Re: [secdir] Feedback about secdir reviews

[David Harrington <[e-mail]>]

Hi,

I made some assumptions from that feedback during the IESG meeting given
my experiences in non-sec areas.
Many secdir reviewers have a strong security background, but the authors
of reviewed documents don't necessarily have the same level of grokking
security.
Authors may not grok "authn+authz+integrity+confidentiality+access
control+..."
Authors certainly may not know the best current practices for achieving
authn [+authz] [+integrity] [+confidentiality] ...
There is an RFC to explain how to write a security considerations section
but the security considerations section example is HUGE - multi-pages of
discussion.
It might be really helpful to have a wiki that discusses common problems
in security reviews, plus some suggestions of how to solve the common
problems.
And I recommend the wiki be updated as new problems are run across in
document reviews.
Being able to point authors to such a wiki might help.

There is still the issue of the authors and Wgs not grokking security.
Soemtimes the right answer is that the draft looks like it might have
security issues, but actually doesn't introduce any new security problems,
and a security person may be able to reach that conclusion fairly easily.
But somebody that does not grok security needs to go learn all about
security and trust domains and possible protocols and cryptosuites and so
on to reach the same conclusion.
They need advisors to help them work through the issues that may or may
not be a problem.

The authors of raqmon got a review that said they had issues to consider.
It took something like eight months (IIRC) for them to learn about and
consider each issue and determine that the problems cited in the review
really didn't exist for their protocol spec.
That leaves a pretty bad taste in people's mouths.

My $.02
--
David Harrington
Director, Transport Area
Internet Engineering Task Force (IETF)
[e-mail]
[phone]





On 3/26/12 3:58 AM, "Stephen Farrell" <[e-mail]> wrote:

>
>Hi all,
>
>The IESG got some anonymized feedback today from the nomcom
>process.
>
>Part of that was that authors were unsure as to how to react
>to secdir reviews. And in particular, as to whether or not
>to engage with the secdir reviewer.
>
>I know we have some boilerplate [1] that tries to handle this,
>but it might be worth taking another look at that to see if
>we can make it better.
>
>Something for the lunchtime session on Tuesday.
>
>Cheers,
>S.
>
>[1] http://trac.tools.ietf.org/area/sec/trac/wiki/SecDirReview
>_______________________________________________
>secdir mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/secdir
>wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview