Subject: [netmod] 5th draft for yang module security considerations

From: Bert Wijnen <[email-masked]>
Date: Mon, 14 Jun 2010 10:09:02 +0200

Since the 4th draft, we have been informed of one typo that is fixed in
this revision.

Further, the security ADs wanted something added about secure transport
of the data, and the secdir review of the netconf-monitoring draft
also had questions about that. As a result, Juergen Schoenwaelder has
suggested to add some text about that.

The resulting text is now as below.

Bert

--- draft 5 for tang module security considerations:

    Each specification that defines one or more YANG
    modules MUST contain a section that discusses
    security considerations relevant to those modules.
    This section MUST be patterned after the latest
    approved template (available at [ed: URL TBD]).

    In particular, writable data nodes that could
    be especially disruptive if abused MUST be
    explicitly listed by name and the associated
    security risks MUST be spelled out.

    Similarly, readable data nodes that contain
    especially sensitive information or that raise
    significant privacy concerns MUST be explicitly
    listed by name and the reasons for the
    sensitivity/privacy concerns MUST be explained.

    Further, if new RPC operations have been defined,
    then the security considerations of each new
    RPC operation MUST be explained.

X. Security Considerations

The YANG module defined in this memo is designed to be accessed
via the NETCONF protocol [RFC4741]. The lowest NETCONF layer is
the secure transport layer and the mandatory to implement secure
transport is SSH [RFC4742].

-- if you have any writeable data nodes (those are all the
-- "config true" nodes, and remember, that is the default)
-- describe their specific sensitivity or vulnerability.

There are a number of data nodes defined in this YANG module
which are writable/creatable/deletable (i.e. config true, which
is the default).  These data nodes may be considered sensitive
or vulnerable in some network environments.  Write operations
(e.g. edit-config) to these data nodes without proper protection
can have a negative effect on network operations.  These are
the subtrees and data nodes and their sensitivity/vulnerability:

  <list subtrees and data nodes and state why they are sensitive>

-- for all YANG modules you must evaluate whether any readable data
-- nodes (those are all the "config false" nodes, but also all other
-- nodes, because they can also be read via operations like get or
-- get-config) are sensitive or vulnerable (for instance, if they
-- might reveal customer information or violate personal privacy
-- laws such as those of the European Union if exposed to
-- unauthorized parties)

Some of the readable data nodes in this YANG module may be
considered sensitive or vulnerable in some network environments.
It is thus important to control read access (e.g. via get,
get-config or notification) to these data nodes.  These are the
subtrees and data nodes and their sensitivity/vulnerability:

  <list subtrees and data nodes and state why they are sensitive>

-- if your YANG module has defined any rpc operations
-- describe their specific sensitivity or vulnerability.

Some of the RPC operations in this YANG module may be considered
sensitive or vulnerable in some network environments.  It is thus
important to control access to these operations.  These are the
operations and their sensitivity/vulnerability:

  <list RPC operations and state why they are sensitive>