Subject: Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)

From: adammontville <[email-masked]>
Date: Fri, 07 Aug 2015 04:38:43 -0700

I agree that privacy needs to be covered.  

Still, when we talk about *identity* or *identification* in this working group, we're talking about something different than PII data.  As such, there's this other issue for the information model https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/21, which is seeking to get feedback on what a useful term other than identity might be.  The present candidate seems to be *designate*.  So, instead of "identify an endpoint" we would "designate an endpoint" or "collect AVPs from the designated set of endpoints".  

I also wouldn't go so far as to say that we're performing pervasive monitoring in the sense that mainstream media understands the term.  Our scope has always been single-enterprise, and it remains that way.

Again, privacy is important, but I don't think we're talking about PII as much as might be implied by our choice of terms.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/55#issuecomment-128680469

---

From: Ron Colvin <[email-masked]>
Date: Fri, 7 Aug 2015 10:01:12 -0400

My understanding on PII is that as soon as I associate a person with an 
email address, phone number or physical address I have PII that I need 
to protect. If we associate a user id, account or user provisioned PKI 
with a device including possibly a MAC address we probably have the same 
concerns.

I think in many cases user certificates are used for device 
authentication and I thought that was an attribute that was highly 
desirable.

On 8/7/15 7:38 AM, adammontville wrote:
> Still, when we talk about /identity/ or /identification/ in this 
> working group, we're talking about something different than PII data. 
> As such, there's this other issue for the information model 
> sacmwg/draft-ietf-sacm-information-model#21 
> <https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/21>, 
> which is seeking to get feedback on what a useful term other than 
> identity might be. The present candidate seems to be /designate/. So, 
> instead of "identify an endpoint" we would "designate an endpoint" or 
> "collect AVPs from the designated set of endpoints".
>
> I also wouldn't go so far as to say that we're performing pervasive 
> monitoring in the sense that mainstream media understands the term. 
> Our scope has always been single-enterprise, and it remains that way.
>
> Again, privacy is important, but I don't think we're talking about PII 
> as much as might be implied by our choice of terms.
>
> —
> Reply to this email directly or view it on GitHub 
> <https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/55#issuecomment-128680469>.
>
>
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

-- 

********************************************************
Ron Colvin CISSP, CAP, CEH
Certified Security Analyst
NASA - Goddard Space Flight Center
<[email-masked]>
Direct phone 301-286-2451
NASA Jabber ([email-masked]) AIM rcolvin13
NASA LCS ([email-masked])
********************************************************

---

From: Ira McDonald <[email-masked]>
Date: Fri, 7 Aug 2015 10:51:57 -0400

Hi,

When an enterprise network is breached by an outside attacker (using "if"
no longer seems appropriate) or is compromised by an inside attacker, the
SACM components that have datastores of devices and associated identity
info as well as (often) associated user identities are high-value targets of
attacks for bulk theft of PII.

By its fundamental nature, SACM increases the threat of exposure of PII
and therefore should address anonymization of individual device identity
info and strong controls on the dissemination of that info to subscribers.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Winter  579 Park Place  Saline, MI  48176  734-944-0094
Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434

On Fri, Aug 7, 2015 at 10:01 AM, Ron Colvin <[email-masked]> wrote:

> email address, phone number or physical address I have PII that I need to
> protect. If we associate a user id, account or user provisioned PKI with a
> device including possibly a MAC address we probably have the same concerns.
>
> I think in many cases user certificates are used for device authentication
> and I thought that was an attribute that was highly desirable.
>
>
> Still, when we talk about *identity* or *identification* in this working
> group, we're talking about something different than PII data. As such,
> there's this other issue for the information model
> which is seeking to get feedback on what a useful term other than identity
> might be. The present candidate seems to be *designate*. So, instead of
> "identify an endpoint" we would "designate an endpoint" or "collect AVPs
> from the designated set of endpoints".
>
> monitoring in the sense that mainstream media understands the term. Our
> scope has always been single-enterprise, and it remains that way.
>
> Again, privacy is important, but I don't think we're talking about PII as
> much as might be implied by our choice of terms.
>
> —
> sacm mailing [email-masked]://www.ietf.org/mailman/listinfo/sacm
>
>
> --
>
>
> NASA - Goddard Space Flight Center<[email-masked]> <[email-masked]>

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 7 Aug 2015 11:35:07 -0400

Hello,

This is a good discussion and it seems that it is getting to the right
set of points, that we do need to worry about index data and ways to
correlate information back to systems and possibly to users of those
systems or whose data crosses those systems.

