Re: [secdir] YANG Reviews

[Russ Housley <[e-mail]>]

https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines

This is exactly what a SecDir reviewer will need.  Awesome.

Russ


> On Jan 11, 2018, at 11:21 AM, Kathleen Moriarty <[e-mail]> wrote:
> 
> Hello,
> 
> As it turns out, there is a page:
> 
> https://www.ietf.org/iesg/directorate/yang-doctors.html
> 
> If anyone has comments on the bis draft with current security
> considerations template, please provide them to the WG.  Here is the
> link again for your convenience:
> https://tools.ietf.org/html/draft-ietf-netmod-rfc6087bis-10#page-52
> 
> Thank you!
> 
> On Tue, Jan 9, 2018 at 2:15 PM, Kathleen Moriarty
> <[e-mail]> wrote:
>> Hi Russ,
>> 
>> Sent from my mobile device
>> 
>>> On Jan 9, 2018, at 1:46 PM, Russ Housley <[e-mail]> wrote:
>>> 
>>> For MIB modules, we came up with a short list of things or the SecDir Reviewer to do.  This is a quote from an email message in 2007:
>>> 
>>>> The job of the security reviewers, then, is three-fold: first, to
>>>> verify the existence of the boilerplate; second, to verify the adequacy
>>>> of the explanations given for particular items; third -- and this is
>>>> the hardest -- to scan the document to see if other items should have
>>>> been identified as sensitive but aren't.
>> 
>> The guidance is very similar.
>>> 
>>> The real guidance appears here: http://www.ops.ietf.org/mib-security.html
>>> 
>>> It would be very helpful if we can come up with an equivalent yang-security.html document.
>>> 
>> We can work with Benoit &Warren as it’s better for those writing the drafts to see it first, so I think the home should be the same.
>> 
>> Best,
>> Kathleen
>> 
>>> Russ
>>> 
>>> 
>>>> On Jan 8, 2018, at 4:43 PM, Kathleen Moriarty <[e-mail]> wrote:
>>>> 
>>>> Hello,
>>>> 
>>>> We will be seeing many YANG module reviews come through, please don't
>>>> let page counts scare you on these.  One of the main things to look
>>>> for is that they used the Security Considerations template and filled
>>>> it out, catching any data nodes that need to be enumerated in the
>>>> considerations.
>>>> 
>>>> Templates like this tend to get updated every time there's a new
>>>> SecAD, :-) . As such, it'll likely be updated again in a few months.
>>>> Here's the draft with the current template.  Have a look so you know
>>>> key things to look for (transport security is called out and
>>>> subtrees/data nodes of concern should be listed out).  Sometimes more
>>>> is needed specific to the draft, but often times, this covers it.
>>>> 
>>>> https://tools.ietf.org/html/draft-ietf-netmod-rfc6087bis-10#page-52
>>>> 
>>>> Thanks again for all your reviews, it is a tremendous help to us!
>>>> 
>>>> --
>>>> 
>>>> Best regards,
>>>> Kathleen
>>> 
> 
> 
> 
> -- 
> 
> Best regards,
> Kathleen