Subject: [Add] Fwd: New Version Notification for draft-reddy-add-enterprise-policy-01.txt

From: tirumal reddy <[email-masked]>
Date: Tue, 8 Mar 2022 15:33:47 +0530

Hi all,

The draft https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-
policy specifies a mechanism to inform endpoints about the network policy to
use the network-designated DNS resolvers.

Comments and suggestions are welcome.

-Tiru, Dan & Kevin

---------- Forwarded message ---------
From: <[email-masked]>
Date: Wed, 2 Mar 2022 at 15:46
Subject: New Version Notification for
draft-reddy-add-enterprise-policy-01.txt
To: Tirumaleswar Reddy.K <[email-masked]>, Dan Wing <[email-masked]>,
Kevin Smith <[email-masked]>

A new version of I-D, draft-reddy-add-enterprise-policy-01.txt
has been successfully submitted by Tirumaleswar Reddy and posted to the
IETF repository.

Name:           draft-reddy-add-enterprise-policy
Revision:       01
Title:          Network policy to use Network-designated DNS Resolvers
Document date:  2022-03-02
Group:          Individual Submission
Pages:          11
URL:
https://www.ietf.org/archive/id/draft-reddy-add-enterprise-policy-01.txt
Status:
https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-policy/
Htmlized:
https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-policy
Diff:
https://www.ietf.org/rfcdiff?url2=draft-reddy-add-enterprise-policy-01

Abstract:
   This document specifies a mechanism to inform endpoints about any
   network policy mandating the use of network-designated DNS resolvers.

The IETF Secretariat

---

From: Ben Schwartz <[email-masked]>
Date: Wed, 9 Mar 2022 12:15:44 -0500

Overall, I think the draft fundamentally is making a bad security
recommendation.  If a network operator has a security goal that involves
control of clients' DNS activity, then it must not allow unmanaged devices
to use that network.  Unmanaged BYOD is simply not compatible with
network-based security.  With the rise of zero-trust models, remote work,
remote learning, and pervasive cell network access, I think this
combination is best viewed as a legacy practice to be warned against, not
fine-tuned.  If you have unmanaged devices on your secure network, you
don't have a secure network.

I'm grateful to the authors for clarifying the scope of this draft, and
especially this text:

   If
>    joining an un-trusted network (e.g., coffeeshop, hotel, airport
>    network), a True value of NetworkDNSOnly MUST be ignored.  The
>    mechanism the client uses to determine 'trusted network' to assist
>    the user MUST involve authenticated identity of the network (not
>    merely matching SSID in the case of WiFi), such as 802.1X or
>    confirming the network-designated encrypted resolver name is pre-
>    configured in the Operating System and TLS handshake with it
>    succeeds.

That last bit seems worrying, though.  Can any untrusted network force me
to stop using my personalized DoT resolver, by switching me to any of the
"pre-configured" resolvers listed by my OS vendor?  That seems like a
particularly poor result.

On Tue, Mar 8, 2022 at 5:04 AM tirumal reddy <[email-masked]> wrote:

> Hi all,
>
> The draft https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise
> -policy specifies a mechanism to inform endpoints about the network policy to
> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: Tommy Jensen <[email-masked]>
Date: Wed, 9 Mar 2022 17:39:52 +0000

I could not agree more with your framing of the situation. As I believe Éric pointed out during the chat of our last meeting, MDM style management is becoming very common. Saying "a properly secured network needs to manage the behavior of its clients and prevent other clients from joining" is perfectly reasonable in my opinion, even if the network owner wants to invite BYOD on the terms of "submit to management".

Thanks,
Tommy

From: Add <[email-masked]> On Behalf Of Ben Schwartz
Sent: Wednesday, March 9, 2022 9:16 AM
To: tirumal reddy <[email-masked]>
Cc: ADD Mailing list <[email-masked]>
Subject: [EXTERNAL] Re: [Add] Fwd: New Version Notification for draft-reddy-add-enterprise-policy-01.txt

Overall, I think the draft fundamentally is making a bad security recommendation.  If a network operator has a security goal that involves control of clients' DNS activity, then it must not allow unmanaged devices to use that network.  Unmanaged BYOD is simply not compatible with network-based security.  With the rise of zero-trust models, remote work, remote learning, and pervasive cell network access, I think this combination is best viewed as a legacy practice to be warned against, not fine-tuned.  If you have unmanaged devices on your secure network, you don't have a secure network.

I'm grateful to the authors for clarifying the scope of this draft, and especially this text:

   If

That last bit seems worrying, though.  Can any untrusted network force me to stop using my personalized DoT resolver, by switching me to any of the "pre-configured" resolvers listed by my OS vendor?  That seems like a particularly poor result.

