Subject: [OPSEC] OPSEC control plane protection draft

From: Richard Graveman <[email-masked]>
Date: Fri, 26 Mar 2010 12:06:40 -0400

David,

I read the draft carefully after the meeting and realize that my
comments missed the point of what the draft is trying to accomplish.
Sorry.

Nevertheless, I think the draft should mention that the protocols
allowed to reach the control plane (OSPF, RSVP, TCP, SNMP, DNS, NTP,
and of course, SSH, TLS, or ESP, etc.) may have cryptographic security
methods applied to them, and this is not a replacement for these
methods.

One other comment: although the examples use IPv4, the language in the
security considerations section is also IPv4-specific in places. I
suggest making it IPv4-IPv6 neutral.

I support taken this on in the WG.

Richard Graveman

---

From: David Dugal <[email-masked]>
Date: Fri, 26 Mar 2010 09:57:27 -0700

Hi Richard.

Thank you very much for the scrutiny, analysis and feedback.  As
mentioned during my brief presentation, our hope is that this
recommendation by example will provide awareness of a possible attack
surface occasionally overlooked, especially by smaller or newer
installations.

I appreciate the feedback and will enhance the draft to make reference
to cryptographic security, as well as attempt to make the document IP
version agnostic.

Thank you for your support, both in carefully reading the document, and
for your willingness to have our draft taken under the OPSEC WG wing.

- ---
David G. Dugal                           Support: +1-408-745-9500
Security Incident Response Team          Direct:  +1-978-589-0719
Juniper Networks                         Mobile:  +1-603-377-1162
Westford, MA, USA                        PGP Key: 0xAB6E02A5

On Fri Mar 26 2010 09:06:40 GMT-0700 (Pacific Daylight Time), Richard
Graveman <[email-masked]> proclaimed ...
> .

---

From: Rob Bird <[email-masked]>
Date: Fri, 26 Mar 2010 13:27:42 -0400

This is most excellent. I was just advising a customer this morning on this
very issue (again).

I look forward to working on this.
Rob

-
Rob Bird, Chief Technology Officer
Red Lambda, Inc.
"Network security at global scale"
www.redlambda.com

On Mar 26, 2010 1:03 PM, "David Dugal" <[email-masked]> wrote:

Hi Richard.

- ---

> comments missed the...

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.o...

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Fri, 26 Mar 2010 21:15:16 -0400

Richard,

These are great comments that will Improve the document -- many thanks.

Thumb typed by Carlos Pignataro.

On Mar 26, 2010, at 1:02 PM, "David Dugal" <[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi Richard.
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
>
> iEYEARECAAYFAkus53cACgkQh59lzatuAqVE9wCgh53mgxNRPWUztlI27aOITHRr
> 2zMAoPb5y3phm260P1zSoDu0LSbUjNcN
> =kitD
> -----END PGP SIGNATURE-----
>