Re: [secdir] Discussion from the Security Directorate

["David Harrington" <[e-mail]>]

Hi,

I have a question. 
I am a member of the Security Directorate, and I do not remember any
discussion leading to this powerpoint presentation or request. I may
have missed a SECDIR session. I didn't find discussion of this
powerpoint presentation in the secdir archives prior to this week. 

Is this a "Discussion from the Security Directorate"? If so, when was
this discussed? Has the SECDIR reviewed this powerpoint slide deck and
approved it being sent to working groups?

David Harrington
[e-mail]
[e-mail]
[e-mail]


> -----Original Message-----
> From: [e-mail] 
> [mailto:[e-mail]] On Behalf Of Fred Baker
> Sent: Tuesday, July 28, 2009 10:49 PM
> To: Joel Jaeggli
> Cc: 6man Chairs; [e-mail]; [e-mail]; 
> Kurt Erik Lindqvist; Joe Abley; Softwire Chairs; 
> [e-mail]; [e-mail]; Tina 
> TSOU; [e-mail]; Behave Chairs
> Subject: Re: [secdir] Discussion from the Security Directorate
> 
> I'm not arguing against the request. I'm asking what it is 
> requesting,  
> as I have no idea...
> 
> I think I know what a threat analysis is.
> 
> What is a "security assessment" apart from a "threat assessment"? I

> told v6ops (which does not develop transition technologies, by  
> charter, and therefore is the absolute wrong place to send 
> this) that  
> I thought it might mean an assessment of how we might mitigate the  
> threats. Absent any answers from the Security Directorate responsive

> to the question, I have no idea whether I was correct.
> 
> And what on God's Green Earth is a "function recommendation"? I have

> no idea what you want.
> 
> Nobody from the Security Directorate was there today to deliver the

> message. If I were developing a threat assessment of that 
> protocol...  
> let's see: delivered to the wrong WG by someone who didn't know what

> the message was supposed to be using slides he didn't understand and

> the security directorate didn't take the time to explain...
> 
> On Jul 27, 2009, at 2:08 PM, Joel Jaeggli wrote:
> 
> > I'd probably tune the slides a bit still:
> >
> > 	Security problems show up in deployment and use, these cannot
be
> > 	thought out at all when designing the protocols
> >
> > Is an assertion you'll get pushback on. we have signficant 
> operational
> > experience with variations on many of the proposed or deployed
> > transition mechanisms. necessarily that experience informs both
our
> > current thinking and the desirability of any particular approach.
> >
> > bump in the wire type transition technologies certainly are an
area
> > potential concern for opsec
> >
> > Fred Baker wrote:
> >> Thanks, Tina. I will add this to the IPv6 Operations 
> agenda, probably
> >> during our second session Tuesday.
> >>
> >> You will note that I am copying the chairs and ADs from several  
> >> working
> >> groups. The reason is that the primary thrust of the 
> comments you are
> >> making apply to work being done in those working groups. Slide 5
> >> specifically requests a threat analysis, security assessment, and
> >> "function recommendation" on each transition technology; 
> these are in
> >> fact being done in behave and softwires. I mention 6man because
> >> marketing blather from the IPv6 form makes security claims 
> for IPv6,
> >> which it would be good if that working group clarified.
> >>
> >> I do have to ask specifically what the Security 
> Directorate hopes to
> >> find in the three documents that have been requested for each of

> >> these
> >> various technologies. What, specifically, is a "function
> >> recommendation"? A threat analysis is a statement that 
> there exist  
> >> a set
> >> of possible threats. Is a security assessment a statement about
how
> >> those threats are responded to? What, if the WGs don't 
> produce it, is
> >> going to leave the Security Directorate feeling ill-used?
> >>
> >> On Jul 27, 2009, at 12:56 PM, Tina TSOU wrote:
> >>
> >>>
> >>> B. R.
> >>> ">http://tinatsou.weebly.com/contact.html
> >>
> >>> Begin forwarded message:
> >>>
> >>>> From: "Romascanu, Dan (Dan)" <[e-mail]>
> >>>> Date: July 27, 2009 7:52:20 AM GMT+02:00
> >>>> To: Ron Bonica <[e-mail]>
> >>>> Cc: Tina TSOU <[e-mail]>
> >>>> Subject: FW: [OPS-DIR] Reminder: OPS-DIR working lunch
> >>>>
> >>>> Ron,
> >>>>
> >>>> This looks more like an opsec (who are not meeting this 
> time) or  
> >>>> v6ops
> >>>> subject.
> >>>>
> >>>> Dan
> >>>>
> >>>>
> >>>> -----Original Message-----
> >>>> From: Tina TSOU [mailto:[e-mail]]
> >>>> Sent: Monday, July 27, 2009 12:02 AM
> >>>> To: Romascanu, Dan (Dan)
> >>>> Subject: Re: [OPS-DIR] Reminder: OPS-DIR working lunch
> >>>>
> >>>> Hi Dan,
> >>>> Could this be discussed at OPS-DIR working lunch?
> >>> <Recommendation of IPv6 Security work--on the flight-2.ppt>
> >>> <ATT4180184.txt>
> >>>
> 
> _______________________________________________
> secdir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdir
>