Subject: [Isms] ISMS solution seslection procedure

From: Juergen Quittek <[email-masked]>
Date: Thu, 23 Sep 2004 17:23:00 +0200

Dear all,

Welcome to the ISMS working group!

We have a very ambitious schedule and need to start discussing how we want
to achieve our goal in time.

Our major objective is selecting a solution for integrating SNMP with a
security infrastructure as described in the charter.  The charter also
defines a submission deadline for solutions, but it does not specify the
selection process.  This message is a first step towards an agreement on
the selection process.

Basically, we have to evaluate all submitted solutions and then select one.
For the evaluation we need a list of evaluation criteria and evaluators.

Wes already spent a lot of time on identifying criteria/requirements.
We should start with his list and discuss it on a separate email thread.

Concerning the evaluators it can be useful to have a look at other WGs.
Similar selections were made in the SEAMOBY, IPFIX and MIDCOM
WGs.  In the SEAMOBY WG the chairs evaluated proposed solutions,
in the IPFIX and MIDCOM WGs an evaluations team performed this
task.  Since SEAMOBY decision ended up in a disaster (shutting down the
entire work item at the IETF) it might be a good idea to go the way
of IPFIX and MIDCOM where the decisions went reasonably well.
Of course we are free to go our own way and our experiences may be
completely different from the ones made in SEAMOBY, IPFIX and MIDCOM.

So, please give us your opinion on the evaluators.  Do you prefer
  - the WG chairs
  - an evaluation team
  - others
???

The evaluators should prepare a written evaluation and give a recommendation.
Preferably the evaluation and recommendation should be available as an
Internet draft, see for example

  <http://www.watersprings.org/pub/id/draft-ietf-seamoby-paging-protocol-assessment-01.txt>
  <http://www.ietf.org/internet-drafts/draft-leinen-ipfix-eval-contrib-03.txt>
  <http://www.ietf.org/internet-drafts/draft-ietf-midcom-protocol-eval-06.txt>.

Ideally, a first version of this draft (containing the final list of
evaluation criteria, but probably not yet any evaluation) would already
be posted by the deadline for submitting solutions.

Then we need to hurry to get to a recommendation in November.

Please send any comment, suggestion, opinion on the selection procedure.
And since little time is left, please send it rather soon than late.

Thanks,

Ken and Juergen

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 23 Sep 2004 13:38:46 -0400

I prefer an evaluation team. I would like to see each proposal
reviewed by a security expert and an SNMPv3 expert to consider
compliance to best current practices.

dbh

---

From: Chris Elliott <[email-masked]>
Date: Thu, 23 Sep 2004 14:16:15 -0400 (EDT)

I agree, but I would add an operational expert to the team as well as the
security and SNMPv3 expert.

Chris.

> compliance to best current practices.

Chris Elliott  CCIE# 2013       |         |
Customer Diagnostic Engineer   |||       |||
RTP, NC, USA                  |||||     |||||
919-392-2146              .:|||||||||:|||||||||:.
[email-masked]        c i s c o S y s t e m s

---

From: Kaushik Narayan <[email-masked]>
Date: Thu, 23 Sep 2004 11:45:17 -0700

I prefer an evaluation team.

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 23 Sep 2004 13:31:29 -0700

>>>>> On Thu, 23 Sep 2004 14:16:15 -0400 (EDT), Chris Elliott <[email-masked]> said:

Chris> I agree, but I would add an operational expert to the team as
Chris> well as the security and SNMPv3 expert.

Oh, and they should be non-biased of course!  That'll be the tricky part.

-- 
Wes Hardaker
Sparta

---

From: "David B Harrington" <[email-masked]>
Date: Mon, 27 Sep 2004 12:51:26 -0400

Greetings,

I recommended that each proposal be reviewed for compliance to
existing best current practices. I suggested this based on experience
in the AAA and MIDCOM WGs. Those WHs spent a great deal of time
deciding on the requirements to compare proposals against, and they
needed to determine what would need to be changed to integrate each
proposed protocol into the desired environment. 

I had in mind such "best current practices" as RFC3411, which places
certain requirements on modules that will fit within an SNMPv3 engine.
I think each proposal needs to be considered as to whether the
proposed security model will work as is within the architecture,
whether a proposed security model will require changes to the security
mechanisms used to fit with the RFC3411 archtecture, or whether the
architecture will need to change to accommodate the proposed solution.

I know the charter says the existing SNMPv3 standard cannot be
changed, but the framework is only a theoretical document based on the
best knowledge available at the time it was written, and new protocols
(e.g. 802.1x) and some paradigms of security management (e.g. RADIUS)
have become much more widely-deployed since then, so I believe the
architecure might need to be updated to accommodate proposed solutions
that best meet operator needs.

For example, BEEP could be considered, but it would probably require
changes to BEEP to be able to pass information to the SNMP agent about
the security principal, the specific authentication mechanism used
within BEEP, and whether the message was authenticated and encrypted.
If the BEEP proposal was treated as a transport mapping in the RFC3411
architecture, then the ASIs in RFC3411 might need to change to pass
this information from the transport mapping module to the message
module. Since BEEP was designed to be used with TCP, not UDP, then
even if BEEP could be treated strictly as a message or security model,
there would be a dependency on the transport model, and the current
architecure doesn't have a mechanism to permit specifying such a
dependency, so RFC3411 might need to be updated to accommodate this
(or not).

I expect that the security area has some written guidelines about the
aspects that must be considered when integrating a security protocol
with another protocol, that would be comparable to RFC3411's purpose
in the SNMP world.

But I don't know of a document that exists that documents operator
best current practice, except the work being done in OPSEC, which is
currently focused only on very large service provider requirements.
What would an operational expert use as the guidelines to judge
compliance to best current practices?

dbh

-----Original Message-----
From: Wes Hardaker [mailto:[email-masked]] 
Sent: Thursday, September 23, 2004 4:31 PM
To: Chris Elliott
Cc: David B Harrington; [email-masked]
Subject: Re: [Isms] ISMS solution seslection procedure

Oh, and they should be non-biased of course!  That'll be the tricky
part.

--
Wes Hardaker
Sparta