Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

["Fred Baker (fred)" <[e-mail]>]

On Nov 15, 2013, at 10:02 AM, Tassos Chatzithomaoglou <[e-mail]> wrote:

> So, although i support this, i would like to see a note warning about some of the above dangers and noting that extra caution is to be used when following this.

Thanks.

Again, speaking as a participant.

Where I most scratch my head is that the threat the firewall presumably is intended to defend against, and the asset it is trying to defend, is not usually related to a protocol. If we decide that a given protocol number or port number is "universally OK", such as RFC 6092's comments on ESP/AH/IKE, one can expect port-agile attacks to use that port number for whatever protocol they use. If we say that we want a specified server to act as a listener for a protocol, such as a web server for http/https, that doesn't imply that all devices implementing listeners should be exposed as a matter of policy (if you have a Canon MP620 series printer or a Cisco telephone, and its address is X.X.X.X, open http://X.X.X.X, and ask yourself if that's information you want available to the world).

So, blocking a couple of ports doesn't seem to accomplish much from a security perspective. I'm not sure what I would call "security" in this draft, much less "balanced". What the draft does, as near as I can tell, is give service providers something that somebody called a firewall, so that they can tell their customers that have the presence of a firewall as a market requirement that they are deploying a firewall, but depending on their customers to be dumb enough to not realize that the firewall doesn't secure anything.

BTW, as chair, I have asked for a security directorate review of this draft.