Scope of the Internet Security Policy

[J Paul Holbrook <[e-mail]>]

At the SPWG meeting in Pittsburgh several people agreed to write on
some position statements on some of the important issues that the
Internet Security Policy will have to address.  We agreed to write
these up by 5/31.  This one is a short proposal for the scope of of
the Internet Security Policy.

These are sent out to encourage discussion on this issue.  Please
disagree, critique, and have at it.  Please copy the spwg list on any
replies.

I'll sent out another note shortly on a different topic.

J. Paul Holbrook
ssphwg co-chair
Internet: <[e-mail]>
[phone]


		SCOPE OF THE INTERNET SECURITY POLICY
			   J. Paul Holbrook
				6/1/90
 		

The Internet security policy should not mandate security policies for
sites beyond what is necessary for maintaining the security of the
Internet.  The policy should not mandate the form of a site's internal
response to security problems.  However, it should require that a site
have policies in place which meet a minimum set of requirements to
allow effective prevention of and response to Internet security
problems.  Helping a site develop a more complete set of security
policies and procedures is the goal of the the Site Security Policy
Handbook.

The goal of the policy is to ensure that each site responsibly
protects and audits access to the Internet, and maintains a point of
contact so that each site can get information about security problems
and also assist others in dealing with security problems that involve
their site.

The policy covers all "network-capable" devices that may affect the
Internet.  Thus, in additional to hosts, terminal servers, routers,
and other network management devices are covered.  Other machines that
may indirectly allow unaudited access to the Internet are also
covered.  For example, if a host that has access to the Internet also
trusts other hosts on a site's local network, the policy covers those
other machines as well.  As an example, if an Internet host trusts a
local PC, a user might be able to use the PC to gain access to the
Internet without proper auditing.  In this case, the PC is covered
under the policy.  (If the Internet host does not trust the PC, the PC
does not come under the policy.)