Subject: Policy terminology relationship to security terminology

From: "Robert W. Shirey" <[email-masked]>
Date: Thu, 4 Nov 1999 10:38:54 -0500

In "Terminology for Describing Network Policy and Services"
<draft-ietf-policy-terms-00.txt>, the authors undertake the laudable
(although probably thankless) task of trying to provide a decent set of
terms and definitions. (John Strassner tells me that the material of the
terminology draft is being folded into another I-D, but that does not
matter for the purpose of the comments and suggestions I am about to make
here.)

Although the immediate area of application of the terminology is policy for
quality of service with regard to delay and throughput, it is desirable
that the policy terminology and framework be compatible with other kinds of
"qualities", no? In particular, I am interested in the quality of
"security":

-----
$ security
(I) (1.) Measures taken to protect a system. (2.) The condition of a system
that results from the establishment and maintenance of measures to protect
the system. (3.) The condition of system resources being free from
unauthorized access and from unauthorized or accidental change,
destruction, or loss.
-----

Among the terms being defined by the Policy Working Group are "mechanism",
"service", "domain", and "policy". Need I point out that "security
mechanism", "security service", "security domain", and "security policy"
are terms commonly used in STD RFCs and other Internet Standards Process
documents? In fact, some of these terms are also well-established in ITU-T
and ISO standards.

-----
$ security mechanism
(I) A process (or a device incorporating such a process) that can be used
in a system to implement a security service that is provided by or within
the system. (See: (discussion under) security policy.)

(C) Some examples of security mechanisms are encryption, digital signature,
authentication exchange, and traffic padding.

$ security policy
(I) A set of rules and practices that specify or regulate how a system or
organization provides security services to protect sensitive and critical
system resources.

(O) "The set of rules laid down by the security authority governing the use
and provision of security services and facilities." [X509]

$ security service
(I) A processing or communication service that is provided by a system to
give a specific kind of protection to system resources.

(O) "A service, provided by a layer of communicating open systems, which
ensures adequate security of the systems or the data transfers." [I7498
Part 2]

(C) Security services implement security policies, and are implemented by
security mechanisms.
-----

Surely you will agree that:

(a) "Security" is just one of several "qualities of service" with which
Internet Standards are concerned now or will be in the future.

(b) It should be possible to use the name of one of these qualities as an
adjective in front of "mechanism", "policy", "service", and other terms
that you are defining without needing to provide a separate, specific
definition that conflicts with or invalidates the general definition
provided by the more general, overarching service policy framework. In
fact, I was looking the Policy WG documents because of ongoing research
work in the area of network security policy speicification and management,
hoping to use some of the Policy WG material as a framework for our work.

Therefore, I would ask the Policy WG to look at their definitions from the
viewpoint of providing a general set of base terms that can be modified
(without redefinition) by "security", "routing", and other specific
"quality" adjectives.

Please test the Policy WG definitions by comparing them to the definitions
in <draft-shirey-security-glossary-01.txt>. When your definitions have been
rolled into the next draft of the "Policy Framework" as John has told me, I
will review the definitions from the security viewpoint and provide
specific comments.

Regards, -Rob-

Robert W. Shirey     GTE Internetworking     Security Practice Center
Suite 1200, 1300 Seventeenth St. North, Arlington, VA  22209-3801 USA
[email-masked], Phone 703-284-4641, Reception 284-4600, Fax 284-2766

---

From: "John Strassner" <[email-masked]>
Date: Thu, 4 Nov 1999 09:31:01 -0800

repeating due to mail failure...

Policy Enthusiasts,

attached is the agenda for next week's Policy Framework WG
meetings. The relevant wg document for each session is also 
defined for your convenience.

MONDAY, November 8, 1999
Time:   1530-1730  Afternoon Sessions II
Where: Regency     OPS  policy    Policy Framework WG *

(10) Agenda Bashing         Ellesson and Strassner
(10) Status                        Ellesson and Strassner
(45) Policy Requirements   Mahon, et. al.
        draft-ietf-policy-req-01.txt
(45) Policy Framework      Stevens, et. al.
       draft-ietf-policy-framework-00.txt

TUESDAY, November 9, 1999
0900-1130  Morning Sessions
Regency     OPS  policy    Policy Framework WG *

(5)   Agenda review           Ellesson and Strassner
(30) Core Info Model        Moore, et. al.
        draft-ietf-policy-core-info-model-02.txt
(40) LDAP Schema           Moore, et. al.
        draft-ietf-policy-core-schema-05.txt
(45) QoS Policy Model     Snir, et. al.
        draft-snir-policy-qos-infomodel-01.txt
        (home page is wrong, get this from the repository)
(30) Device QoS Model    Weiss, et. al.
        draft-weiss-policy-device-qos-model-00.txt
        (the -01 version of this draft did not make the
         cutoff, but will be posted asap)

regards,
John and Ed