Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)

[Kathleen Moriarty <[e-mail]>]

Good discussion and just a note in an effort to help make this easier
for you all.  If you call out any data used as an index or sensitive
data, then offer options for protection (could be leaving that data
out or using role names instead of specific users for instance) and
discuss the need for confidentiality and privacy protections, that
should be enough for the draft.  There may be other considerations
outside of data model elements, so reading the referenced RFCs would
be good as the IETF's use of the word privacy is broader than that of
enterprises.  For SACM, a service provider environment might also be
considered in scope as an "enterprise".

I'll look for this section when doing an AD review and should catch
most things that would come up in the IESG review to help correct them
before it goes on for the following review phase as well.

Thanks,
Kathleen

On Fri, Aug 7, 2015 at 12:14 PM, Lisa Lorenzin
<[e-mail]> wrote:
> Hi all,
>
> I completely agree that our privacy considerations need to explicitly call out these issues and provide guidance that this information needs to be protected as any other PII would be protected.
>
> Rather than SACM getting into the details of what comprises that protection, I'd rather see us refer out to the work that's already been done by many other groups in characterizing that protection - such the two Kathleen mentions here, RFC6973 (great resource, thank you!) and the IAB statement, and possibly resources from other standards bodies such as the NIST guide to protecting PII (http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf - see http://csrc.nist.gov/publications/nistbul/april-2010_guide-protecting-pii.pdf for a summary).  No point in re-inventing the wheel when we can point to someone else's wheel instead. :)
>
> Regards,
> Lisa
>
> -----Original Message-----
> From: sacm [mailto:[e-mail]] On Behalf Of Kathleen Moriarty
> Sent: Friday, August 07, 2015 11:35 AM
> To: Ira McDonald <[e-mail]>
> Cc: sacmwg/draft-ietf-sacm-requirements <[e-mail]>; sacmwg/draft-ietf-sacm-requirements <reply+00a6c4d1129080622850[e-mail]>; sacm <[e-mail]>; [e-mail]
> Subject: Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)
>
> Hello,
>
> This is a good discussion and it seems that it is getting to the right set of points, that we do need to worry about index data and ways to correlate information back to systems and possibly to users of those systems or whose data crosses those systems.
>
> Jim is right on the PM angle, but you can phrase this lots of ways.
> In terms of privacy, we worry about indexes, anything considered sensitive that requires confidentiality related to privacy, and PII.
> There are lots of ways to handle this and that will be up to the WG to decide how to provide such guidance.  We do have materials to help you from the view of developing protocols.
>
> Here are some links from a slide I've been using in presentations (please do read the RFC listed, it's very helpful):
> ŸIETF Privacy Considerations for Internet protocols
>   –https://datatracker.ietf.org/doc/rfc6973/
>   –Data protection
>      ▪Object level encryption
>      ▪Determining when data is not necessary
>      ▪Obscuring data or generalizing when possible
>      ▪Protections on sensitive data and indexes to that data
>   –Push for encrypted traffic
> ŸIAB Statement on Internet Confidentiality
>   –https://www.iab.org/2014/11/14/iab-statement-on-internet-confidentiality/
>
> Pervasive Monitoring is an Attack
>   –RFC7258/BCP188 published after major IETF LC debate – sets the basis for further actions
>   –https://www.rfc-editor.org/rfc/rfc7258.txt
>
> In case you missed the tech plenary for IETF88 and you prefer video over reading (or in addition), this was a great plenary that gives background into these considerations for the IETF:
> http://www.ietf.org/live/ietf88/text.html
>
> Unofficial stuff:
> Blog from Snowden Q&A in Prague:
> https://www.mnot.net/blog/2015/07/20/snowden_meets_the_ietf
>
