Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)

[dromasca <[e-mail]>]

Hi,

This looks good, but I have a clarification question. What does ‘filtering requirements at the data model MUST be applied’ mean? We already have OP-005 which states that ‘The query operation MUST support filtering’. Why do we need another capitalized MUST? Or do we have something else in mind?

Thanks and Regards,

Dan


From: Nancy [mailto:[e-mail]]
Sent: Tuesday, September 29, 2015 12:50 AM
To: sacmwg/draft-ietf-sacm-requirements
Subject: Re: [draft-ietf-sacm-requirements] Do we need a privacy section (#55)


Wow, this has been a good discussion. Given that this is a requirements draft, I'm not sure how much information we need to provide (RFC 6973 is a good base to recommend). So here is a proposed new section to address some of this (please comment so that I can place into the next version):

5.2. Privacy Considerations
SACM information may contain sensitive information about the target
endpoint as well as revealing identity information of the producer or
consumer of such information. Similarly, as part of the SACM
discovery mechanism, the advertised capabilities (and roles, e.g.
SACM components enabled) by the endpoint may be construed as private
information. There may be applications as well as business and
regulatory practicess that require that aspects of such information
be hidden from any parties that do not need to know it.

Data confidentiality can provide some level of privacy but may fall
short where unecessary data is still transmitted. In those cases,
filtering requirements at the data model MUST be applied to ensure
that such data is not disclosed. [RFC6973] provides guidelines for
which SACM protocols and information and data models should follow.

Comments? - Nancy

—
Reply to this email directly or view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_sacmwg_draft-2Dietf-2Dsacm-2Drequirements_issues_55-23issuecomment-2D143883721&d=BQMCaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=hrq1G9WeSgCouO44QrxIXe1nGJpwyhNtHF8RM-QqEcA&s=rfaqlB3q6Mk05_NupcV1d66o8iCrCN_1qMRshljzO3c&e=>.


---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/55#issuecomment-143981529