Re: [Teas] Roman Danyliw's No Objection on draft-ietf-teas-rfc3272bis-26: (with COMMENT)

[Adrian Farrel <[e-mail]>]

Hi Roman,

Thanks for these comments.

> ** Section 6.6.  With the context that I don’t have a clear sense of what was
> chosen to be included in this document on traffic engineering, it seemed liked
> a few common traffic engineering design patterns related to survivability were
> not included.

I think "survivability" may have a different meaning for the two of us?
Not surviving attacks, but surviving network outages. Hence, 6.6 starts...
   Network survivability refers to the capability of a network to
   maintain service continuity in the presence of faults.

But...

>  I could also see discussion of these in the Security
> Considerations:

After a double-take, I see you mean you could see benefit in including these topics in the Security Considerations section :-)

So...

> -- traffic filtering/scrubbing of any/every kind at the edge to prevent attacks
> from entering the network or leaving (a very primitive form of traffic
> engineering)

A valuable tool. Does it fit into our definition of TE?
   Internet traffic engineering is defined as that aspect of Internet
   network engineering dealing with the issues of performance evaluation
   and performance optimization of operational IP networks.

Weeeeell, a network may be optimized by preventing attacks, but I don't think that is the main thrust of what we're talking about.

> -- choosing optional security features in control plane protocols such as
> authentication to harden the control plane

Sure. We already have:
   Thus, it is important to use adequate protection mechanisms on all
   protocols used to deliver TE.

We can add "such as authentication" if that helps.

> -- relying on external packet scrubbing services to mitigate DDoS attacks

Is this TE in any way?
It occurs to me that one could say that TE can be used to steer traffic through nodes capable of performing security functions (such as scrubbing and pattern matching), but I think this is SFC (which is certainly path steering, but not really TE). I'm ambivalent about including this, but the second paragraph (you quoted below) already talks about steering onto more secure links, so I can add it there.

> ** Section 9
>   In general, TE
>   mechanisms are security-neutral: they may use tunnels which can
>   slightly help protect traffic from inspection and which, in some
>   cases, can be secured using encryption; they put traffic onto
>   predictable paths within the network that may make it easier to find
>   and attack; they increase the complexity or operation and management
>   of the network; and they enable traffic to be steered onto more
>   secure links or to more secure parts of the network.
>
> Saying that TE mechanisms are security neutral” seems incongruent to the rest
> of the text.  For example, noting that a path “can be secured using encryption”
> doesn’t seem neutral at all and changes the security properties of the traffic
> carries.  Poorly configured traffic engineering seems like it could have
> disastrous consequences on security or “survivability” as discussed in Section
> 6.

As previously noted, "survivability" is not "security" in this document.

What you say, however, is true: running encryption on a path is a good thing; screwing up configuration is a bad thing. Those are things you can do in a TE system. But TE, itself, remains security-neutral. And this is an NRA marketing spin [1], it's just an observation.

Perhaps it is the language usage that is unclear. The paragraph can be split so the neutrality is one thing, and the list of things that can happen / be done with TE is a separate thing. This gives me...

OLD
   This document does not introduce new security issues.

   Network security is, of course, an important issue.  In general, TE
   mechanisms are security-neutral: they may use tunnels which can
   slightly help protect traffic from inspection and which, in some
   cases, can be secured using encryption; they put traffic onto
   predictable paths within the network that may make it easier to find
   and attack; they increase the complexity or operation and management
   of the network; and they enable traffic to be steered onto more
   secure links or to more secure parts of the network.
NEW
   In general, TE mechanisms are security-neutral, and this document
   does not introduce new security issues.

   Network security is, of course, an important issue, and TE mechanisms
   can have benefits and drawbacks.
 
    o TE may use tunnels which can slightly help protect traffic from
        inspection and which, in some cases, can be secured using encryption.

    o TE puts traffic onto predictable paths within the network that may
        make it easier to find and attack.

    o TE often increases the complexity of operation and management of
       the network which may lead to errors that compromise security.
     
    o TE enables traffic to be steered onto more secure links or to more
        secure parts of the network.
     
     o TE can be used to steer traffic through network nodes that are able
         to provide additional security functions.
END

Cheers,
Adrian


[1] https://en.wikipedia.org/wiki/Guns_don't_kill_people%2C_people_kill_people