Re: I-D.ietf-v6ops-cpe-simple-security-09

[Brian E Carpenter <brian.e.carpenter@gmail.com>]

On 2010-03-21 08:32, Mark Townsley wrote:
> 
> On 3/20/10 1:32 AM, james woodyatt wrote:
>> On Mar 19, 2010, at 16:50, Brian E Carpenter wrote:
>>   
>>> But I'm afraid that the simplicity of 'default deny' has long
>>> ago won the hearts and minds of enterprise network managers.
>>>      
>> Sadly, enterprise network managers aren't the only people whose
>> legitimate interests are at stake in the matter under discussion.
>>    
> This document is clearly scoped in the first sentence of the
> Introduction to:
> 
> "gateway devices that enable delivery of Internet services in
> residential and small office settings."
> 
> So, I'm not sure why we are even considering enterprise network managers
> here.

Fair enough, but...
> 
> The networks themselves, the assets under protection, the types of
> applications, are quite different
> between and enterprise network and residential network.

Indeed. But ISPs that supply CPE to their customers are going to
assume that their customers are running unpatched insecure operating
systems at high risk of catching malware. So I think they are just as
likely as enterprise IT departments to favour default deny approaches.

    Brian
> 
> - Mark
>>
>> -- 
>> james woodyatt<jhw@apple.com>
>> member of technical staff, communications engineering
>>
>>
>>
>>
>>    
> 
> 
>