Subject: Outboard Tunnel Mode

From: [email-masked]
Date: Mon, 17 Dec 2001 13:09:10 EST

Folks,

May be I missed something in SLC meeting.  I can expect several 
implementations of iSCSI not include any security.Reason - I can see that 
customers would often rely on the company's existing VPNs (outboard Router 
etc) to protect their data (storage or otherwise) over IP networks. From a 
CIO's viewpoint, this approach may make more sense than extending yet another 
layer of IPSec into its servers just for storage data. 

 It is not clear to me from the standard if it will be a non-compliance of 
iSCSI standard. If so, we may potentially have many non-compliances.

---

From: "John Hufferd" <[email-masked]>
Date: Mon, 17 Dec 2001 11:13:00 -0800

Installations can do what ever they want.  The Security functions are must
implement, NOT must use.

.
.
.
John L. Hufferd
Senior Technical Staff Member (STSM)
IBM/SSG San Jose Ca
Main Office (408) 256-0403, Tie: 276-0403,  eFax: (408) 904-4688
Home Office (408) 997-6136, Cell: (408) 499-9702
Internet address: [email-masked]

[email-masked]@ece.cmu.edu on 12/17/2001 10:09:10 AM

Sent by:  [email-masked]

To:   [email-masked]
cc:
Subject:  Outboard Tunnel Mode

Folks,

CIO's viewpoint, this approach may make more sense than extending yet
another

---

From: "David F Hepner" <[email-masked]>
Date: Mon, 17 Dec 2001 14:06:19 -0800

With most corporations security at the corporate firewall is a MUST no
mater what is done at the machine I/O.   With Security functions a MUST for
iSCSI, an installation will pay for security twice and only use it once.
Why pay for security at every I/O when the corporation mandates it at the
edge?
This seems like motorcycle helmet laws.  Why mandate something that a
reasonable person would do any way?

David

------------------------------------------------------
David F. Hepner                     WA7UHT
[email-masked]
IBM SSG San Jose, CA
(408) 256-4981  Fax (408) 256-6214
Tie Line 8-276-4981
-----------------------------------------------------

John Hufferd/San Jose/IBM@[email-masked] on 12/17/2001 11:13:00 AM

To:    [email-masked]
cc:    [email-masked]
Subject:    Re: Outboard Tunnel Mode

.
.
.
John L. Hufferd

To:   [email-masked]
cc:

Folks,

---

From: [email-masked]
Date: Tue, 18 Dec 2001 10:18:12 -0500

The iSCSI standard will REQUIRE implementation of the
appropriate portions of IPsec.  An iSCSI implementation
that omits all of IPsec will not comply with the standard.
It really is that simple.

Thanks,
--David

---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000            FAX: +1 (508) 497-8500
[email-masked]       Mobile: +1 (978) 394-7754
---------------------------------------------------

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Monday, December 17, 2001 1:09 PM
> To: [email-masked]

---

From: [email-masked]
Date: Tue, 18 Dec 2001 10:25:12 -0500

The assumption that all (or even the most serious) security
threats originate from outside the firewall is incorrect, and
the analogy with motorcycle helmet laws is badly flawed.
Further discussion on this issue is discouraged.

Thanks,
--David

> From: David F Hepner [mailto:[email-masked]]
> Sent: Monday, December 17, 2001 5:06 PM
> To: John Hufferd
> Cc: [email-masked]; [email-masked]