On Tue, Mar 8, 2022 at 5:04 AM tirumal reddy <[email-masked]<mailto:[email-masked]>> wrote:
Hi all,

The draft https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-policy<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-reddy-add-enterprise-policy&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TbR6ArldxM6aVUMAHvJ%2BJn%2FFbYm%2FBTRfvAqMvSPW81U%3D&reserved=0> specifies a mechanism to inform endpoints about the network policy to use the network-designated DNS resolvers.

-Tiru, Dan & Kevin

---------- Forwarded message ---------
From: <[email-masked]<mailto:[email-masked]>>
Date: Wed, 2 Mar 2022 at 15:46
Subject: New Version Notification for draft-reddy-add-enterprise-policy-01.txt
To: Tirumaleswar Reddy.K <[email-masked]<mailto:[email-masked]>>, Dan Wing <[email-masked]<mailto:[email-masked]>>, Kevin Smith <[email-masked]<mailto:[email-masked]>>

Name:           draft-reddy-add-enterprise-policy
Revision:       01
Title:          Network policy to use Network-designated DNS Resolvers
Document date:  2022-03-02
Group:          Individual Submission
Pages:          11
URL:            https://www.ietf.org/archive/id/draft-reddy-add-enterprise-policy-01.txt<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-reddy-add-enterprise-policy-01.txt&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=1EML5PPd9tfpLWgMyDe4dWzdfLRs%2Bi7fM4I6W6UYE3s%3D&reserved=0>
Status:         https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-policy/<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-reddy-add-enterprise-policy%2F&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=%2FyadNdEx%2Bez1AnL2HDqg2JfDrK22dpdGlbycmKMOxRE%3D&reserved=0>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-policy<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-reddy-add-enterprise-policy&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TbR6ArldxM6aVUMAHvJ%2BJn%2FFbYm%2FBTRfvAqMvSPW81U%3D&reserved=0>
Diff:           https://www.ietf.org/rfcdiff?url2=draft-reddy-add-enterprise-policy-01<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-reddy-add-enterprise-policy-01&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=j21RYeukF1HXpl3HaSwPuc54CnK2v%2Bo3Ex01c25179I%3D&reserved=0>

Abstract:

The IETF Secretariat

--
Add mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/add<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fadd&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=jxwwRAb0ENZAiBeBs0qcGIAytZdkcOUMpAB%2BDhH9RX4%3D&reserved=0>

---

From: Joe Abley <[email-masked]>
Date: Wed, 9 Mar 2022 12:58:41 -0500

I like the general framing of your text, Tommy, except that I would refrain from suggesting that something is "proper" especially given (e.g. as Ben as noted) much modern thinking points towards acknowledgement that the network is untrusted.

> On 9 Mar 2022, at 12:39, Tommy Jensen <Jensen.Thomas=[email-masked]> wrote:
> 
> I could not agree more with your framing of the situation. As I believe Éric pointed out during the chat of our last meeting, MDM style management is becoming very common. Saying “a properly secured network needs to manage the behavior of its clients and prevent other clients from joining” is perfectly reasonable in my opinion, even if the network owner wants to invite BYOD on the terms of “submit to management”.
>  
> Thanks,
> Tommy
>  
> On Tue, Mar 8, 2022 at 5:04 AM tirumal reddy <[email-masked] <mailto:[email-masked]>> wrote:
> Hi all,
>  
> The draft https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-policy <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-reddy-add-enterprise-policy&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TbR6ArldxM6aVUMAHvJ%2BJn%2FFbYm%2FBTRfvAqMvSPW81U%3D&reserved=0> specifies a mechanism to inform endpoints about the network policy to use the network-designated DNS resolvers. 
>  
> From: <[email-masked] <mailto:[email-masked]>>
> To: Tirumaleswar Reddy.K <[email-masked] <mailto:[email-masked]>>, Dan Wing <[email-masked] <mailto:[email-masked]>>, Kevin Smith <[email-masked] <mailto:[email-masked]>>
> 
> 
> 
> URL:            https://www.ietf.org/archive/id/draft-reddy-add-enterprise-policy-01.txt <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-reddy-add-enterprise-policy-01.txt&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=1EML5PPd9tfpLWgMyDe4dWzdfLRs%2Bi7fM4I6W6UYE3s%3D&reserved=0>
> Status:         https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-policy/ <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-reddy-add-enterprise-policy%2F&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=%2FyadNdEx%2Bez1AnL2HDqg2JfDrK22dpdGlbycmKMOxRE%3D&reserved=0>
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-policy <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-reddy-add-enterprise-policy&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TbR6ArldxM6aVUMAHvJ%2BJn%2FFbYm%2FBTRfvAqMvSPW81U%3D&reserved=0>
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-reddy-add-enterprise-policy-01 <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-reddy-add-enterprise-policy-01&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=j21RYeukF1HXpl3HaSwPuc54CnK2v%2Bo3Ex01c25179I%3D&reserved=0>
> 
> Abstract:
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/add <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fadd&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=jxwwRAb0ENZAiBeBs0qcGIAytZdkcOUMpAB%2BDhH9RX4%3D&reserved=0>-- 
> Add mailing list
> [email-masked]

