[sacm] minor comments on draft-lin-sacm-nid-mp-security-baseline-03

[Benjamin Kaduk <[e-mail]>]

During Jessica's talk I noticed a couple things I wanted to mention, but
that didn't seem to merit getting up to the mic:

There's a container for 'telnet' admin access; my understanding is that
there are not any applications out there that could be called "telnet" and
are actually secure these days (but maybe I'm missing some!); e.g.,
kerberized telnet mostly only uses single-DES and a lousy cipher mode, with
a vendor-specific option for triple-DES, which is deprecated as of my
document that's currently at the RFC Editor.  So we may want to have some
text clarifying the situation and disrecommending its use (or even remove
it entirely, if that's feasible).

Similarly, there's a pwd-sec-policy container that describes password
security policies.  While it's definitely true that password policies and
mandatory change intervals are currently widely deployed, it's less clear
whether their usage should still be considered useful or a best current
practice -- I think I've seen some research go by that suggests that not
requiring character classes or frequency of change can be just as secure
(and, of course, if passwords can be avoided entirely that can also help).
So, perhaps there is room for some qualifying text here as well.

-Ben
(with no hats)