Subject: Policy terminology relationship to security terminology

From: "Bert Wijnen" <[email-masked]>
Date: Thu, 4 Nov 99 21:08:59 CET

Ref:  Your note of Thu, 4 Nov 1999 10:38:54 -0500

Subject: Re:   Policy terminology relationship to security terminology

Thanks for your input/comments.
May I point you all to the POLTERM BOF (Friday 9-11:30) which is a
BOF to try and come to a set of common terms for Policy Based Network
Management.

Here is the agenda for that BOF:

Bert
---------------- draft agenda for POLTERM BOF ---------------
Date: Monday 1 November 1999, 11:51:49 +0100 (CET)
From: Bert Wijnen                                    WIJNEN   at vnet.ibm.com
To:   agenda   at ietf.org
Subject: Prelimenary agenda for CFGMGMT BOF

Title:     BOF on Terminology for Policy Based (Network) Management
Time:      09:00-11:30 on Friday 12 November
Place:     46th IETF in Wahsington D.C., Blue room
Chair(s):  Bert Wijnen and Randy Bush

The goal of the BOF is as follows:

  Discuss the terminology used in various WGs w.r.t. Policy Based
  (Network) Management. Then try to come to a common set of terms
  that we can all agree upon and that we then want each WG to
  start using. This will make it easier to discuss and read the
  documents being produced by these WGs; to list some:

    POLICY   - Policy Framework WG
    RAP      - Resource Allocation Protocols WG
    DIFFSERV - Differentiated Services WG
    IPSP     - IPsec Policy BOF

Agenda:
-------
 5 min - Agenda bashing
 5 min - Introduction (Bert Wijnen)
30 min - Policy Terminology by Design Team
         Francis Reichmeyer and Mark Stevens
60 min - Other terms used throughout the various documents
         Francis Reichmeyer and Mark Stevens
30 min - Other terms to consider from participants
         (pls inform BOF chairs asap if you want to present any).
20 min - Wrapup

And very important, the reading materials are:

- First, the document produced by the Design Team:

  http://www.ietf.org/internet-drafts/draft-ops-mumble-terminology-00.txt
  this one should have as date: October 22nd

- Other documents containing terminology from the various WGs or
  otherwise relevant:

  http://www.ietf.org/internet-drafts/draft-ietf-policy-framework-00.txt
  http://www.ietf.org/internet-drafts/draft-ietf-policy-terms-00.txt
  http://www.ietf.org/internet-drafts/draft-ietf-rap-framework-03.txt
  http://www.ietf.org/internet-drafts/draft-ietf-rap-cops-pr-01.txt

Bert and Randy

---

From: Francis Reichmeyer -NJ <[email-masked]>
Date: Thu, 4 Nov 1999 23:34:25 -0500

Rob,

As you noted, the policy terms draft is being folded into
another draft (draft-ops-mumble-terminology-00.txt). This
draft is (will be, anyway, in next rev) trying to define
policy terms on a broader scope than QoS alone. The
design team for this draft originally included someone from
the security area, but unfortunately security policy terms
aren't sufficiently covered in the -00 draft. We will
look over your comments here and the glossary draft you
mention and incorporate into the unified terminology draft.
The draft is being discussed in the POLIICY TERM BOF on
Friday next week in D.C.

Thanks,
-Fran

> -----Original Message-----
> From: Robert W. Shirey [mailto:[email-masked]]
> Sent: Thursday, November 04, 1999 10:39 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]; Jeffrey I. Schiller; Marcus Leech
> Subject: Policy terminology relationship to security terminology
> 
> 
> In "Terminology for Describing Network Policy and Services"
> <draft-ietf-policy-terms-00.txt>, the authors undertake the laudable
> (although probably thankless) task of trying to provide a 
> decent set of
> terms and definitions. (John Strassner tells me that the 
> material of the
> terminology draft is being folded into another I-D, but that does not
> matter for the purpose of the comments and suggestions I am 
> about to make
> here.)
> 
> Although the immediate area of application of the terminology 
> is policy for
> quality of service with regard to delay and throughput, it is 
> desirable
> that the policy terminology and framework be compatible with 
> other kinds of
> "qualities", no? In particular, I am interested in the quality of
> "security":
> 
> -----
> $ security
> (I) (1.) Measures taken to protect a system. (2.) The 
> condition of a system
> that results from the establishment and maintenance of 
> measures to protect
> the system. (3.) The condition of system resources being free from
> unauthorized access and from unauthorized or accidental change,
> destruction, or loss.
> -----
> 
> Among the terms being defined by the Policy Working Group are 
> "mechanism",
> "service", "domain", and "policy". Need I point out that "security
> mechanism", "security service", "security domain", and 
> "security policy"
> are terms commonly used in STD RFCs and other Internet 
> Standards Process
> documents? In fact, some of these terms are also 
> well-established in ITU-T
> and ISO standards.
> 
> -----
> $ security mechanism
> (I) A process (or a device incorporating such a process) that 
> can be used
> in a system to implement a security service that is provided 
> by or within
> the system. (See: (discussion under) security policy.)
> 
> (C) Some examples of security mechanisms are encryption, 
> digital signature,
> authentication exchange, and traffic padding.
> 
> $ security policy
> (I) A set of rules and practices that specify or regulate how 
> a system or
> organization provides security services to protect sensitive 
> and critical
> system resources.
> 
> (O) "The set of rules laid down by the security authority 
> governing the use
> and provision of security services and facilities." [X509]
> 
> $ security service
> (I) A processing or communication service that is provided by 
> a system to
> give a specific kind of protection to system resources.
> 
> (O) "A service, provided by a layer of communicating open 
> systems, which
> ensures adequate security of the systems or the data 
> transfers." [I7498
> Part 2]
> 
> (C) Security services implement security policies, and are 
> implemented by
> security mechanisms.
> -----
> 
> Surely you will agree that:
> 
> (a) "Security" is just one of several "qualities of service" 
> with which
> Internet Standards are concerned now or will be in the future.
> 
> (b) It should be possible to use the name of one of these 
> qualities as an
> adjective in front of "mechanism", "policy", "service", and 
> other terms
> that you are defining without needing to provide a separate, specific
> definition that conflicts with or invalidates the general definition
> provided by the more general, overarching service policy framework. In
> fact, I was looking the Policy WG documents because of 
> ongoing research
> work in the area of network security policy speicification 
> and management,
> hoping to use some of the Policy WG material as a framework 
> for our work.
> 
> Therefore, I would ask the Policy WG to look at their 
> definitions from the
> viewpoint of providing a general set of base terms that can 
> be modified
> (without redefinition) by "security", "routing", and other specific
> "quality" adjectives.
> 
> Please test the Policy WG definitions by comparing them to 
> the definitions
> in <draft-shirey-security-glossary-01.txt>. When your 
> definitions have been
> rolled into the next draft of the "Policy Framework" as John 
> has told me, I
> will review the definitions from the security viewpoint and provide
> specific comments.
> 
> Regards, -Rob-
> 
> Robert W. Shirey     GTE Internetworking     Security Practice Center
> Suite 1200, 1300 Seventeenth St. North, Arlington, VA  22209-3801 USA
> [email-masked], Phone 703-284-4641, Reception 284-4600, Fax 284-2766
> 
> 
> 
> 
> 
>