Re: [secdir] Discussion from the Security Directorate

[Tina <[e-mail]>]

Hi Fred and David,
The slides were sent to OPS ADs, and we discussed it a bit in OPS-DIR  
work lunch on Monday. According to the suggestion from Dan, I  
forwarded the slides to the WG chairs of v6ops and opsec.

Then Fred forwarded to SEC-DIR.

I mentioned Fred's email during SEC-DIR work lunch on Tuesday. There  
was discussion.

I went to Tuesday v6ops session before my slides were taken. Then I  
left for some personal emergency reasons. Therefore I was not able to  
present the slides. But Fred did it.

The slides will be presented in OPS Area Opening meeting in the Large  
Stage between 15:10 to 16:10.


B. R.
Tina
http://tinatsou.weebly.com/contact.html


On Jul 29, 2009, at 5:04 PM, Fred Baker wrote:

> It was presented to the ops directorate as "from the security  
> directorate" on Monday, and shipped off to my working group.
>
> OK, Tina, over to you...
>
> On Jul 29, 2009, at 11:30 AM, David Harrington wrote:
>
>> Hi,
>>
>> I have a question.
>> I am a member of the Security Directorate, and I do not remember any
>> discussion leading to this powerpoint presentation or request. I may
>> have missed a SECDIR session. I didn't find discussion of this
>> powerpoint presentation in the secdir archives prior to this week.
>>
>> Is this a "Discussion from the Security Directorate"? If so, when was
>> this discussed? Has the SECDIR reviewed this powerpoint slide deck  
>> and
>> approved it being sent to working groups?
>>
>> David Harrington
>> [e-mail]
>> [e-mail]
>> [e-mail]
>>
>>
>>> -----Original Message-----
>>> From: [e-mail]
>>> [mailto:[e-mail]] On Behalf Of Fred Baker
>>> Sent: Tuesday, July 28, 2009 10:49 PM
>>> To: Joel Jaeggli
>>> Cc: 6man Chairs; [e-mail]; [e-mail];
>>> Kurt Erik Lindqvist; Joe Abley; Softwire Chairs;
>>> [e-mail]; [e-mail]; Tina
>>> TSOU; [e-mail]; Behave Chairs
>>> Subject: Re: [secdir] Discussion from the Security Directorate
>>>
>>> I'm not arguing against the request. I'm asking what it is
>>> requesting,
>>> as I have no idea...
>>>
>>> I think I know what a threat analysis is.
>>>
>>> What is a "security assessment" apart from a "threat assessment"? I
>>
>>> told v6ops (which does not develop transition technologies, by
>>> charter, and therefore is the absolute wrong place to send
>>> this) that
>>> I thought it might mean an assessment of how we might mitigate the
>>> threats. Absent any answers from the Security Directorate responsive
>>
>>> to the question, I have no idea whether I was correct.
>>>
>>> And what on God's Green Earth is a "function recommendation"? I have
>>
>>> no idea what you want.
>>>
>>> Nobody from the Security Directorate was there today to deliver the
>>
>>> message. If I were developing a threat assessment of that
>>> protocol...
>>> let's see: delivered to the wrong WG by someone who didn't know what
>>
>>> the message was supposed to be using slides he didn't understand and
>>
>>> the security directorate didn't take the time to explain...
>>>
>>> On Jul 27, 2009, at 2:08 PM, Joel Jaeggli wrote:
>>>
>>>> I'd probably tune the slides a bit still:
>>>>
>>>> 	Security problems show up in deployment and use, these cannot
>> be
>>>> 	thought out at all when designing the protocols
>>>>
>>>> Is an assertion you'll get pushback on. we have signficant
>>> operational
>>>> experience with variations on many of the proposed or deployed
>>>> transition mechanisms. necessarily that experience informs both
>> our
>>>> current thinking and the desirability of any particular approach.
>>>>
>>>> bump in the wire type transition technologies certainly are an
>> area
>>>> potential concern for opsec
>>>>
>>>> Fred Baker wrote:
>>>>> Thanks, Tina. I will add this to the IPv6 Operations
>>> agenda, probably
>>>>> during our second session Tuesday.
>>>>>
>>>>> You will note that I am copying the chairs and ADs from several
>>>>> working
>>>>> groups. The reason is that the primary thrust of the
>>> comments you are
>>>>> making apply to work being done in those working groups. Slide 5
>>>>> specifically requests a threat analysis, security assessment, and
>>>>> "function recommendation" on each transition technology;
>>> these are in
>>>>> fact being done in behave and softwires. I mention 6man because
>>>>> marketing blather from the IPv6 form makes security claims
>>> for IPv6,
>>>>> which it would be good if that working group clarified.
>>>>>
>>>>> I do have to ask specifically what the Security
>>> Directorate hopes to
>>>>> find in the three documents that have been requested for each of
>>
>>>>> these
>>>>> various technologies. What, specifically, is a "function
>>>>> recommendation"? A threat analysis is a statement that
>>> there exist
>>>>> a set
>>>>> of possible threats. Is a security assessment a statement about
>> how
>>>>> those threats are responded to? What, if the WGs don't
>>> produce it, is
>>>>> going to leave the Security Directorate feeling ill-used?
>>>>>
>>>>> On Jul 27, 2009, at 12:56 PM, Tina TSOU wrote:
>>>>>
>>>>>>
>>>>>> B. R.
>>>>>> ">http://tinatsou.weebly.com/contact.html
>>>>>
>>>>>> Begin forwarded message:
>>>>>>
>>>>>>> From: "Romascanu, Dan (Dan)" <[e-mail]>
>>>>>>> Date: July 27, 2009 7:52:20 AM GMT+02:00
>>>>>>> To: Ron Bonica <[e-mail]>
>>>>>>> Cc: Tina TSOU <[e-mail]>
>>>>>>> Subject: FW: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>>>
>>>>>>> Ron,
>>>>>>>
>>>>>>> This looks more like an opsec (who are not meeting this
>>> time) or
>>>>>>> v6ops
>>>>>>> subject.
>>>>>>>
>>>>>>> Dan
>>>>>>>
>>>>>>>
>>>>>>> -----Original Message-----
>>>>>>> From: Tina TSOU [mailto:[e-mail]]
>>>>>>> Sent: Monday, July 27, 2009 12:02 AM
>>>>>>> To: Romascanu, Dan (Dan)
>>>>>>> Subject: Re: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>>>
>>>>>>> Hi Dan,
>>>>>>> Could this be discussed at OPS-DIR working lunch?
>>>>>> <Recommendation of IPv6 Security work--on the flight-2.ppt>
>>>>>> <ATT4180184.txt>
>>>>>>
>>>
>>> _______________________________________________
>>> secdir mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/secdir
>>>
>>
>