Re: [secdir] Discussion from the Security Directorate

[Fred Baker <[e-mail]>]

who is "we"?

I would suggest that you make your request to the chairs of the  
various working groups doing the work. These include 6man (designated  
custodian of all things IPv6 and therefore of RFCs 3053, 3056, 4213,  
and 5214), behave (translation), and softwire (tunnels).

On Jul 29, 2009, at 8:45 PM, Tina wrote:

> Hi again:)
> Some clarifications for the slides.
>
> a. security assessment, to evaluate the security of a transition  
> technology. What aspects do we need to judge and consider?
> b. function recommendation, to reduce the security threat of some  
> kind of transition technology. When deploy this technology, what  
> functionalities should the device need to have?
>
>
> B. R.
> Tina
> http://tinatsou.weebly.com/contact.html
>
>
>
> On Jul 29, 2009, at 5:23 PM, Tina wrote:
>
>> Hi Fred and David,
>> The slides were sent to OPS ADs, and we discussed it a bit in OPS- 
>> DIR work lunch on Monday. According to the suggestion from Dan, I  
>> forwarded the slides to the WG chairs of v6ops and opsec.
>>
>> Then Fred forwarded to SEC-DIR.
>>
>> I mentioned Fred's email during SEC-DIR work lunch on Tuesday.  
>> There was discussion.
>>
>> I went to Tuesday v6ops session before my slides were taken. Then I  
>> left for some personal emergency reasons. Therefore I was not able  
>> to present the slides. But Fred did it.
>>
>> The slides will be presented in OPS Area Opening meeting in the  
>> Large Stage between 15:10 to 16:10.
>>
>>
>> B. R.
>> Tina
>> http://tinatsou.weebly.com/contact.html
>>
>>
>> On Jul 29, 2009, at 5:04 PM, Fred Baker wrote:
>>
>>> It was presented to the ops directorate as "from the security  
>>> directorate" on Monday, and shipped off to my working group.
>>>
>>> OK, Tina, over to you...
>>>
>>> On Jul 29, 2009, at 11:30 AM, David Harrington wrote:
>>>
>>>> Hi,
>>>>
>>>> I have a question.
>>>> I am a member of the Security Directorate, and I do not remember  
>>>> any
>>>> discussion leading to this powerpoint presentation or request. I  
>>>> may
>>>> have missed a SECDIR session. I didn't find discussion of this
>>>> powerpoint presentation in the secdir archives prior to this week.
>>>>
>>>> Is this a "Discussion from the Security Directorate"? If so, when  
>>>> was
>>>> this discussed? Has the SECDIR reviewed this powerpoint slide  
>>>> deck and
>>>> approved it being sent to working groups?
>>>>
>>>> David Harrington
>>>> [e-mail]
>>>> [e-mail]
>>>> [e-mail]
>>>>
>>>>
>>>>> -----Original Message-----
>>>>> From: [e-mail]
>>>>> [mailto:[e-mail]] On Behalf Of Fred Baker
>>>>> Sent: Tuesday, July 28, 2009 10:49 PM
>>>>> To: Joel Jaeggli
>>>>> Cc: 6man Chairs; [e-mail]; [e-mail];
>>>>> Kurt Erik Lindqvist; Joe Abley; Softwire Chairs;
>>>>> [e-mail]; [e-mail]; Tina
>>>>> TSOU; [e-mail]; Behave Chairs
>>>>> Subject: Re: [secdir] Discussion from the Security Directorate
>>>>>
>>>>> I'm not arguing against the request. I'm asking what it is
>>>>> requesting,
>>>>> as I have no idea...
>>>>>
>>>>> I think I know what a threat analysis is.
>>>>>
>>>>> What is a "security assessment" apart from a "threat  
>>>>> assessment"? I
>>>>
>>>>> told v6ops (which does not develop transition technologies, by
>>>>> charter, and therefore is the absolute wrong place to send
>>>>> this) that
>>>>> I thought it might mean an assessment of how we might mitigate the
>>>>> threats. Absent any answers from the Security Directorate  
>>>>> responsive
>>>>
>>>>> to the question, I have no idea whether I was correct.
>>>>>
>>>>> And what on God's Green Earth is a "function recommendation"? I  
>>>>> have
>>>>
>>>>> no idea what you want.