> If you missed the Snowden Q&A on Sunday of Prague, here is a link:
> https://www.youtube.com/watch?feature=youtu.be&v=0NvsUXBCeVA&app=desktop
>
>
> We are also working with the IEEE on their privacy work.  This includes work to ensure MAC addresses can't be used to identify hosts (and thus users of the hosts).
>
> Thanks,
> Kathleen
>
> On Fri, Aug 7, 2015 at 10:51 AM, Ira McDonald <[e-mail]> wrote:
>> Hi,
>>
>> When an enterprise network is breached by an outside attacker (using "if"
>> no longer seems appropriate) or is compromised by an inside attacker,
>> the SACM components that have datastores of devices and associated
>> identity info as well as (often) associated user identities are
>> high-value targets of attacks for bulk theft of PII.
>>
>> By its fundamental nature, SACM increases the threat of exposure of
>> PII and therefore should address anonymization of individual device
>> identity info and strong controls on the dissemination of that info to subscribers.
>>
>> Cheers,
>> - Ira
>>
>>
>> Ira McDonald (Musician / Software Architect) Co-Chair - TCG Trusted
>> Mobility Solutions WG Chair - Linux Foundation Open Printing WG
>> Secretary - IEEE-ISTO Printer Working Group Co-Chair - IEEE-ISTO PWG
>> Internet Printing Protocol WG IETF Designated Expert - IPP & Printer
>> MIB Blue Roof Music / High North Inc
>> http://sites.google.com/site/blueroofmusic
>> http://sites.google.com/site/highnorthinc
>> mailto: [e-mail]
>> Winter  579 Park Place  Saline, MI  48176  734-944-0094 Summer  PO Box
>> 221  Grand Marais, MI 49839  906-494-2434
>>
>>
>> On Fri, Aug 7, 2015 at 10:01 AM, Ron Colvin <[e-mail]> wrote:
>>>
>>> My understanding on PII is that as soon as I associate a person with
>>> an email address, phone number or physical address I have PII that I
>>> need to protect. If we associate a user id, account or user
>>> provisioned PKI with a device including possibly a MAC address we probably have the same concerns.
>>>
>>> I think in many cases user certificates are used for device
>>> authentication and I thought that was an attribute that was highly desirable.
>>>
>>>
>>> On 8/7/15 7:38 AM, adammontville wrote:
>>>
>>> I agree that privacy needs to be covered.
>>>
>>> Still, when we talk about identity or identification in this working
>>> group, we're talking about something different than PII data. As
>>> such, there's this other issue for the information model
>>> sacmwg/draft-ietf-sacm-information-model#21, which is seeking to get
>>> feedback on what a useful term other than identity might be. The
>>> present candidate seems to be designate. So, instead of "identify an
>>> endpoint" we would "designate an endpoint" or "collect AVPs from the
>>> designated set of endpoints".
>>>
>>> I also wouldn't go so far as to say that we're performing pervasive
>>> monitoring in the sense that mainstream media understands the term.
>>> Our scope has always been single-enterprise, and it remains that way.
>>>
>>> Again, privacy is important, but I don't think we're talking about
>>> PII as much as might be implied by our choice of terms.
>>>
>>> —
>>> Reply to this email directly or view it on GitHub.
>>>
>>>
>>>
>>> _______________________________________________
>>> sacm mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/sacm
>>>
>>>
>>> --
>>>
>>>
>>> ********************************************************
>>> Ron Colvin CISSP, CAP, CEH
>>> Certified Security Analyst
>>> NASA - Goddard Space Flight Center
>>> <[e-mail]>
>>> Direct phone [phone]
>>> NASA Jabber ([e-mail]) AIM rcolvin13 NASA LCS
>>> ([e-mail])
>>> ********************************************************
>>>
>>>
>>> _______________________________________________
>>> sacm mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/sacm
>>>
>>
>>
>> _______________________________________________
>> sacm mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/sacm
>>
>
>
>
> --
>
> Best regards,
> Kathleen
>
> _______________________________________________
> sacm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sacm



-- 

Best regards,
Kathleen