Re: [Smart] [Secdispatch] New Version Notification for draft-lazanski-smart-users-internet-00.txt

[Kathleen Moriarty <[e-mail]>]

Dominique,

Thank you for your work on this draft.  It's a good start toward broadening
the conversation on the Internet threat model and I do agree that is
necessary.

The other recent threat model drafts don't cover the points raised, but
none of the three threat model drafts cover all threats. I'm not sure if
there are other threat model drafts I have missed as well.

I like the focus, but think as the draft goes on, broadening the scope to
look at the full threat model would be very helpful towards something the
IETF participants might buy into (I could be wrong here, but this is what I
suspect).  We can't look solely at the end point as the IETF is concerned
mostly with on-the-wire protocols.  In some RFCs, there are clear
requirements on end point security, but this is not particularly common.
It would be good to see the sort of changes proposed added into a revision
of 3552 in my opinion.  However, we do need to think about surveillance and
other threats too.  One of DKG's points from a panel at RSA was that boxes
that intercept traffic and are capable of decrypting that traffic is a
target rich environment.  I agree with that point.

We are in a tough spot as crypto has become stronger, but the endpoints
have not become more secure or even capable of detecting the threats that
were blocked in-the-middle previously.  I think adding this point into your
draft would be helpful as we (as a community) rethink the threat model.

I'd be very happy to discuss this further.

Also - is this a request to present at SecDispatch?

Thank you,
Kathleen

Sorry for the top-post, but I was not responding the the thread besides
Dominique's initial message.


>>> On Jul 8, 2019, at 12:54 PM, Dominique Lazanski <[e-mail]>
>>> wrote:
>>>
>>> Cross posting to this mailing list.
>>>
>>> Dominique
>>>
>>> A new version of I-D, draft-lazanski-smart-users-internet-00.txt
>>> has been successfully submitted by Dominique Lazanski and posted to the
>>> IETF repository.
>>>
>>> Name:        draft-lazanski-smart-users-internet
>>> Revision:    00
>>> Title:        An Internet for Users Again
>>> Document date:    2019-07-08
>>> Group:        Individual Submission
>>> Pages:        12
>>> URL:
>>> https://www.ietf.org/internet-drafts/draft-lazanski-smart-users-internet-00.txt
>>> Status:
>>> https://datatracker.ietf.org/doc/draft-lazanski-smart-users-internet/
>>> Htmlized:
>>> https://tools.ietf.org/html/draft-lazanski-smart-users-internet-00
>>> Htmlized:
>>> https://datatracker.ietf.org/doc/html/draft-lazanski-smart-users-internet
>>>
>>>
>>> Abstract:
>>>   RFC 3552 introduces a threat model that does not include endpoint
>>>   security. In the fifteen years since RFC 3552 security issues and
>>>   cyber attacks have increased, especially on the endpoint. This
>>>   document proposes a new approach to Internet cyber security protocol
>>>   development that focuses on the user of the Internet, namely those
>>>   who use the endpoint and are the most vulnerable to attacks.
>>> --
>>> Smart mailing list
>>> [e-mail]
>>> https://www.irtf.org/mailman/listinfo/smart
>>>
>>>
>>> _______________________________________________
>>> Secdispatch mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/secdispatch
>>>
>>
>>
> _______________________________________________
> Secdispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdispatch
>


-- 

Best regards,
Kathleen