>>>>>
>>>>> Nobody from the Security Directorate was there today to deliver  
>>>>> the
>>>>
>>>>> message. If I were developing a threat assessment of that
>>>>> protocol...
>>>>> let's see: delivered to the wrong WG by someone who didn't know  
>>>>> what
>>>>
>>>>> the message was supposed to be using slides he didn't understand  
>>>>> and
>>>>
>>>>> the security directorate didn't take the time to explain...
>>>>>
>>>>> On Jul 27, 2009, at 2:08 PM, Joel Jaeggli wrote:
>>>>>
>>>>>> I'd probably tune the slides a bit still:
>>>>>>
>>>>>> 	Security problems show up in deployment and use, these cannot
>>>> be
>>>>>> 	thought out at all when designing the protocols
>>>>>>
>>>>>> Is an assertion you'll get pushback on. we have signficant
>>>>> operational
>>>>>> experience with variations on many of the proposed or deployed
>>>>>> transition mechanisms. necessarily that experience informs both
>>>> our
>>>>>> current thinking and the desirability of any particular approach.
>>>>>>
>>>>>> bump in the wire type transition technologies certainly are an
>>>> area
>>>>>> potential concern for opsec
>>>>>>
>>>>>> Fred Baker wrote:
>>>>>>> Thanks, Tina. I will add this to the IPv6 Operations
>>>>> agenda, probably
>>>>>>> during our second session Tuesday.
>>>>>>>
>>>>>>> You will note that I am copying the chairs and ADs from several
>>>>>>> working
>>>>>>> groups. The reason is that the primary thrust of the
>>>>> comments you are
>>>>>>> making apply to work being done in those working groups. Slide 5
>>>>>>> specifically requests a threat analysis, security assessment,  
>>>>>>> and
>>>>>>> "function recommendation" on each transition technology;
>>>>> these are in
>>>>>>> fact being done in behave and softwires. I mention 6man because
>>>>>>> marketing blather from the IPv6 form makes security claims
>>>>> for IPv6,
>>>>>>> which it would be good if that working group clarified.
>>>>>>>
>>>>>>> I do have to ask specifically what the Security
>>>>> Directorate hopes to
>>>>>>> find in the three documents that have been requested for each of
>>>>
>>>>>>> these
>>>>>>> various technologies. What, specifically, is a "function
>>>>>>> recommendation"? A threat analysis is a statement that
>>>>> there exist
>>>>>>> a set
>>>>>>> of possible threats. Is a security assessment a statement about
>>>> how
>>>>>>> those threats are responded to? What, if the WGs don't
>>>>> produce it, is
>>>>>>> going to leave the Security Directorate feeling ill-used?
>>>>>>>
>>>>>>> On Jul 27, 2009, at 12:56 PM, Tina TSOU wrote:
>>>>>>>
>>>>>>>>
>>>>>>>> B. R.
>>>>>>>> ">http://tinatsou.weebly.com/contact.html
>>>>>>>
>>>>>>>> Begin forwarded message:
>>>>>>>>
>>>>>>>>> From: "Romascanu, Dan (Dan)" <[e-mail]>
>>>>>>>>> Date: July 27, 2009 7:52:20 AM GMT+02:00
>>>>>>>>> To: Ron Bonica <[e-mail]>
>>>>>>>>> Cc: Tina TSOU <[e-mail]>
>>>>>>>>> Subject: FW: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>>>>>
>>>>>>>>> Ron,
>>>>>>>>>
>>>>>>>>> This looks more like an opsec (who are not meeting this
>>>>> time) or
>>>>>>>>> v6ops
>>>>>>>>> subject.
>>>>>>>>>
>>>>>>>>> Dan
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> -----Original Message-----
>>>>>>>>> From: Tina TSOU [mailto:[e-mail]]
>>>>>>>>> Sent: Monday, July 27, 2009 12:02 AM
>>>>>>>>> To: Romascanu, Dan (Dan)
>>>>>>>>> Subject: Re: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>>>>>
>>>>>>>>> Hi Dan,
>>>>>>>>> Could this be discussed at OPS-DIR working lunch?
>>>>>>>> <Recommendation of IPv6 Security work--on the flight-2.ppt>
>>>>>>>> <ATT4180184.txt>
>>>>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> secdir mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/secdir
>>>>>
>>>>
>>>
>>
>