Subject: RE: [Isms] ISMS Operational Scenario/Goal

From: "Nelson, David" <[email-masked]>
Date: Wed, 2 Mar 2005 17:43:00 -0500

David Perkins writes...

> Please stick with an argument based on facts instead of
> stories, especially when the stories do not match the
> situation.

I though it both apt and instructive.  I'm sorry that you disagree.

> It seems like your argument is that the cost to define, code,
> and deploy a new SNMP security model with no changes to
> any existing security infrastructure, is more expensive
> than defining a new SNMP security model (that is similar
> to USM), and defining, coding, and deploying updates to
> the existing security models. Is that what you are saying?

I don't think so, but I'm having difficulty understanding your sentence.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Wed, 2 Mar 2005 14:58:52 -0800 (PST)

HI,

On Wed, 2 Mar 2005, Nelson, David wrote:
<stuff cut>
> I don't think so, but I'm having difficulty understanding your sentence.

Let me break it down for you....

Cost 1 consists of costs to:
1) define new SNMP security model
2) code new security model
3) deploy SNMP with new secuirty model
4) NOTE: no changes to existing security infrastructure

Cost 2 consists of costs to:
1) define a new SNMP secuirty model that is similar to USM
2) code new secuirty model
3) deploy new secuirty model
4) define extensions to existing security infrastructure to
   support the new security model
5) code new extensions
6) deploy new security structure extensions

So, are you saying that cost 1 is greater than cost 2?

Did I leave out any significant cost items?

Regards,
/david t. perkins

---

From: "Tom Petch" <[email-masked]>
Date: Fri, 4 Mar 2005 10:09:54 +0100

Ah but cost to whom?

Defining or amending a security model is a cost to us on this list.

Coding a new security model is a cost to manufacturers of SNMP engines,
'managers' and 'agents' (who may be lurking on this list).

Deploying is a cost to all those in the world who will use it from now until the
end of its life.  And has been pointed out, this community is not strongly
represented on
this list.

When I was designing software, I was sadly ignorant of this last cost, which in
any widely deployed system vastly outweighs the previous two costs (orders of
magnitude was once suggested to me).  So when I look at isms, I first think will
it reuse all the effort that has been put into setting up roles, groups, users,
secret info, management and logging of violations, etc etc perhaps at great cost
over a long time in an existing, maybe not very network-oriented, security
system?

My reading of Wes' survey is that it is that that needs to be reused, not just a
particular flavour of a particular existing protocol.

So no, it is not a question of leaving out, rather of the different magnitude of
items to different  people.

And I do see these considerations as part of the requirements of isms even
though they do not appear in RFC3411.

Tom Petch

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 04 Mar 2005 06:44:36 -0800

>>>>> On Fri, 4 Mar 2005 10:09:54 +0100, "Tom Petch" <[email-masked]> said:

Tom> So no, it is not a question of leaving out, rather of the
Tom> different magnitude of items to different people.

You've defined 3 groups of people that would be affected by cost.
Maybe analyzing each cost David P. proposed, and any that people feel
he left out, by each group of people would show something?

-- 
Wes Hardaker
Sparta