Re: [secdir] Review of draft-ietf-ccamp-alarm-module-07

[stefan vallin <[e-mail]>]

Thanks Shawn!
Next version will include fixes to your comments
/s


> On 14 Mar 2019, at 06:45, Shawn Emery <[e-mail]> wrote:
> 
> Reviewer: Shawn M. Emery
> Review result: Ready with nits
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security
> area directors. Document editors and WG chairs should treat these
> comments just like any other last call comments.
> 
> This draft specifies a YANG module for the purpose of network device alarm management.
> 
> The security considerations section does exist and follows the yang-security-guidelines.
> I believe the data nodes and operations of concern are covered in this section, but it seems
> that alarm-profiles could also be sensitive if an attacker were to downgrade the severity of
> an alarm by changing the alarm-severity-assignment-profile.
> 
> General comments:
> 
> None.
> 
> Editorial comments:
> 
> s/northbound/north-bound/
> s/definition also focus/definition also focuses/
> s/an hierarchy/a hierarchy/
> s/raised again etc/raised again, etc/
> s/sent Notifications/sent.  Notifications/
> s/alarn/alarm/
> s/The NETCONF access control model/The Network Configuration Access Control Model (NACM)/
> s/notify-status-change:/notify-status-changes:/
> 
> OLD:
> This leaf controls whether an alarm should notify only raise and clear or all severity level
> changes.  Unauthorized access to leaf could have a negative impact on operational procedures
> relying on fine-grained alarm state change reporting.
> 
> NEW:
> This leaf controls whether an alarm should notify based on various state changes.  Unauthorized
> access to this leaf could have a negative impact on operational procedures relying on
> fine-grained alarm state change reporting.
> 
> Shawn.
> --