-sacm-nid-mp-security-baseline-03

On Tue, Jul 24, 2018 at 02:24:51AM +0000, Linqiushi (Jessica, CSPL) wrote:
> Hi Ben, Adam and Jarrett,
> 
> Thanks a lot for raising your concerns.
> 
> Please see my comments inline.
> 
> Best Regards,
> Jessica
> 
> -----邮件原件-----
> 发件人: sacm [mailto:sacm-bounces@ietf.org] 代表 Benjamin Kaduk
> 发送时间: 2018年7月24日 2:01
> 收件人: sacm@ietf.org
> 主题: [sacm] minor comments on draft-lin-sacm-nid-mp-security-baseline-03
> 
> > During Jessica's talk I noticed a couple things I wanted to mention, 
> > but that didn't seem to merit getting up to the mic:
> 
> > There's a container for 'telnet' admin access; my understanding is 
> > that there are not any applications out there that could be called 
> > "telnet" and are actually secure these days (but maybe I'm missing
> > some!); e.g., kerberized telnet mostly only uses single-DES and a 
> > lousy cipher mode, with a vendor-specific option for triple-DES, which
> > is deprecated as of my document that's currently at the RFC Editor. 
> > So we may want to have some text clarifying the situation and
> > disrecommending its use (or even remove it entirely, if that's feasible).
> 
> The "telnet" admin access listed in the current draft is not meant to suggest the use of Telnet. In some legacy scenarios that the insecure channel like Telnet has to be used, some configuration such as changing the source port is recommended. We mentioned to disable the insecure channel, but didn't clarify it in details in the draft.
> You're right. The security baseline is intended to be a minimal set of security controls and should be up-to-date. We'll remove it and other similar security controls in the next version of draft. 

That would be fine with me.

> > Similarly, there's a pwd-sec-policy container that describes password
> > security policies.  While it's definitely true that password policies
> > and mandatory change intervals are currently widely deployed, it's
> > less clear whether their usage should still be considered useful or a
> > best current practice -- I think I've seen some research go by that
> > suggests that not requiring character classes or frequency of change
> > can be just as secure (and, of course, if passwords can be avoided entirely that can also help).
> 
> As password security policy is the currently widely deployed mechanisms and devices support it,maybe we can make it optional, such as a feature? 
> Currently the devices support this kind of feature, then it can be checked whether this policy is enabled.

I think that's the sort of thing I had in mind.

Thanks!

-Ben

> >So, perhaps there is room for some qualifying text here as well.
> 
> > -Ben
> > (with no hats)
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm