Re: [secdir] Discussion from the Security Directorate

I'll second Dave, I don't remember seeing this in a SECDIR context 
before Fred sent it around.

Fred Baker wrote:
> It was presented to the ops directorate as "from the security 
> directorate" on Monday, and shipped off to my working group.
> 
> OK, Tina, over to you...
> 
> On Jul 29, 2009, at 11:30 AM, David Harrington wrote:
> 
>> Hi,
>>
>> I have a question.
>> I am a member of the Security Directorate, and I do not remember any
>> discussion leading to this powerpoint presentation or request. I may
>> have missed a SECDIR session. I didn't find discussion of this
>> powerpoint presentation in the secdir archives prior to this week.
>>
>> Is this a "Discussion from the Security Directorate"? If so, when was
>> this discussed? Has the SECDIR reviewed this powerpoint slide deck and
>> approved it being sent to working groups?
>>
>> David Harrington
>> dbharrington@comcast.net
>> ietfdbh@comcast.net
>> dharrington@huawei.com
>>
>>
>>> -----Original Message-----
>>> From: secdir-bounces@ietf.org
>>> [mailto:secdir-bounces@ietf.org] On Behalf Of Fred Baker
>>> Sent: Tuesday, July 28, 2009 10:49 PM
>>> To: Joel Jaeggli
>>> Cc: 6man Chairs; 6man-ads@tools.ietf.org; secdir@ietf.org;
>>> Kurt Erik Lindqvist; Joe Abley; Softwire Chairs;
>>> v6ops-ads@tools.ietf.org; softwire-ads@tools.ietf.org; Tina
>>> TSOU; behave-ads@tools.ietf.org; Behave Chairs
>>> Subject: Re: [secdir] Discussion from the Security Directorate
>>>
>>> I'm not arguing against the request. I'm asking what it is
>>> requesting,
>>> as I have no idea...
>>>
>>> I think I know what a threat analysis is.
>>>
>>> What is a "security assessment" apart from a "threat assessment"? I
>>
>>> told v6ops (which does not develop transition technologies, by
>>> charter, and therefore is the absolute wrong place to send
>>> this) that
>>> I thought it might mean an assessment of how we might mitigate the
>>> threats. Absent any answers from the Security Directorate responsive
>>
>>> to the question, I have no idea whether I was correct.
>>>
>>> And what on God's Green Earth is a "function recommendation"? I have
>>
>>> no idea what you want.
>>>
>>> Nobody from the Security Directorate was there today to deliver the
>>
>>> message. If I were developing a threat assessment of that
>>> protocol...
>>> let's see: delivered to the wrong WG by someone who didn't know what
>>
>>> the message was supposed to be using slides he didn't understand and
>>
>>> the security directorate didn't take the time to explain...
>>>
>>> On Jul 27, 2009, at 2:08 PM, Joel Jaeggli wrote:
>>>
>>>> I'd probably tune the slides a bit still:
>>>>
>>>>     Security problems show up in deployment and use, these cannot
>> be
>>>>     thought out at all when designing the protocols
>>>>
>>>> Is an assertion you'll get pushback on. we have signficant
>>> operational
>>>> experience with variations on many of the proposed or deployed
>>>> transition mechanisms. necessarily that experience informs both
>> our
>>>> current thinking and the desirability of any particular approach.
>>>>
>>>> bump in the wire type transition technologies certainly are an
>> area
>>>> potential concern for opsec
>>>>
>>>> Fred Baker wrote:
>>>>> Thanks, Tina. I will add this to the IPv6 Operations
>>> agenda, probably
>>>>> during our second session Tuesday.
>>>>>
>>>>> You will note that I am copying the chairs and ADs from several
>>>>> working
>>>>> groups. The reason is that the primary thrust of the
>>> comments you are
>>>>> making apply to work being done in those working groups. Slide 5
>>>>> specifically requests a threat analysis, security assessment, and
>>>>> "function recommendation" on each transition technology;
>>> these are in
>>>>> fact being done in behave and softwires. I mention 6man because
>>>>> marketing blather from the IPv6 form makes security claims
>>> for IPv6,
>>>>> which it would be good if that working group clarified.
>>>>>
>>>>> I do have to ask specifically what the Security
>>> Directorate hopes to
>>>>> find in the three documents that have been requested for each of
>>
>>>>> these
>>>>> various technologies. What, specifically, is a "function
>>>>> recommendation"? A threat analysis is a statement that
>>> there exist
>>>>> a set
>>>>> of possible threats. Is a security assessment a statement about
>> how
>>>>> those threats are responded to? What, if the WGs don't
>>> produce it, is
>>>>> going to leave the Security Directorate feeling ill-used?
>>>>>
>>>>> On Jul 27, 2009, at 12:56 PM, Tina TSOU wrote:
>>>>>
>>>>>>
>>>>>> B. R.
>>>>>> ">http://tinatsou.weebly.com/contact.html
>>>>>
>>>>>> Begin forwarded message:
>>>>>>
>>>>>>> From: "Romascanu, Dan (Dan)" <dromasca@avaya.com>
>>>>>>> Date: July 27, 2009 7:52:20 AM GMT+02:00
>>>>>>> To: Ron Bonica <rbonica@juniper.net>
>>>>>>> Cc: Tina TSOU <tena@huawei.com>
>>>>>>> Subject: FW: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>>>
>>>>>>> Ron,
>>>>>>>
>>>>>>> This looks more like an opsec (who are not meeting this
>>> time) or
>>>>>>> v6ops
>>>>>>> subject.
>>>>>>>
>>>>>>> Dan
>>>>>>>
>>>>>>>
>>>>>>> -----Original Message-----
>>>>>>> From: Tina TSOU [mailto:tena@huawei.com]
>>>>>>> Sent: Monday, July 27, 2009 12:02 AM
>>>>>>> To: Romascanu, Dan (Dan)
>>>>>>> Subject: Re: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>>>
>>>>>>> Hi Dan,
>>>>>>> Could this be discussed at OPS-DIR working lunch?
>>>>>> <Recommendation of IPv6 Security work--on the flight-2.ppt>
>>>>>> <ATT4180184.txt>
>>>>>>
>>>
>>> _______________________________________________
>>> secdir mailing list
>>> secdir@ietf.org
>>> https://www.ietf.org/mailman/listinfo/secdir
>>>
>>
> 
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir
> 