Subject: [OPSEC] Revised Charter Text

From: KK <[email-masked]>
Date: Thu, 13 Jun 2013 10:59:04 -0700

Dear All,

The chairs in conjunction with our AD, Joel, recently worked on a draft
revision to our charter text. The changes in this revision are mostly
related to elaborating on the type of documents this WG produces along with
some minor wordsmithing here and there.

We would like to get you to review the text and provide comments. Please
have a read and voice an opinion one way or the other. If we don't hear any
objections by June 30th, we'll assume you love it and proceed.

Thanks,
KK, Gunter, Warren

P.S. The current version of the charter can be found at
http://datatracker.ietf.org/wg/opsec/charter/

**********

Proposed Revised OPSEC Charter:

"""

Goals:

The OPSEC WG will document operational issues and best current practices
with regard to network security. In particular, efforts will be made to
clarify the rationale supporting current operational practice, address gaps
in currently understood best practices for forwarding, control plane, and
management plane security and clarify liabilities inherent in security
practices where they exist.

Scope:

The scope of the OPSEC WG is intended to include the protection and secure
operation of the forwarding, control and management planes. Documentation
of operational issues, revision of existing operational

security practices documents and proposals for new approaches to
operational challenges related to network security are in scope.

Method:

It is expected that the product of the working group will result in the
publication of informational or BCP RFCs. Taxonomy or problem statement
documents may provide a basis for such documents.

Informational or Best Current Practices Document

For each topic addressed, a document that attempts to capture common
practices related to secure network operation will be produced. This will
be primarily based on operational experience. A document might convey:

* a threat or threats to be addressed

* current practices for addressing the threat

* protocols, tools and technologies extant at the time of writing that are
used to address the threat

* the possibility that a solution does not exist within existing tools or
technologies

Taxonomy and Problem Statement Documents

A document which attempts to describe the scope of particular operational
security challenge or problem space without necessarily coming to a
conclusion or proposing a solution. Such a document might

be a precursor to an informational or best current practices document.

While the principal input of the working group is operational experience
and needs, the output should be directed towards providing guidance to the
operators community, other working groups that develop

protocols or the community of protocol developers at large and implementers
of these protocols.

Non-Goals:

The OPSEC WG is not the place to do new protocols. New protocol work should
be addressed in a working group chartered in the appropriate area or as
individual submissions. The OPSEC WG may take on documents related to the
practices of using such work.

"""

---

From: KK <[email-masked]>
Date: Sun, 30 Jun 2013 10:11:08 -0700

Hey Folks,

Just a reminder, we'll be wrapping this up today.

Thanks,
KK

On Thu, Jun 13, 2013 at 10:59 AM, KK <[email-masked]> wrote:

> protocols or the community of protocol developers at large and
> implementers of these protocols.
>
> Non-Goals:
>
> The OPSEC WG is not the place to do new protocols. New protocol work
> should be addressed in a working group chartered in the appropriate area or
> as individual submissions. The OPSEC WG may take on documents related to
> the practices of using such work.
>
>
> """
>

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Sun, 30 Jun 2013 18:37:44 +0000

KK, chairs, Joel,

The revised charter looks good to me.

One small comment, the following sentence seems to be a bit of a runaway long one:
"In particular, efforts will be made to clarify the rationale supporting current operational practice, address gaps in currently understood best practices for forwarding, control plane, and management plane security and clarify liabilities inherent in security practices where they exist."

(Plus there's a preposition missing after "rationale") I wonder if it could be fragmented or turned into a list. For example:
"The working group documents security practices in the forwarding, control, and management planes. In particular, efforts will be made to clarify the rationale of supporting current operational practice, addressing gaps in currently understood best practices, and clarifying liabilities inherent in security practices where they exist."

Thanks,

Thumb typed by Carlos Pignataro.
Excuze typofraphicak errows

On Jun 30, 2013, at 1:11 PM, "KK" <[email-masked]<mailto:[email-masked]>> wrote:

Hey Folks,

Thanks,
KK

On Thu, Jun 13, 2013 at 10:59 AM, KK <[email-masked]<mailto:[email-masked]>> wrote:
Dear All,

The chairs in conjunction with our AD, Joel, recently worked on a draft revision to our charter text. The changes in this revision are mostly related to elaborating on the type of documents this WG produces along with some minor wordsmithing here and there.

