From: "Adrian Farrel" <adrian@olddog.co.uk>
To: "'Linda Dunbar'" <linda.dunbar@futurewei.com>, <secdir@ietf.org>
References: 
 <172322405122.255490.10909933045876420270@dt-datatracker-6df4c9dcf5-t2x2k>
 <05d201daea9a$91419b30$b3c4d190$@olddog.co.uk>
 <CO1PR13MB49207C8212E2F8974AD4AB8E85BA2@CO1PR13MB4920.namprd13.prod.outlook.com>
In-Reply-To: 
 <CO1PR13MB49207C8212E2F8974AD4AB8E85BA2@CO1PR13MB4920.namprd13.prod.outlook.com>
Date: Sat, 10 Aug 2024 15:10:10 +0100
Organization: Old Dog Consulting
Message-ID: <061701daeb2f$033f6ed0$09be4c70$@olddog.co.uk>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Language: en-gb
Thread-Index: AQId/n6KYGtJaXv8jVl8zh7iqeoaTgJU516dALqZ7hexgeBycA==
Message-ID-Hash: Z5SYW32WTF4TBXKPFOBIOCZ6YGEJLRAK
CC: draft-ietf-teas-applicability-actn-slicing.all@ietf.org,
 last-call@ietf.org, teas@ietf.org
Precedence: list
Reply-To: adrian@olddog.co.uk
Subject: =?utf-8?q?=5BTeas=5D_Re=3A_Secdir_last_call_review_of_draft-ietf-teas-applic?=
	=?utf-8?q?ability-actn-slicing-07?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/teas/6SEC29xDtYPt1WHV-ZP800btaEI>

Thanks again, Linda.

>> I have reviewed this document as part of the SEC area directorate's=20
>> ongoing effort to review all IETF documents being processed by the=20
>> IESG.  These comments were written primarily for the benefit of the =
Security area directors.
>> Document editors and WG chairs should treat these comments just like=20
>> any other last-call comments
>>
>> Section 6, paragraph 4 highlights the customer's responsibility for=20
>> end-to-end security, even when utilizing secure network slices as a=20
>> service provided by their service providers. This raises several =
questions:
>>
>> - Does the document imply that customers should not trust the secure=20
>> network  slices offered by service providers?
>
> Essentially, yes. No one should trust a security service that they =
cannot, themselves, verify.

[Linda] sometimes a customer doesn't have the ability to verify the =
security services. That is why they  buy  security services from their =
trusted providers.=20

The point is that the customer *never* has the ability to verify a =
security service. They hand over their unprotected traffic to the =
service provider on the understanding that the traffic will be protected =
edge-to-edge and delivered unprotected at the destination.

So the crunch is "trusted provider." The level of trust depends, of =
course, on the nature of the traffic, the trustworthiness of the =
provider, and the nervousness of the customer.
However, a customer that wishes to be *certain* that the traffic is =
adequately protected must take responsibility themselves.

> However, the text doesn't go quite that far. It says that the customer =
is responsible for ensuring
> the privacy and integrity of their traffic. If a customer chooses to =
do that by subscribing to a=20
> service that claims to provide the necessary measures, then the =
customer is free to do so.

[Linda] It might be better to say something along the line of  Shared =
Responsibility for end to end security when using secure network slices. =


I disagree. Even if the protection is delegated to another party, the =
responsibility for protecting the traffic lies with the owner of the =
traffic.=20

>> - It might be beneficial for the document to specify criteria or=20
>> guidelines that customers can use to evaluate the security and=20
>> integrity of secure network slices as a service. Providing such=20
>> criteria would help customers make informed decisions and ensure they =
meet their security requirements.
>
> It might be, although that is probably way beyond the scope or =
competence of the authors.
>
> If pushed, I would say that no privacy or integrity service that =
cannot be independently verified by the
> customer can be trusted.

At this point, what do you say we leave this to the Sec AD to decide =
whether or not to follow-up on this point?

A