Re: [sacm] minor comments on draft-lin-sacm-nid-mp-security-baseline-03

[Jarrett Lu <[e-mail]>]

On 7/23/18 11:01 AM, Benjamin Kaduk wrote:
> During Jessica's talk I noticed a couple things I wanted to mention, but
> that didn't seem to merit getting up to the mic:
>
> There's a container for 'telnet' admin access; my understanding is that
> there are not any applications out there that could be called "telnet" and
> are actually secure these days (but maybe I'm missing some!); e.g.,
> kerberized telnet mostly only uses single-DES and a lousy cipher mode, with
> a vendor-specific option for triple-DES, which is deprecated as of my
> document that's currently at the RFC Editor.  So we may want to have some
> text clarifying the situation and disrecommending its use (or even remove
> it entirely, if that's feasible).

I agree 'telnet' is insecure and is often disabled by default in many 
enterprise
environments. I wonder if it's simpler for the draft authors to consider 
replacing
'telnet' with 'ssh' which is secure. 'ssh' should meet the "remote admin 
access"
requirement.

>
> Similarly, there's a pwd-sec-policy container that describes password
> security policies.  While it's definitely true that password policies and
> mandatory change intervals are currently widely deployed, it's less clear
> whether their usage should still be considered useful or a best current
> practice -- I think I've seen some research go by that suggests that not
> requiring character classes or frequency of change can be just as secure
> (and, of course, if passwords can be avoided entirely that can also help).
> So, perhaps there is room for some qualifying text here as well.

I also recall reading a publication which argues against forcing users 
to change passwd
frequently (I vaguely recall it's a NIST document but can't be sure). 
Some security tools
company like CyberArk manage periodic passwd changes in their tools so 
that users
don't need to do that.

- Jarrett

>
> -Ben
> (with no hats)
>
> _______________________________________________
> sacm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sacm