We would like to get you to review the text and provide comments. Please have a read and voice an opinion one way or the other. If we don't hear any objections by June 30th, we'll assume you love it and proceed.

Thanks,
KK, Gunter, Warren

P.S. The current version of the charter can be found at http://datatracker.ietf.org/wg/opsec/charter/

**********

"""

Goals:

The OPSEC WG will document operational issues and best current practices with regard to network security. In particular, efforts will be made to clarify the rationale supporting current operational practice, address gaps in currently understood best practices for forwarding, control plane, and management plane security and clarify liabilities inherent in security practices where they exist.

Scope:

The scope of the OPSEC WG is intended to include the protection and secure operation of the forwarding, control and management planes. Documentation of operational issues, revision of existing operational

security practices documents and proposals for new approaches to operational challenges related to network security are in scope.

Method:

It is expected that the product of the working group will result in the publication of informational or BCP RFCs. Taxonomy or problem statement documents may provide a basis for such documents.

For each topic addressed, a document that attempts to capture common practices related to secure network operation will be produced. This will be primarily based on operational experience. A document might convey:

* protocols, tools and technologies extant at the time of writing that are used to address the threat

* the possibility that a solution does not exist within existing tools or technologies

A document which attempts to describe the scope of particular operational security challenge or problem space without necessarily coming to a conclusion or proposing a solution. Such a document might

While the principal input of the working group is operational experience and needs, the output should be directed towards providing guidance to the operators community, other working groups that develop

protocols or the community of protocol developers at large and implementers of these protocols.

Non-Goals:

The OPSEC WG is not the place to do new protocols. New protocol work should be addressed in a working group chartered in the appropriate area or as individual submissions. The OPSEC WG may take on documents related to the practices of using such work.

"""

_______________________________________________
OPSEC mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/opsec

---

From: Arturo Servin <[email-masked]>
Date: Sun, 30 Jun 2013 22:05:14 +0100

It looks good to me. No objections.

Regards,
as

On 6/30/13 6:11 PM, KK wrote:
>     The chairs in conjunction with our AD, Joel, recently worked on a
>     draft revision to our charter text. The changes in this revision
>     are mostly related to elaborating on the type of documents this WG
>     produces along with some minor wordsmithing here and there. 
>
>     We would like to get you to review the text and provide comments.
>     Please have a read and voice an opinion one way or the other. If
>     we don't hear any objections by June 30th, we'll assume you love
>     it and proceed.
>
>     Thanks,
>     KK, Gunter, Warren
>
>     P.S. The current version of the charter can be found
>     at http://datatracker.ietf.org/wg/opsec/charter/
>
>
>     **********
>
>     The OPSEC WG will document operational issues and best current
>     practices with regard to network security. In particular, efforts
>     will be made to clarify the rationale supporting current
>     operational practice, address gaps in currently understood best
>     practices for forwarding, control plane, and management plane
>     security and clarify liabilities inherent in security practices
>     where they exist.
>
>
>     Scope:
>
>
>     The scope of the OPSEC WG is intended to include the protection
>     and secure operation of the forwarding, control and management
>     planes. Documentation of operational issues, revision of existing
>     operational
>
>     It is expected that the product of the working group will result
>     in the publication of informational or BCP RFCs. Taxonomy or
>     problem statement documents may provide a basis for such documents.
>
>
>     For each topic addressed, a document that attempts to capture
>     common practices related to secure network operation will be
>     produced. This will be primarily based on operational experience.
>     A document might convey:
>
>
>     A document which attempts to describe the scope of particular
>     operational security challenge or problem space without
>     necessarily coming to a conclusion or proposing a solution. Such a
>     document might
>
>     While the principal input of the working group is operational
>     experience and needs, the output should be directed towards
>     providing guidance to the operators community, other working
>     groups that develop
>
>     The OPSEC WG is not the place to do new protocols. New protocol
>     work should be addressed in a working group chartered in the
>     appropriate area or as individual submissions. The OPSEC WG may
>     take on documents related to the practices of using such work.
>
>
>     """
>
>
>
>
> [email-masked]

---

From: joel jaeggli <[email-masked]>
Date: Sun, 30 Jun 2013 14:41:46 -0700

> Just a reminder, we'll be wrapping this up today.
this is a perhaps related question that is  NOT tied to the charter text 
which is are there milestone(s) which we should be  adding associated 
with particular areas of work that are ongoing (the nd security draft).

joel