Re: [secdir] Discussion from the Security Directorate

[Joel Jaeggli <[e-mail]>]

Fred Baker wrote:
> I'm not arguing against the request. I'm asking what it is requesting,
> as I have no idea...
> 
> I think I know what a threat analysis is.
> 
> What is a "security assessment" apart from a "threat assessment"? I told
> v6ops (which does not develop transition technologies, by charter, and
> therefore is the absolute wrong place to send this) that I thought it
> might mean an assessment of how we might mitigate the threats. Absent
> any answers from the Security Directorate responsive to the question, I
> have no idea whether I was correct.

I don't get the warm fuzzy impression that what the security directorate
 was attempting to communicate was conveyed.

If the cpe security discussion in v6 ops underscores anything it's the
compromise that we arrived at in ipv4 with 30 years worth of
intellectual ferment where desirable or un, is quite hard to arrive at
by deliberate intention.

> And what on God's Green Earth is a "function recommendation"? I have no
> idea what you want.
> 
> Nobody from the Security Directorate was there today to deliver the
> message. If I were developing a threat assessment of that protocol...
> let's see: delivered to the wrong WG by someone who didn't know what the
> message was supposed to be using slides he didn't understand and the
> security directorate didn't take the time to explain...
> 
> On Jul 27, 2009, at 2:08 PM, Joel Jaeggli wrote:
> 
>> I'd probably tune the slides a bit still:
>>
>>     Security problems show up in deployment and use, these cannot be
>>     thought out at all when designing the protocols
>>
>> Is an assertion you'll get pushback on. we have signficant operational
>> experience with variations on many of the proposed or deployed
>> transition mechanisms. necessarily that experience informs both our
>> current thinking and the desirability of any particular approach.
>>
>> bump in the wire type transition technologies certainly are an area
>> potential concern for opsec
>>
>> Fred Baker wrote:
>>> Thanks, Tina. I will add this to the IPv6 Operations agenda, probably
>>> during our second session Tuesday.
>>>
>>> You will note that I am copying the chairs and ADs from several working
>>> groups. The reason is that the primary thrust of the comments you are
>>> making apply to work being done in those working groups. Slide 5
>>> specifically requests a threat analysis, security assessment, and
>>> "function recommendation" on each transition technology; these are in
>>> fact being done in behave and softwires. I mention 6man because
>>> marketing blather from the IPv6 form makes security claims for IPv6,
>>> which it would be good if that working group clarified.
>>>
>>> I do have to ask specifically what the Security Directorate hopes to
>>> find in the three documents that have been requested for each of these
>>> various technologies. What, specifically, is a "function
>>> recommendation"? A threat analysis is a statement that there exist a set
>>> of possible threats. Is a security assessment a statement about how
>>> those threats are responded to? What, if the WGs don't produce it, is
>>> going to leave the Security Directorate feeling ill-used?
>>>
>>> On Jul 27, 2009, at 12:56 PM, Tina TSOU wrote:
>>>
>>>>
>>>> B. R.
>>>> ">http://tinatsou.weebly.com/contact.html
>>>
>>>> Begin forwarded message:
>>>>
>>>>> From: "Romascanu, Dan (Dan)" <[e-mail]>
>>>>> Date: July 27, 2009 7:52:20 AM GMT+02:00
>>>>> To: Ron Bonica <[e-mail]>
>>>>> Cc: Tina TSOU <[e-mail]>
>>>>> Subject: FW: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>
>>>>> Ron,
>>>>>
>>>>> This looks more like an opsec (who are not meeting this time) or v6ops
>>>>> subject.
>>>>>
>>>>> Dan
>>>>>
>>>>>
>>>>> -----Original Message-----
>>>>> From: Tina TSOU [mailto:[e-mail]]
>>>>> Sent: Monday, July 27, 2009 12:02 AM
>>>>> To: Romascanu, Dan (Dan)
>>>>> Subject: Re: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>
>>>>> Hi Dan,
>>>>> Could this be discussed at OPS-DIR working lunch?
>>>> <Recommendation of IPv6 Security work--on the flight-2.ppt>
>>>> <ATT4180184.txt>
>>>>
>