Subject: RE: [Isms] CALL FOR CONSENSUS: ISMS Architecture

From: "Nelson, David" <[email-masked]>
Date: Wed, 4 May 2005 09:37:28 -0400

David Perkins writes...

> Reminder... The goal of the charter is to reduce OPERATIONAL
> costs, not the coding costs.

Actually, I thought the goal was to introduce a method for providing
SNMPv3 authentication and privacy that somehow re-used existing
authentication services that operator's have already deployed.

If the work product of ISMS can directly use the existing authentication
services, I think we have met that goal.  The re-use of existing
infrastructure minimizes operating costs.  The costs here are those of
deploying and maintaining multiple sets of authentication information,
when only one is required.

Some folks may desire the ability to use SNMPv3 authentication and
privacy without having *any* authentication infrastructure.  This seems
unlikely to have a realistic and robust solution.  Anonymous privacy is
certainly possible, but authentication without some database of
credentials seems to be a non sequitur.  

There will be some capital costs of any solution.  Operators are going
to have to upgrade at least some of the FW and SW they currently use to
newer versions that incorporate ISMS features.  I see no way around
that.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Wed, 4 May 2005 08:48:51 -0700 (PDT)

HI,

On the following...

> authentication services that operator's have already deployed.
Yes, this by reusing existing authentication services, operational
costs is reduced.

> when only one is required.
Absolutely!

I don't follow how the message below has anything to do with
reducing operational costs. Only time will tell what the cap-ex
will be with a new SNMP security model. More than likely, it will
be "nothing" to the network equipment users. For SNMP technology
suppliers and network equipment suppliers, I believe that dropping
USM and only providing ISMS will cost less over the long run (1 to
2 years). Over the last 5 months, I've added support for SNMPv3/USM
to a device, and it would have taken me about 1 month (or less)
if I had to provide SNMPv3/ISMS. No kidding. There were CLI
commands and pages (many) in the manuals that WOULD NOT have been
needed if SNMPv3/ISMS existed. The "break through way of thinking"
is that another security system ALREADY exists, and if SNMPv3/ISMS
just uses it (unmodified), then the incremental cost is
very low for coding and delivering SNMPv3/ISMS. And also, for
users, the incremental cost for deploying and using SNMPv3/ISMS
is very low compared to SNMPv3/USM.
> newer versions that incorporate ISMS features.  I see no way around

It's a shame that some vendors (including the ones that I have
provided support for SNMPv3) have gone through the costs of
bulking out the CLI and tech pubs. It's a real shame. (It was
a shame that vendors many years ago put in OSI protocols and
support for CMIP, only to rip them out (or let them die) when
there wasn't enough market demand. However, complaining that
the development work has already been done is not going to
change the market.)

Regards,
/david t. perkins