Subject: [websec] new rev of requirements preso

From: =JeffH <[email-masked]>
Date: Mon, 08 Nov 2010 18:26:32 -0800

Please see attached. Pls upload to meeting materials when u get change Tobias.

thanks,

=JeffH

---

From: "Natale, Bob" <[email-masked]>
Date: Tue, 9 Nov 2010 00:27:56 -0500

Hi,

After reviewing these slides and your position paper (http://w2spconf.com/2010/papers/p11.pdf), I'd like to request some basic clarifications:

Given the phrase "Coherent Web Security Framework":

- What do you mean by "coherent" ... i.e., what observable and measurable attributes constitute coherence in this context?

- What is the scope of "Web Security"?

- What constitutes a "framework"?

I realize that on the surface these might seem like dunce questions, but I really cannot sync up the websec charter, your slides, and your paper ... some hints to my confusion from the paper:

- Is it "web security" or "web site security"?

- "...working to address specific subsets of the overall problems space" ... scope? ... how does that fit with "coherent framework"?

- "website security policy framework" ... ok, that might work, but might a smaller scope that "Web Security Framework"?

- "...deployed web browsers featuring more coherent security properties" ... browsers? ... coherent security properties?  What happened to Web, web site, coherent framework?

- "... set of robust standards coherent web security policy framework(s)" ... not sure what the wording in the beginning means ("robust standards coherent")? ... now we're talking about security policy frameworks? ... and it might be more than one framework?

- "...a generalized web security policy framework" ... are "generalized" and "coherent" the same? ... are we back to one framework? ... and we've settled on "security policy" as the scope of interest?

Again, I do apologize for the possible (probable?) sense of "dunce-ness" my questions might suggest ... but, having tried, I can't put these pieces together to produce a picture of a "coherent web security framework".

Cheers,
BobN

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of =JeffH
Sent: Monday, November 08, 2010 9:27 PM
To: IETF WebSec WG
Subject: [websec] new rev of requirements preso

thanks,

=JeffH

---

From: "Steingruebl, Andy" <[email-masked]>
Date: Mon, 8 Nov 2010 22:36:32 -0700

> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Natale, Bob

> After reviewing these slides and your position paper
> (http://w2spconf.com/2010/papers/p11.pdf), I'd like to request some basic
> clarifications:

I'll take the blame for at least 50% of your confusion :)
 
> - What do you mean by "coherent" ... i.e., what observable and measurable
> attributes constitute coherence in this context?

Singular, or at least well thought out and contained within multiple non-overlapping policies would be a good start. 

> - What is the scope of "Web Security"?

If only there were a good working definition.  WE generally mean to include portions of the general web security model such as the same-origin-policy, Cookie semantics, frame navigation policy, how HTTP/HTTPS interact with each other, etc.

> - Is it "web security" or "web site security"?

If we were unclear, apologies.  Generally speaking we don't think of it was "web site security" because they usually means things like Web-Server-Configuration, and Application security such as preventing XSS for example.

> - "... set of robust standards coherent web security policy framework(s)" ...
> not sure what the wording in the beginning means ("robust standards
> coherent")? ... now we're talking about security policy frameworks? ... and it
> might be more than one framework?

OK, here I'm just going to punt and say our language was probably a bit sloppy.  I don't know that we have a perfect taxonomy or naming system to differentiate between what we'd call a framework, and what we wouldn't.  Given that we're still formulating the whole space, I think defining much of this is still work to be done.

- Andy