Subject: [ippm] Kathleen Moriarty's No Objection on draft-ietf-ippm-2679-bis-04: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 19 Aug 2015 15:27:13 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-ippm-2679-bis-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ippm-2679-bis/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I support Alissa's discuss.

Alissa's comment reads as being more focused on privacy considerations
and this point should be expanded to consider operational security
considerations that have been around for a long time, but were not in the
original text of this RFC.  Collecting measurement data or using
measurement data for reconnaissance to later attack systems is quite
common.  Access to this data or the ability to use measurement techniques
to do reconnaissance activity should be guarded agist or at least noted
as a security consideration.  When you look at text to address her
comment, please expand it to include this operational security
consideration as it is a very real and present threat.  This is pretty
much the same as my discuss on the other IPPM draft.

Thank you.

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Thu, 20 Aug 2015 08:44:41 -0400

Hi Kathleen,

> -----Original Message-----
> From: Kathleen Moriarty [mailto:[email-masked]]
> Sent: Wednesday, August 19, 2015 6:27 PM
> To: The IESG
> Cc: Bill Cerveny; [email-masked]; draft-ietf-ippm-2679-
> [email-masked]; [email-masked]
> Subject: Kathleen Moriarty's No Objection on draft-ietf-ippm-2679-bis-
> 04: (with COMMENT)
> 
...
> considerations that have been around for a long time, but were not in
> the original text of this RFC.  Collecting measurement data or using
> common.  Access to this data or the ability to use measurement
> techniques to do reconnaissance activity should be guarded agist or at
> least noted as a security consideration.  When you look at text to
> address her comment, please expand it to include this operational
> security consideration as it is a very real and present threat.  This is
> pretty much the same as my discuss on the other IPPM draft.
> 

[ACM] 
There are some useful ideas here that can go into a note (for both drafts).
Something like:

---
Collecting measurements or using measurement results for reconnaissance 
to assist in subsequent system attacks is quite common.  Access to 
measurement results, or control of the  to use measurement systems 
to do perform reconnaissance should be guarded against. 
See Section 7 of <xref target="I-D.ietf-lmap-framework"
(security considerations for the LMAP Framework) for system 
requirements that help to avoid measurement system compromise.
---

Because we're guarding against access, we have a real recommendation
we can make and a lot of prior study to draw upon.
I don't think we need another memo for this aspect,
the LMAP Security considerations cover system access security very well.

I was struggling with the case where the attacker builds their own
measurement system, measures metrics, and uses the results
(so far, that's exactly what I do everyday), to assist a later attack.
There doesn't seem to be anything productive we can say about
attacker's purpose-built systems, and I doubt there's any value
for attackers to say that their measurement system conforms
to RFC 2679 bis.

Let me know if you have suggestions on the text above,
Al

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Thu, 20 Aug 2015 09:14:40 -0400

Something went wrong in cut/paste, so here's the text I propose:

Collecting measurements or using measurement results for reconnaissance 
to assist in subsequent system attacks is quite common.  Access to 
measurement results, or control of the  measurement systems to perform 
reconnaissance should be guarded against. 
See Section 7 of <xref target="I-D.ietf-lmap-framework"
(security considerations of the LMAP Framework) for system requirements 
that help to avoid measurement system compromise.

> From: MORTON, ALFRED C (AL)
> Sent: Thursday, August 20, 2015 8:45 AM
> To: 'Kathleen Moriarty'; The IESG
> Subject: RE: Kathleen Moriarty's No Objection on draft-ietf-ippm-2679-
> bis-04: (with COMMENT)
> 
> Hi Kathleen,
> 
> > security consideration as it is a very real and present threat.  This
> > is pretty much the same as my discuss on the other IPPM draft.
> >
> 
> [ACM]
> measurement results, or control of the  to use measurement systems to do
> perform reconnaissance should be guarded against.
> (security considerations for the LMAP Framework) for system requirements
> that help to avoid measurement system compromise.
> ---
> 
> Because we're guarding against access, we have a real recommendation we
> can make and a lot of prior study to draw upon.
> I don't think we need another memo for this aspect, the LMAP Security
> considerations cover system access security very well.
> 
> 
> measurement system, measures metrics, and uses the results (so far,
> that's exactly what I do everyday), to assist a later attack.
> There doesn't seem to be anything productive we can say about attacker's
> purpose-built systems, and I doubt there's any value for attackers to
> say that their measurement system conforms to RFC 2679 bis.
> 
> Let me know if you have suggestions on the text above, Al
> 
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 20 Aug 2015 10:06:30 -0400

Thanks, Al!

This looks good for now.  Will this go into both of the IPPM drafts?

-- 

Best regards,
Kathleen

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Thu, 20 Aug 2015 10:16:44 -0400

> From: Kathleen Moriarty [mailto:[email-masked]]
> Sent: Thursday, August 20, 2015 10:07 AM
> To: MORTON, ALFRED C (AL)
> Cc: The IESG; Bill Cerveny; [email-masked]; draft-ietf-ippm-2679-
> Subject: Re: Kathleen Moriarty's No Objection on draft-ietf-ippm-2679-
> bis-04: (with COMMENT)
> 
> Thanks, Al!
> 
[ACM] 
Yes, that's been my approach all along, assume duplicate comments where
relevant. We'll interpret potential recon as a source of access threats
for now.  Doing more requires us to distinguish legitimate characterization
from recon, somehow.

Al

> > Collecting measurements or using measurement results for
> > reconnaissance to assist in subsequent system attacks is quite common.
> > Access to measurement results, or control of the  measurement systems
> > to perform reconnaissance should be guarded against.
> > (security considerations of the LMAP Framework) for system
> >> > Alissa's comment reads as being more focused on privacy
> >> > considerations and this point should be expanded to consider
> >> > operational security considerations that have been around for a
> >> > long time, but were not in the original text of this RFC.
> >> > Collecting measurement data or using measurement data for
> >> > reconnaissance to later attack systems is quite common.  Access to
> >> > this data or the ability to use measurement techniques to do
> >> > reconnaissance activity should be guarded agist or at least noted
> >> > consideration as it is a very real and present threat.  This is
> >> Collecting measurements or using measurement results for
> >> reconnaissance to assist in subsequent system attacks is quite
> >> common.  Access to measurement results, or control of the  to use
> >> measurement systems to do perform reconnaissance should be guarded
> against.
> >> attacker's purpose-built systems, and I doubt there's any value for
> >> attackers to say that their measurement system conforms to RFC 2679
> bis.
> >>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 20 Aug 2015 10:18:33 -0400

> for now.  Doing more requires us to distinguish legitimate characterization

Thanks, Al!  I'll clear once the updated draft comes in.

Best regards,
Kathleen

-- 

Best regards,
Kathleen