[Teas] Re: Secdir last call review of draft-ietf-teas-applicability-actn-slicing-07

[Linda Dunbar <[e-mail]>]

Adrian, 

Some comments inserted below. 

Linda 

-----Original Message-----
From: Adrian Farrel <[e-mail]> 
Sent: Friday, August 9, 2024 1:28 PM
To: Linda Dunbar <[e-mail]>; [e-mail]
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: RE: Secdir last call review of draft-ietf-teas-applicability-actn-slicing-07

Linda,

Thank you so much for casting your eyes over our document.

Some thoughts in line...

> I have reviewed this document as part of the SEC area directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG.  These comments were written primarily for the benefit of the Security area directors.
> Document editors and WG chairs should treat these comments just like 
> any other last-call comments
>
> Section 6, paragraph 4 highlights the customer's responsibility for 
> end-to-end security, even when utilizing secure network slices as a 
> service provided by their service providers. This raises several questions:
>
> - Does the document imply that customers should not trust the secure 
> network  slices offered by service providers?

Essentially, yes. No one should trust a security service that they cannot, themselves, verify.
[Linda] sometimes a customer doesn't have the ability to verify the security services. That is why they  buy  security services from their trusted providers. 

However, the text doesn't go quite that far. It says that the customer is responsible for ensuring the privacy and integrity of their traffic. If a customer chooses to do that by subscribing to a service that claims to provide the necessary measures, then the customer is free to do so.

[Linda] It might be better to say something along the line of  Shared Responsibility for end to end security when using secure network slices. 

> - It might be beneficial for the document to specify criteria or 
> guidelines that customers can use to evaluate the security and 
> integrity of secure network slices as a service. Providing such 
> criteria would help customers make informed decisions and ensure they meet their security requirements.

It might be, although that is probably way beyond the scope or competence of the authors.

If pushed, I would say that no privacy or integrity service that cannot be independently verified by the customer can be trusted.

Cheers,
Adrian