[secdir] secdir review of draft-ietf-opsawg-coman-use-cases-03

[⌘ Matt Miller <[e-mail]>]

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
 These comments were written primarily for the benefit of the security
area directors.  Document editors and WG chairs should treat these
comments just like any other last call comments.

SUMMARY:

This Informational document describes use cases for managing a network
involving constrained devices (e.g., sensors, smart controllers), along
with a discussion on network access and the operational lifecycle of
such devices.  This also covers some situational guidelines and
requirements specific to the discussed use cases.

This document is ready with nits.  My one issue I have might not be
appropriate for this use case document, and my other nits are simply
editorial.


MINOR ISSUE:

There is little mention about data protection within this document, but
is discussed some in [COM-REQ].  However, neither this document nor
[COM-REQ] include any discussion about protecting data as it traverses
networks (e.g., using TLS or DTLS), as far as I can tell.  I assume this
will be covered in greater detail in any Standards Track documents
derived from these documents, but might be worthwhile to at least
mention in the use cases where in-transit data protection needs special
considerations, if not more generally in [COM-REQ].


NITS (not security related):

* RFC7228 is listed as informational, but it probably ought to be
normative.  It seems to me that it's necessary to understand the terms
from RFC7228 in order to understand this document.

* [COM-REQ] is listed as an informational reference, but ought to be
normative.  It seems to me that it's necessary to understand [COM-REQ]
in order to understand this document, at least from a security perspective.

* Throughout the document, the locution "ad-hoc" should be "ad hoc".

* Throughout the document, the phrase "In cases" is almost always (two
out of three) followed by a comma, which seems superfluous.

* In section 1. second paragraph, "type" should be "types" in the phrase
"... the management of a network with constrained devices offers
different type of challenges compared to ...".

* In section 2. last paragraph, "since tend" should be "since they tend"
in the phrase "... are not discussed here since tend to be quite static
and do not typically impose ..."

* In section 4.1. second paragraph, "looses" should be "loses" in the
phrase "... new constrained devices in case the system looses too much
of its structure."

* In section 4.1. second paragraph, "loosing" should be "losing" in the
phrase "... deal with events such as loosing neighbors or being moved to
other locations."


-- 
- m&m

Matt Miller < [e-mail] >
Cisco Systems, Inc.

[COM-REQ] "Management of Networks with Constrained Devices: Problem
Statement and Requirements"
<https://datatracker.ietf.org/doc/draft-ietf-opsawg-coman-probstate-reqs>