Subject: RE: [Nea] Charter language on compromised endpoints

From: "Khosravi, Hormuzd M" <[email-masked]>
Date: Fri, 26 May 2006 14:51:17 -0700

Looks good to me, Steve.

We'll also add some text around this in the Requirements draft as you
suggested.

Thanks
Hormuzd

-----Original Message-----
From: Stephen Hanna [mailto:[email-masked]] 
Sent: Friday, May 26, 2006 1:35 PM
To: [email-masked]
Subject: [Nea] Charter language on compromised endpoints

Since several people on the NEA list have asked to have
the charter address the matter of compromised endpoints
but nobody has suggested that this should be in scope
for NEA (except that it will be addressed in the overall
security analysis), I propose adding the following text
to the current draft charter just before the milestones:

-----

One commonly discussed issue with NEA systems is how to
handle compromised endpoints, whose reports of their own
posture may not be accurate. This issue is out of scope
for the NEA working group except in the security analysis
section of the Requirements document.

-----

I invite comments on this proposal.

Thanks,

Steve

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "Sean Convery" <[email-masked]>
Date: Fri, 26 May 2006 23:15:05 -0700

Would it be appropriate to extend this wording to include some basic
statements that we, as a group, agree that there is value conferred on
the system even if some elements (the compromised ones) don't
accurately report their health? The wording as written seems to beg
the question, "Well why isn't it in scope?"

Thanks,

Sean