Jim is right on the PM angle, but you can phrase this lots of ways.
In terms of privacy, we worry about indexes, anything considered
sensitive that requires confidentiality related to privacy, and PII.
There are lots of ways to handle this and that will be up to the WG to
decide how to provide such guidance.  We do have materials to help you
from the view of developing protocols.

Here are some links from a slide I've been using in presentations
(please do read the RFC listed, it's very helpful):
IETF Privacy Considerations for Internet protocols
  –https://datatracker.ietf.org/doc/rfc6973/
  –Data protection
     ▪Object level encryption
     ▪Determining when data is not necessary
     ▪Obscuring data or generalizing when possible
     ▪Protections on sensitive data and indexes to that data
  –Push for encrypted traffic
IAB Statement on Internet Confidentiality
  –https://www.iab.org/2014/11/14/iab-statement-on-internet-confidentiality/

Pervasive Monitoring is an Attack
  –RFC7258/BCP188 published after major IETF LC debate – sets the
basis for further actions
  –https://www.rfc-editor.org/rfc/rfc7258.txt

In case you missed the tech plenary for IETF88 and you prefer video
over reading (or in addition), this was a great plenary that gives
background into these considerations for the IETF:
http://www.ietf.org/live/ietf88/text.html

Unofficial stuff:
Blog from Snowden Q&A in Prague:
https://www.mnot.net/blog/2015/07/20/snowden_meets_the_ietf

If you missed the Snowden Q&A on Sunday of Prague, here is a link:
https://www.youtube.com/watch?feature=youtu.be&v=0NvsUXBCeVA&app=desktop

We are also working with the IEEE on their privacy work.  This
includes work to ensure MAC addresses can't be used to identify hosts
(and thus users of the hosts).

Thanks,
Kathleen

On Fri, Aug 7, 2015 at 10:51 AM, Ira McDonald <[email-masked]> wrote:
>> Still, when we talk about identity or identification in this working
>> sacmwg/draft-ietf-sacm-information-model#21, which is seeking to get
>> feedback on what a useful term other than identity might be. The present
>> candidate seems to be designate. So, instead of "identify an endpoint" we
>> would "designate an endpoint" or "collect AVPs from the designated set of
>> endpoints".
>>
>> Reply to this email directly or view it on GitHub.
>>
>>
>>

-- 

Best regards,
Kathleen

---

From: Lisa Lorenzin <[email-masked]>
Date: Fri, 7 Aug 2015 16:14:51 +0000

Hi all,

I completely agree that our privacy considerations need to explicitly call out these issues and provide guidance that this information needs to be protected as any other PII would be protected.  

Rather than SACM getting into the details of what comprises that protection, I'd rather see us refer out to the work that's already been done by many other groups in characterizing that protection - such the two Kathleen mentions here, RFC6973 (great resource, thank you!) and the IAB statement, and possibly resources from other standards bodies such as the NIST guide to protecting PII (http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf - see http://csrc.nist.gov/publications/nistbul/april-2010_guide-protecting-pii.pdf for a summary).  No point in re-inventing the wheel when we can point to someone else's wheel instead. :)

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Friday, August 07, 2015 11:35 AM
To: Ira McDonald <[email-masked]>
Cc: sacmwg/draft-ietf-sacm-requirements <[email-masked]>; sacmwg/draft-ietf-sacm-requirements <reply+00a6c4d1129080622850[email-masked]>; sacm <[email-masked]>; [email-masked]
Subject: Re: [sacm] [draft-ietf-sacm-requirements] Do we need a privacy section (#55)

Hello,

This is a good discussion and it seems that it is getting to the right set of points, that we do need to worry about index data and ways to correlate information back to systems and possibly to users of those systems or whose data crosses those systems.

Jim is right on the PM angle, but you can phrase this lots of ways.
In terms of privacy, we worry about indexes, anything considered sensitive that requires confidentiality related to privacy, and PII.
There are lots of ways to handle this and that will be up to the WG to decide how to provide such guidance.  We do have materials to help you from the view of developing protocols.

