Subject: [Netconf] FW: David Harrington's Yes on draft-ietf-netconf-system-notifications-06:(with COMMENT)

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 1 Dec 2011 11:30:58 +0100

Please address the issue raised by David in his COMMENT. 

Thanks and Regards,

Dan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of David Harrington
Sent: Wednesday, November 30, 2011 10:47 PM
To: The IESG
Cc: [email-masked]; [email-masked]
Subject: David Harrington's Yes on draft-ietf-netconf-system-notifications-06:(with COMMENT)

David Harrington has entered the following ballot position for
draft-ietf-netconf-system-notifications-06: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

The security consideratiions could be improved by discussing what threat is posed by the specific data points. 

For example, netconf-config-change "indicates that the system configurastion has changed." I don't understand just what vulnerability this describes; is the concern about disclosing information about the system? or alerting a listening attacker that the system might now be more vulnerable? The sensitivity/vulnerability is not described. Ditto for many of these bullets.

---

From: Andy Bierman <[email-masked]>
Date: Thu, 01 Dec 2011 04:43:13 -0800

> Please address the issue raised by David in his COMMENT.

I can add text that says the administrator must be aware
of the specific capabilities and features supported by a server.
A change in system capabilities may alter the specific vulnerabilities
related to particular data models.  The capabilities themselves will not
be enough information to determine any particular security threat.

For example, if the acme implementation of version X of module foo is
known (a-priori) to have a buffer overflow exploit that is fixed in version Y,
then a capability change event that indicates module foo, version X
has been loaded into the system would notify the administrator of
new vulnerable device.  The same event for version Y would indicate
the vulnerability has been removed from the device.

There could be direct relationships between a data model capability event and a security threat,
such as loading a port-mirroring/packet capture module like RMON, which might
be exploited for unauthorized eavesdropping somehow.

Andy

> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>
>