Re: [secdir] YANG Reviews

[Russ Housley <[e-mail]>]

For MIB modules, we came up with a short list of things or the SecDir Reviewer to do.  This is a quote from an email message in 2007:

> The job of the security reviewers, then, is three-fold: first, to
> verify the existence of the boilerplate; second, to verify the adequacy
> of the explanations given for particular items; third -- and this is
> the hardest -- to scan the document to see if other items should have
> been identified as sensitive but aren't.

The real guidance appears here: http://www.ops.ietf.org/mib-security.html

It would be very helpful if we can come up with an equivalent yang-security.html document.

Russ


> On Jan 8, 2018, at 4:43 PM, Kathleen Moriarty <[e-mail]> wrote:
> 
> Hello,
> 
> We will be seeing many YANG module reviews come through, please don't
> let page counts scare you on these.  One of the main things to look
> for is that they used the Security Considerations template and filled
> it out, catching any data nodes that need to be enumerated in the
> considerations.
> 
> Templates like this tend to get updated every time there's a new
> SecAD, :-) . As such, it'll likely be updated again in a few months.
> Here's the draft with the current template.  Have a look so you know
> key things to look for (transport security is called out and
> subtrees/data nodes of concern should be listed out).  Sometimes more
> is needed specific to the draft, but often times, this covers it.
> 
> https://tools.ietf.org/html/draft-ietf-netmod-rfc6087bis-10#page-52
> 
> Thanks again for all your reviews, it is a tremendous help to us!
> 
> -- 
> 
> Best regards,
> Kathleen