[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Initial Logging capabiltiies document

On 7/11/06, patrick cain <pcain@coopercain.com> wrote:

George,

Thanks for the comments. I'll incorporate most of them into a new version.

But you say

"
3.  Functional Capabilities of Log Storage Systems

gmj> I would argue that these are out of scope.
"

I disagree. Generation of a log message is nice, but there are many
instances where that message is lost to history because the receiving log
collector was down, broke, ignored, full, etc.  And never noticed or acted
upon. This is bad.

Since we are giving capabilities for "securing layer 2 and 3 devices", and
log storage is called out in the CURPRAC, it seemed to make sense that the
system engineer not forget that there are two parts of the logging problem.
Note that the three capabilities are only for "log storage" devices, which
should keep the router vendors happy.Scope


From the charter:

The working group will list capabilities appropriate for
devices use in:

* Internet Service Provider (ISP) Networks
* Enterprise Networks

The following areas are excluded from the charter at this time:

* Wireless devices
* Small-Office-Home-Office (SOHO) devices
* Security devices (firewalls, Intrusion Detection Systems,
Authentication Servers)
* Hosts

From the framework:

Abstract

  This document outlines work to be done and documents to be produced
  by the Operational Security Capabilities (OPSEC) Working Group.  The
  goal of the working group is to codify knowledge gained through
  operational experience about feature sets that are needed to securely

  deploy and operate managed network elements providing transit
  services at the data link and IP layers.


1.5.  Scope

  The working group will produce a list of capabilities appropriate
  for:

  o  Internet Service Provider (ISP) Networks

  o  Enterprise Networks

  The following are explicitly out of scope:

>>>>>>>  o  general purpose hosts that do not transit traffic including
>>>>>>>     infrastructure hosts such as name/time/log/AAA servers, etc.,

I agree that both sides of the coin (sending and recieving/storing) matter,
but we drew the line at things that transit packets to keep the scope
managable.

If you want to change the charter or framework document, talk to the
WG chair....wait....

----George