RE: FW: Updating the MIB security guidelines

["C. M. Heard" <heard@pobox.com>]

On Fri, 27 Dec 2002, Wijnen, Bert (Bert) wrote:
> [cmh wrote:]
> >  So may I suggest that you consider the following language instead:
> > 
> > -- for all MIBs you must evaluate
> > 
> >    Some of the readable objects in this MIB module may be considered
> >    sensitive or vulnerable in some network environments.  It is thus
> >    important to control even GET access to these objects and possibly
> >    to even encrypt the values of these objects when sending them over
> >    the network via SNMP.  These are the tables and objects and their
> >    sensitivity/vulnerability:
> > 
> >     <list the tables and objects and state why they are sensitive>
> > 
> > Note that "readable objects" covers read-write and read-create objects
> > as well as read-only objects, and so accomplishes Juergen's objective.
> > 
> OK, that would work for me. Am I assuming correct here that the
> two sections on read-create/read-write and on read-write also stay
> in your proposal?

Yes, exactly.  The two preceding sections on what to do if there are 
read-create/read-write objects and what to do if there are no read-write
objects are fine as is and should stay (modulo typo corrections).   The
same is true of the three paragraphs at then end.
 
> > One last point:  in many cases it's not possible to single out any
> > parrticular readable MIB objects as being especially sensitive, but
> > it is still the case that some users will not want the information
> > in the MIB module revealed indiscriminately.  I hope that in such cases
> > it will be considered acceptable within the guidelines to say something
> > like this (the following example is intended for the Ethernet 
> > WIS MIB):
[ ... example snipped ... ]
> I think Wes made a similar comment also.
> I think this would be fine. After all, the idea is that this is a guideline.

My thoughts exactly ... I just wanted to be sure that we were on the same
page regarding the meaning of the word "guideline".

> Should we add some text about that? I worry (again) that people will take
> the easy way out and always do something as a bovem and that is exactly what
> we do NOT want. If at all possible (and where it makes sense), we want
> authors/editors to be EXPLICIT as to which pieces of the information are
> senstitive and why.

I'd say to leave the guideline as proposed above but to change the
introductory text on the Web page to encourage people to ask questions
if they are not sure (like I just did :).  Maybe something like this:

   This text may need changes if new RFCs are published.  In general, if
   you think this text needs changes, or if you have any questions as to
   its application in a specific case, please send an email message to the
   mibs@ops.ietf.org mailing list.

Regards,

Mike