---

From: Tommy Jensen <[email-masked]>
Date: Wed, 9 Mar 2022 18:09:22 +0000

My quote there does not apply to Zero-Trust deployments, where all networks are presumed to be hostile, nor to label them as improper (that is, imo, the superior way to handle nomadic and roaming devices). That was specifically in the context of a threat model where the network is trusted (consider a non-roaming corporate device such as a server or desktop, especially one without general Internet access) to say that doing such a deployment "properly" means you need to manage *all* the clients on the same network if you are going to place trust in said network.

Thanks,
Tommy Jensen

Need new DNS/HTTP work?
https://aka.ms/featureask_dnsclient
https://aka.ms/featureask_httpsys
https://aka.ms/featureask_winhttp

Need to file an HTTP server bug? Don't forget to gather traces!
https://aka.ms/httpsysbug
https://aka.ms/gathertraces

From: Joe Abley <[email-masked]>
Sent: Wednesday, March 9, 2022 9:59 AM
To: Tommy Jensen <[email-masked]>
Cc: Ben Schwartz <[email-masked]>; tirumal reddy <[email-masked]>; ADD Mailing list <[email-masked]>
Subject: Re: [Add] [EXTERNAL] Re: Fwd: New Version Notification for draft-reddy-add-enterprise-policy-01.txt

On 9 Mar 2022, at 12:39, Tommy Jensen <Jensen.Thomas=[email-masked]<mailto:Jensen.Thomas=[email-masked]>> wrote:

Thanks,
Tommy

From: Add <[email-masked]<mailto:[email-masked]>> On Behalf Of Ben Schwartz
Sent: Wednesday, March 9, 2022 9:16 AM
To: tirumal reddy <[email-masked]<mailto:[email-masked]>>
Cc: ADD Mailing list <[email-masked]<mailto:[email-masked]>>
Subject: [EXTERNAL] Re: [Add] Fwd: New Version Notification for draft-reddy-add-enterprise-policy-01.txt

   If

The draft https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-policy<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-reddy-add-enterprise-policy&data=04%7C01%7CJensen.Thomas%40microsoft.com%7Cb7b3fa35f42242d9230808da01f67981%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824456142359593%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=DWQwlf%2BgbDRpJXOzn5wMi2i3jEs3YHREruYRRe1r3OM%3D&reserved=0> specifies a mechanism to inform endpoints about the network policy to use the network-designated DNS resolvers.

-Tiru, Dan & Kevin

---------- Forwarded message ---------
From: <[email-masked]<mailto:[email-masked]>>
Date: Wed, 2 Mar 2022 at 15:46
Subject: New Version Notification for draft-reddy-add-enterprise-policy-01.txt
To: Tirumaleswar Reddy.K <[email-masked]<mailto:[email-masked]>>, Dan Wing <[email-masked]<mailto:[email-masked]>>, Kevin Smith <[email-masked]<mailto:[email-masked]>>

Name:           draft-reddy-add-enterprise-policy
Revision:       01
Title:          Network policy to use Network-designated DNS Resolvers
Document date:  2022-03-02
Group:          Individual Submission
Pages:          11
URL:            https://www.ietf.org/archive/id/draft-reddy-add-enterprise-policy-01.txt<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-reddy-add-enterprise-policy-01.txt&data=04%7C01%7CJensen.Thomas%40microsoft.com%7Cb7b3fa35f42242d9230808da01f67981%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824456142359593%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=tWknHOa1trp7oz3IcFLGYNV%2BmN%2BP4uobQppdyn8nfJw%3D&reserved=0>
Status:         https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-policy/<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-reddy-add-enterprise-policy%2F&data=04%7C01%7CJensen.Thomas%40microsoft.com%7Cb7b3fa35f42242d9230808da01f67981%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824456142359593%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=VnlfdclKY9pRLSIOhGWY61IwghHee37lPUBhQYWE43M%3D&reserved=0>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-policy<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-reddy-add-enterprise-policy&data=04%7C01%7CJensen.Thomas%40microsoft.com%7Cb7b3fa35f42242d9230808da01f67981%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824456142359593%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=DWQwlf%2BgbDRpJXOzn5wMi2i3jEs3YHREruYRRe1r3OM%3D&reserved=0>
Diff:           https://www.ietf.org/rfcdiff?url2=draft-reddy-add-enterprise-policy-01<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-reddy-add-enterprise-policy-01&data=04%7C01%7CJensen.Thomas%40microsoft.com%7Cb7b3fa35f42242d9230808da01f67981%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824456142359593%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=OzYDWYSywTdeoOLjPpbZDTjXZaPMWx1zstqMCBP2wU8%3D&reserved=0>

