Subject: [Detnet] Network security - purely technical?

From: John Dowdell <[email-masked]>
Date: Wed, 4 Jan 2017 19:54:13 +0000

Dear Sec ADs

We in detnet are engaging in writing security-related text in our drafts. As is normal, much is being or has been written about technical methods of subverting the operation of detnets.

I wonder if it is also time, given the uses to which detnets will be put (factory and continuous process control, live entertainment and power grid control to name but a few), that readers of security-related RFCs should also be encouraged to consider the business cases of choosing to mitigate against a set of threats or not. An extreme view may be that the finance community in a particular organisation see such mitigation as unaffordable, until that is the worst happens and the cost of implementing the security pales into insignificance against the impact not only to the organisations operations but to the reputation of their brand.

It is this reputational damage that I brought up at the detnet session at IETF 97; a reputation can take years to build up, but can be torn down so very quickly as the news, correct or otherwise, gets out. I wondered if it would help the community who have to propose the mitigation for security threats to have some appropriate guidelines or advice to understand the potential business impact, so that they can better build their case when applying for funds to design and build out their detnet.

I’m acutely aware that the IETF is a technical organisation, but do you think there is a place for some guidelines that are mostly already in the public domain, just not our public domain?

Regards
John

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 8 Jan 2017 12:07:03 +0000

Hi John,

Sorry for the slow response...

On 04/01/17 19:54, John Dowdell wrote:
> Dear Sec ADs
> 
> We in detnet are engaging in writing security-related text in our
> drafts. As is normal, much is being or has been written about
> technical methods of subverting the operation of detnets.
> 
> I wonder if it is also time, given the uses to which detnets will be
> put (factory and continuous process control, live entertainment and
> power grid control to name but a few), that readers of
> security-related RFCs should also be encouraged to consider the
> business cases of choosing to mitigate against a set of threats or
> not. An extreme view may be that the finance community in a
> particular organisation see such mitigation as unaffordable, until
> that is the worst happens and the cost of implementing the security
> pales into insignificance against the impact not only to the
> organisations operations but to the reputation of their brand.
> 
> It is this reputational damage that I brought up at the detnet
> session at IETF 97; a reputation can take years to build up, but can
> be torn down so very quickly as the news, correct or otherwise, gets
> out. I wondered if it would help the community who have to propose
> the mitigation for security threats to have some appropriate
> guidelines or advice to understand the potential business impact, so
> that they can better build their case when applying for funds to
> design and build out their detnet.
> 
> I’m acutely aware that the IETF is a technical organisation, but do
> you think there is a place for some guidelines that are mostly
> already in the public domain, just not our public domain?

Sorry, I'm not at all clear on what you're asking there. Can
you elaborate?

Thanks,
S.

> Regards John