Re: [secdir] Review of draft-ietf-xcon-common-data-model-23.txt

[Tero Kivinen <[e-mail]>]

Oscar Novo writes:
> The authors of this document understand the Security considerations
> as a general guidelines for the implementers, rather than a set of
> absolute requirement for this specification. It might be the case in
> some particular scenarios where the confidentiality can be ignored.
> For this reason, we decided not to impose confidentiality (using
> SHOULD instead of MUST) in the document and to leave that decision
> to the administrator of the conference.

I can understand that, and I agree that on some scenarios the
confidentiality can be ignored. But I do think that is the case when
the database actually holds confidential information like passwords. I
would be happy for text saying that if database has no confidential
information then confidentiality may be ignored, but if in most cases
I think it does include confidential information and then it needs to
be protected.

Anyways I think this is to point the fact out to iesg, they can decide
whether it is appropriate or not. Usually protocols have required
confidentiality when there are tihngs like passwords to be protected.

> The same reason applies to the definition in this document of
> 'private elements'. Privacy is a subjective expectation and the
> definition of private elements in the conference depends very much
> on the context of such conference. As you point out, every country,
> company, association or entity would have a completely different
> meaning of privacy. For this reason, we just decided to suggest some
> control and integrity of the data ( by using access control rules)
> in the security section instead of imposing it:

The current security considerations section does not say anything
about the privacy issue, and I think this is big omission.

I am not sure if any real world requirement can be given, but I think
the security considerations section should point out that the database
has privacy related information stored in it and that should be taken
in to consideration when deciding how the database is protected, and
who has access to it.

The privacy issue also brings up new topic, namely the lifetime of the
data in the database. I do not know whether the entry stays in
database only during the conference, or whether it stays there
forever. For privacy information storing it long times can cause
problems. 
-- 
[e-mail]