From: "Adrian Farrel" <adrian@olddog.co.uk>
To: "'Linda Dunbar'" <linda.dunbar@futurewei.com>, <secdir@ietf.org>
References: 
 <172322405122.255490.10909933045876420270@dt-datatracker-6df4c9dcf5-t2x2k>
In-Reply-To: 
 <172322405122.255490.10909933045876420270@dt-datatracker-6df4c9dcf5-t2x2k>
Date: Fri, 9 Aug 2024 21:27:33 +0100
Organization: Old Dog Consulting
Message-ID: <05d201daea9a$91419b30$b3c4d190$@olddog.co.uk>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Language: en-gb
Thread-Index: AQId/n6KYGtJaXv8jVl8zh7iqeoaTrGZNqZg
Message-ID-Hash: 35ND2E6GSKJKUIA6S5K2ECEBN3YAXOVY
CC: draft-ietf-teas-applicability-actn-slicing.all@ietf.org,
 last-call@ietf.org, teas@ietf.org
Precedence: list
Reply-To: adrian@olddog.co.uk
Subject: =?utf-8?q?=5BTeas=5D_Re=3A_Secdir_last_call_review_of_draft-ietf-teas-applic?=
	=?utf-8?q?ability-actn-slicing-07?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/teas/U6xddpo0S4tboUkGvV8ZE2JCUhY>

Linda,

Thank you so much for casting your eyes over our document.

Some thoughts in line...

> I have reviewed this document as part of the SEC area directorate's =
ongoing
> effort to review all IETF documents being processed by the IESG.  =
These
> comments were written primarily for the benefit of the Security area =
directors.
> Document editors and WG chairs should treat these comments just like =
any other
> last-call comments
>
> Section 6, paragraph 4 highlights the customer's responsibility for =
end-to-end
> security, even when utilizing secure network slices as a service =
provided by
> their service providers. This raises several questions:
>
> - Does the document imply that customers should not trust the secure =
network
>  slices offered by service providers?

Essentially, yes. No one should trust a security service that they =
cannot, themselves, verify.

However, the text doesn't go quite that far. It says that the customer =
is responsible for ensuring the privacy and integrity of their traffic. =
If a customer chooses to do that by subscribing to a service that claims =
to provide the necessary measures, then the customer is free to do so.

> - It might be beneficial for the document to specify criteria or =
guidelines
> that customers can use to evaluate the security and integrity of =
secure network
> slices as a service. Providing such criteria would help customers make =
informed
> decisions and ensure they meet their security requirements.

It might be, although that is probably way beyond the scope or =
competence of the authors.

If pushed, I would say that no privacy or integrity service that cannot =
be independently verified by the customer can be trusted.

Cheers,
Adrian