Subject: [sacm] minor comments on draft-lin-sacm-nid-mp-security-baseline-03

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 23 Jul 2018 13:01:01 -0500

During Jessica's talk I noticed a couple things I wanted to mention, but
that didn't seem to merit getting up to the mic:

There's a container for 'telnet' admin access; my understanding is that
there are not any applications out there that could be called "telnet" and
are actually secure these days (but maybe I'm missing some!); e.g.,
kerberized telnet mostly only uses single-DES and a lousy cipher mode, with
a vendor-specific option for triple-DES, which is deprecated as of my
document that's currently at the RFC Editor.  So we may want to have some
text clarifying the situation and disrecommending its use (or even remove
it entirely, if that's feasible).

Similarly, there's a pwd-sec-policy container that describes password
security policies.  While it's definitely true that password policies and
mandatory change intervals are currently widely deployed, it's less clear
whether their usage should still be considered useful or a best current
practice -- I think I've seen some research go by that suggests that not
requiring character classes or frequency of change can be just as secure
(and, of course, if passwords can be avoided entirely that can also help).
So, perhaps there is room for some qualifying text here as well.

-Ben
(with no hats)

---

From: Adam Montville <[email-masked]>
Date: Mon, 23 Jul 2018 15:28:30 -0500

Two good points, Ben. I have two comments inline. 

I think I mentioned this at the mic, during the SACM session, but I'm interested in whether anyone else sees value in defining a "baseline registry" over draft-based baselines (I'm still not sure that baseline is the right label for these, but I'm going with it until I think of something better). 

For example, a year from now those password complexity settings may be something the world wants to remove from the baseline... I wouldn't want to need to reopen the draft. I'd prefer to update a registry somewhere. This may be less of an issue (but not a non-issue) for network devices, and it's certainly an issue for operating systems, applications, cloud environments, and probably IoT.

If folks think this is a sane idea, I'd volunteer to create such a draft.

Kind regards,

Adam

> On Jul 23, 2018, at 1:01 PM, Benjamin Kaduk <[email-masked]> wrote:
> 

FWIW, I don't believe there's a single recent CIS Benchmark (security configuration guide) that doesn't recommend disabling telnet entirely.

> So, perhaps there is room for some qualifying text here as well.

Qualifying text is a good idea. There are usually caveats accompanying more modern guidance (i.e. MFA or use of loooong passwords). At CIS, we've had a hard time reconciling both worlds while we're in a transition. There is still a large group of folks out there who find comfort in the complexity constraints and don't have faith in users to rely on long pass phrases, etc.

> 
> -Ben
> (with no hats)
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 23 Jul 2018 16:17:23 -0500

> If folks think this is a sane idea, I'd volunteer to create such a draft.

I'm of a mixed mind on this; it seems like something that might want more
nuance than a registry allows, and thus fit better as a BCP doc (that could
be regularly updated), though as you know the process for that is more
heavyweight.

> Qualifying text is a good idea. There are usually caveats accompanying more modern guidance (i.e. MFA or use of loooong passwords). At CIS, we've had a hard time reconciling both worlds while we're…

Indeed, this is a hard space to get universal agreement on what is "best".
Perhaps the best (sic) we can do is to document the tradeoffs involved.

-Ben

---

From: Jarrett Lu <[email-masked]>
Date: Mon, 23 Jul 2018 19:07:05 -0700

> it entirely, if that's feasible).

I agree 'telnet' is insecure and is often disabled by default in many 
enterprise
environments. I wonder if it's simpler for the draft authors to consider 
replacing
'telnet' with 'ssh' which is secure. 'ssh' should meet the "remote admin 
access"
requirement.

> So, perhaps there is room for some qualifying text here as well.

I also recall reading a publication which argues against forcing users 
to change passwd
frequently (I vaguely recall it's a NIST document but can't be sure). 
Some security tools
company like CyberArk manage periodic passwd changes in their tools so 
that users
don't need to do that.

- Jarrett