Here are some links from a slide I've been using in presentations (please do read the RFC listed, it's very helpful):

Pervasive Monitoring is an Attack
  –RFC7258/BCP188 published after major IETF LC debate – sets the basis for further actions
  –https://www.rfc-editor.org/rfc/rfc7258.txt

In case you missed the tech plenary for IETF88 and you prefer video over reading (or in addition), this was a great plenary that gives background into these considerations for the IETF:
http://www.ietf.org/live/ietf88/text.html

Unofficial stuff:

We are also working with the IEEE on their privacy work.  This includes work to ensure MAC addresses can't be used to identify hosts (and thus users of the hosts).

Thanks,
Kathleen

On Fri, Aug 7, 2015 at 10:51 AM, Ira McDonald <[email-masked]> wrote:
> no longer seems appropriate) or is compromised by an inside attacker, 
> the SACM components that have datastores of devices and associated 
> identity info as well as (often) associated user identities are 
> high-value targets of attacks for bulk theft of PII.
>
> By its fundamental nature, SACM increases the threat of exposure of 
> PII and therefore should address anonymization of individual device 
> identity info and strong controls on the dissemination of that info to subscribers.
>
> Cheers,
> - Ira
>
>
> Ira McDonald (Musician / Software Architect) Co-Chair - TCG Trusted 
> Mobility Solutions WG Chair - Linux Foundation Open Printing WG 
> Secretary - IEEE-ISTO Printer Working Group Co-Chair - IEEE-ISTO PWG 
> Internet Printing Protocol WG IETF Designated Expert - IPP & Printer 
> MIB Blue Roof Music / High North Inc 
> Winter  579 Park Place  Saline, MI  48176  734-944-0094 Summer  PO Box 
> 221  Grand Marais, MI 49839  906-494-2434
>
>
>> My understanding on PII is that as soon as I associate a person with 
>> an email address, phone number or physical address I have PII that I 
>> need to protect. If we associate a user id, account or user 
>> provisioned PKI with a device including possibly a MAC address we probably have the same concerns.
>>
>> authentication and I thought that was an attribute that was highly desirable.
>>
>>
>> group, we're talking about something different than PII data. As 
>> such, there's this other issue for the information model 
>> feedback on what a useful term other than identity might be. The 
>> present candidate seems to be designate. So, instead of "identify an 
>> endpoint" we would "designate an endpoint" or "collect AVPs from the 
>> designated set of endpoints".
>>
>> Again, privacy is important, but I don't think we're talking about 
>> PII as much as might be implied by our choice of terms.
>>
>> —
>> NASA Jabber ([email-masked]) AIM rcolvin13 NASA LCS 
>> ([email-masked])

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 7 Aug 2015 14:10:51 -0400

Good discussion and just a note in an effort to help make this easier
for you all.  If you call out any data used as an index or sensitive
data, then offer options for protection (could be leaving that data
out or using role names instead of specific users for instance) and
discuss the need for confidentiality and privacy protections, that
should be enough for the draft.  There may be other considerations
outside of data model elements, so reading the referenced RFCs would
be good as the IETF's use of the word privacy is broader than that of
enterprises.  For SACM, a service provider environment might also be
considered in scope as an "enterprise".

I'll look for this section when doing an AD review and should catch
most things that would come up in the IESG review to help correct them
before it goes on for the following review phase as well.

Thanks,
Kathleen

On Fri, Aug 7, 2015 at 12:14 PM, Lisa Lorenzin
<[email-masked]> wrote:
> ŸIETF Privacy Considerations for Internet protocols
> ŸIAB Statement on Internet Confidentiality

-- 

Best regards,
Kathleen

---

From: Jim Schaad <[email-masked]>
Date: Fri, 07 Aug 2015 14:38:01 -0700

Adam,

While it is true that we are focused on the single enterprise systems.  I will be shocked if there are not third parties that will offer to do the monitoring on my behalf.  This means that they are going to have to ability to look not only at the systems and users in my enterprise, but potentially compare them against systems and users in other enterprises.  

Also, although we are looking at single enterprise systems, my ISP is a single enterprise and can do the monitoring against me and anybody in my enterprise.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/55#issuecomment-128838977

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 9 Aug 2015 09:02:07 -0400

I had another thought after I sent my last message that should be helpful as you develop language prior to IETF last call.  Make sure the privacy considerations are not country specific.  The IETF references will help with that.  If you use NIST's, you'll also need to look at guidance from other countries, and that can get tricky.

Thanks,
Kathleen 

Sent from my iPhone

> On Aug 7, 2015, at 5:38 PM, Jim Schaad <[email-masked]> wrote:
> 
> Adam,
>