Re: Response to opsec issues raised by Russ White

[George Jones <gmj@pobox.com>]

On Fri, 26 Mar 2004, Russ White wrote:

> > rw> Should you refer to the idr draft about choosing good MD5 keys at some point in the 2.2.3 area, maybe?
> >
> > I-D.orman-public-key-lengths ?
> >
> > That's about key lengths and strength, and hence cited in 2.2.2 which is
> > about cryptographic strength.  2.2.3 is about open review of protocols.
>
> I was thinking about 3562. I don't know if that would fit in here anyplace,
> but it might be a useful reference (?).

Citation added.  Thanks.

> > rw> 2.4 Configuration and Management Interface Requirements
> > rw>
> > rw> I think you need better justification for this section than what
> > rw> you've given here. This section is more of a wish list of what the UI
> > rw> should support, and there's seems to be little justification given
> > rw> for why these things make a network more secure (?).
> >
> > I disagree.   I just re-read all the justification sections in 2.4.x
> > and I think each one of them gives adequate security-related rational
> > for the individual requirement.   Show me which ones you think are weak
> > on security rational ?
>
> Well, why is it important that the interface be scriptable or
> > programmatic?

One word: scale.

I reworded the justification:

04>   Justification.
04>
04>      During the handling of security incidents, it is often necessary
04>      to quickly make configuration changes on large numbers of
04>      devices.  Doing so manually is error prone and slow.  Vendor
04>      supplied management solutions do not always foresee or address
04>      the type or scale of solutions that are required.  The ability
04>      to script provides a solution to these problems.

> Thanks!

Thank you.

---George Jones