Internet Info 1994 March/Internet Info CD-ROM (Walnut Creek) (March 1994).iso/inet/ietf/spwg/spwg-minutes-90may.txt

Text File | 1993-02-17 | 8.3 KB | 221 lines

CURRENT_MEETING_REPORT_



Reported by Richard Pethia/ CERT

Mintues of the SPWG Meeting of April 17, 1990

The purpose of the April 17 meeting was to review the spwg chater,
making any necessary changes, and to begin the activity of producing a
policy framework.

The initial discussion at the April 17 meeting focused on the utility of
producing a security policy for the Internet, an internetwork of many
networks sharing common name and address spaces.  Since the ``Internet''
has no single controlling entity, and since its components are owned,
operated, and administered by a variety of organizations, there was a
concern that it would not be possible to enforce an Internet Security
Policy in any useful way.

Despite the concerns, the attendees at this meeting decided that a
formal written policy, issued by the IAB as a recommendation in the form
of an RFC, could act as a vehicle to build concensus among the
organizations that own and operate components of the Internet.  While it
was concluded that uniform policy enforcement was probably not possible,
the effort of producing and promoting a security policy would benefit
the Internet community by focusing attention on Internet security issues
and by encouraging the component owners to take steps to improve the
security of those components.  In addition, the recommended policy could
act as a vehicle to establish expectations of community behavior and
could act as an enabling document for the development and implementation
of local policy.

The group then decided that the policy should address various audiences:
Internet users, host operators, network operators (including local
networks, regional networks, national backbones, and international
backbones), host vendors, and network vendors.  For each of these
audiences, the policy should speak to legal issues, technical issues,
and administrative issues.  Finally, the policy should, for each of the
audiences, deal with the following issues:  unauthorized access to data,
destruction of data, modification of data, unauthorized use of service,
and denial of service.

Attention then turned to the distinction between a policy and a
framework to be used in developing a policy.  It was generally felt that
the final result of the spwg effort should be a short, succinct document
that address the issues listed above.  The activity of developing the
policy, however, should proceed using some sort of framework that would
support the policy developers' efforts.  This ``Internet Security Policy
Development Framework'' should be structured to insure all key issues
are addressed and act as a working document that is elaborated over time
and serves to capture the work of the policy developers.  The initial
outline of the document is:

                                   1






  1. Introduction
     (a) Definitions and references (terms used in the balance of the
         document)
     (b) Internet definition
     (c) Scope of policy
     (d) Applicability
     (e) Authority
     (f) Focus and emphasis
  2. Inventory of existing policies.  A survey of existing policies,
     directives and laws that would influence an Internet security
     policy.
  3. Needed policy and architecture A description of the audiences and
     issues an Internet Security policy should address.
  4. Security Services Covers such areas as:  Service classes,
     information classes, subscribers and users, current architectural
     approaches, availability, etc.
  5. Certification and Accreditation Covers possible certification and
     accreditation activities including:  who are the authorities,
     certification of components, accreditation of facilities.
  6. Security Administration and Responsibilities Discusses issues as:
     overall security policy coordination, facility administration,
     component security administration, risk management, security
     training and awareness.


Minutes of the SPWG meeting of May 1, 1990

The purpose of the May 1st meeting was to discuss the policy development
framework created at the April meeting and to begin work documenting
areas of concern and key issues.

The framework was presented and there was general agreement that it
could be used as a vehicle to develop a proposed Internet security
policy.  Discusson focused on section 4 (Security Services) of the
outline and it was decided that the following three dimensions of the
problem should be considered


   o Security Threats/Services
      -  Confidentiality (theft of data)
      -  Integrity (destruction)
      -  Authentication (masquerade)
      -  Assured Service (denial of service)
   o Domains of Implementation
      -  Administrative
      -  Technical
      -  Legal
   o Who's Responsible
      -  Users
      -  Host Operators
      -  Router/Network operators
      -  Host Vendors
      -  Router vendors

                                   2






Finally, attendees brainstormed to produce the key issues listed below.
Several attendees (named on individual items below) agreed to draft
brief position statements on specific items in the early June time
frame.


   o Internet infrastructure assured service (Mike StJohns)
   o User Identification - including authentication, email, remote
     login, ftp (Vint Cerf)
   o Plugging Holes - individual responsibility (Tracy Laquey)
   o Incident Handling rules (Tracy Laquey)
   o Identification of resources (Tony Hain)
   o Lines of responsibility
   o User/Host/Network responsibilities (Paul Holbrook)
   o Proper usage; network ethics (James Van Bokkelen)
   o Configuration control
   o Audit trail
   o Confidentiality
   o Bad Press
   o User Identification - restricted access
   o Denial of Service - network service
   o Unauthorized access
   o Adequate response when being challenged about being a source of
     attacks (especially when cooperating with an investigation)
   o Known chain of responsibile authorities
   o Export restrictions - limitations enforcement


Attendees of the April Meeting


    Branstad, Dennis          [e-mail]
    Crocker, Steve            [e-mail]
    Elliott, Oma              [e-mail]
    Ellis, James              [e-mail]
    Gross, Phill              [e-mail]
    Holbrook, Paul            [e-mail]
    Hollingsworth, Greg       [e-mail]
    Jacobs, Joel              [e-mail]
    Mills, Kevin              [e-mail]
    Pethia, Rich              [e-mail]
    Shirey, Rob               [e-mail]
    Tabacchi, Len
    Vaudreuil, Greg           [e-mail]



                                   3






Attendees of the May meeting


    Stan Ames                 [e-mail]
    Tom Bajzek                [e-mail]
    Alison Brown              [e-mail]
    Jeffrey S. Carpenter      [e-mail]
    Vinton Cerf               [e-mail]
    Richard Colella           [e-mail]
    Steve Crocker             [e-mail]
    James Davin               [e-mail]
    Hunaid Engineer           [e-mail]
    James Galvin              [e-mail]
    Ella Gardner              [e-mail]
    Tony Hain                 [e-mail]
    Robert Hoffman            [e-mail]
    Paul Holbrook             [e-mail]
    Greg Hollingsworth        [e-mail]
    Phil Karn                 [e-mail]
    Tracy Laquey              [e-mail]
    Keith McCloghrie          sytek![e-mail]
    Gerald K Newman           [e-mail]
    Lee Oattes                [e-mail]
    David Perkins             [e-mail]
    Marsha Perrott            [e-mail]
    Richard Pethia            [e-mail]
    Ted Pike                  [e-mail]
    Paul Pomes                [e-mail]
    Joyce Reynolds            [e-mail]
    Robert J. Reschly Jr.     [e-mail]
    Milt Roselinsky           cmcvax![e-mail]
    Jonathan Saperia          [e-mail]
    Robert W. Shirey          [e-mail]
    Tim Seaver                [e-mail]
    Michael StJohns           [e-mail]
    Cal Thixton               [e-mail]
    C. Philip Wood            [e-mail]
    Sze-Ying Wuu              [e-mail]



                                   4