Subject: [sfc] Security framework

From: Dave Dolson <[email-masked]>
Date: Fri, 24 Jul 2015 11:51:35 +0000

Listening to the security discussion this morning, it occurred to me that we ‎could improve the conversation by delimiting physical security, meaning the network domain at which an attacker cannot insert themselves.

As we know, nothing is secure without physical security; if an attacker can open your server, root password is meaningless.

So, in SFC terms, what is the physical security boundary? Is it a single node, a single physical box, a single rack, a room in a data center, the entire data center?
‎Once a boundary is set, packets traveling within the boundary can be trusted, and hence don't require encryption or authentication, by definition of the boundary.

When packets enter or leave a boundary, that is where to focus.

I was also thinking that when a virtualization infrastructure provides a layer2 network, it is assumed to be a protected subnet. True? If the layer2 network crosses physical security boundaries, it would be the responsibility of that underlay (e.g. VxLAN) to provide the encryption/authentication.

So, in the context of NSH, in the case of Ethernet/NSH transport packets can only be sent on the same subnet. If this is a trusted subnet, within a physical or virtual security boundary, the traffic doesn't need to be encrypted or authenticated.

If, on the other hand, an NSH packet is encapsulated in an IP packet and sent across the security bounds, then it would be the responsibility of the NSH encapsulation to protect and authenticate sent/received packets.

So again, define the boundaries of the secure area.

Hopefully I'm just finally cluing in to what everyone else already knows...
Anyhow I'll put it out there.

(I don't think I qualify as a security expert‎, although I worked on secure X-windows and networking in 1992)

-Dave