Abstract:

The IETF Secretariat

--
Add mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/add<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fadd&data=04%7C01%7CJensen.Thomas%40microsoft.com%7Cb7b3fa35f42242d9230808da01f67981%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824456142359593%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=U0K0ZeEGW5keyrNRO%2BqSM0TLhCupuGqZ4pY4qcc4rDo%3D&reserved=0>
--
Add mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/add<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fadd&data=04%7C01%7CJensen.Thomas%40microsoft.com%7Cb7b3fa35f42242d9230808da01f67981%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824456142359593%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=U0K0ZeEGW5keyrNRO%2BqSM0TLhCupuGqZ4pY4qcc4rDo%3D&reserved=0>

---

From: tirumal reddy <[email-masked]>
Date: Thu, 10 Mar 2022 13:05:25 +0530

On Wed, 9 Mar 2022 at 22:45, Ben Schwartz <[email-masked]> wrote:

> network-based security.

MDM has its challenges in some deployments, users are skeptical to install
MDM on personal devices. Alternatively, lite-weight agents are provided to
endpoints to only convey the security posture of the device to the network
(for example, see
https://duo.com/blog/available-now-duo-device-health-app-extends-security-checks-for-desktops-and-laptops
).

> With the rise of zero-trust models, remote work, remote learning, and
> pervasive cell network access, I think this combination is best viewed as a
> legacy practice to be warned against, not fine-tuned.  If you have
> unmanaged devices on your secure network, you don't have a secure network.
>

Good catch, will remove the text. Thanks.

Cheers,
-Tiru

>> The draft https://datatracker.ietf.org/doc/html/draft-reddy-add-
>> enterprise-policy specifies a mechanism to inform endpoints about the
>> network policy to use the network-designated DNS resolvers.
>>

---

From: tirumal reddy <[email-masked]>
Date: Thu, 10 Mar 2022 14:24:54 +0530

On Wed, 9 Mar 2022 at 23:09, Tommy Jensen <[email-masked]>
wrote:

> I could not agree more with your framing of the situation. As I believe
> Éric pointed out during the chat of our last meeting, MDM style management
> is becoming very common. Saying “a properly secured network needs to manage
> the behavior of its clients and prevent other clients from joining” is
> perfectly reasonable in my opinion, even if the network owner wants to
> invite BYOD on the terms of “submit to management”.
>

MDM is not mandatory for Enterprise deployments. If it was mandatory,
Enterprise DNS filtering would not have to block access to encrypted
resolvers not signalled by the network (see
https://umbrella.cisco.com/blog/doh-dns-over-https-to-block-or-not-to-block
for more details).

-Tiru

>
>
> Thanks,
> Tommy
>
>
>
> *From:* Add <[email-masked]> *On Behalf Of * Ben Schwartz
> *Sent:* Wednesday, March 9, 2022 9:16 AM
> *To:* tirumal reddy <[email-masked]>
> *Cc:* ADD Mailing list <[email-masked]>
> *Subject:* [EXTERNAL] Re: [Add] Fwd: New Version Notification for
> The draft
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-reddy-add-enterprise-policy&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TbR6ArldxM6aVUMAHvJ%2BJn%2FFbYm%2FBTRfvAqMvSPW81U%3D&reserved=0> specifies
> a mechanism to inform endpoints about the network policy to use the
> network-designated DNS resolvers.
>
>
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Farchive%2Fid%2Fdraft-reddy-add-enterprise-policy-01.txt&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=1EML5PPd9tfpLWgMyDe4dWzdfLRs%2Bi7fM4I6W6UYE3s%3D&reserved=0>
> Status:
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-reddy-add-enterprise-policy%2F&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=%2FyadNdEx%2Bez1AnL2HDqg2JfDrK22dpdGlbycmKMOxRE%3D&reserved=0>
> Htmlized:
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-reddy-add-enterprise-policy&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TbR6ArldxM6aVUMAHvJ%2BJn%2FFbYm%2FBTRfvAqMvSPW81U%3D&reserved=0>
> Diff:
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-reddy-add-enterprise-policy-01&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=j21RYeukF1HXpl3HaSwPuc54CnK2v%2Bo3Ex01c25179I%3D&reserved=0>
>
> Abstract:
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fadd&data=04%7C01%7CJensen.Thomas%40microsoft.com%7C593ca3f09c1641aa21ba08da01f081e8%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637824429765566234%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=jxwwRAb0ENZAiBeBs0qcGIAytZdkcOUMpAB%2BDhH9RX4%3D&reserved=0>
>
>