From nobody Fri Aug 13 06:42:12 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 993003A1941; Fri, 13 Aug 2021 06:42:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, CTE_8BIT_MISMATCH=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y9pV2zRtX7wS; Fri, 13 Aug 2021 06:41:59 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67ED03A193C; Fri, 13 Aug 2021 06:41:59 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 3ED9AF40759; Fri, 13 Aug 2021 06:41:23 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, opsec@ietf.org Content-type: text/plain; charset=UTF-8 Message-Id: <20210813134123.3ED9AF40759@rfc-editor.org> Date: Fri, 13 Aug 2021 06:41:23 -0700 (PDT) Archived-At: Subject: [OPSEC] =?utf-8?q?RFC_9099_on_Operational_Security_Consideration?= =?utf-8?q?s_for_IPv6_Networks?= X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Aug 2021 13:42:06 -0000 A new Request for Comments is now available in online RFC libraries. RFC 9099 Title: Operational Security Considerations for IPv6 Networks Author: É. Vyncke, K. Chittimaneni, M. Kaeo, E. Rey Status: Informational Stream: IETF Date: August 2021 Mailbox: evyncke@cisco.com, kk.chittimaneni@gmail.com, merike@doubleshotsecurity.com, erey@ernw.de Pages: 48 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-opsec-v6-27.txt URL: https://www.rfc-editor.org/info/rfc9099 DOI: 10.17487/RFC9099 Knowledge and experience on how to operate IPv4 networks securely is available, whether the operator is an Internet Service Provider (ISP) or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes security issues in the protocol, but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues associated with several types of networks and proposes technical and procedural mitigation techniques. This document is only applicable to managed networks, such as enterprise networks, service provider networks, or managed residential networks. This document is a product of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Fri Aug 13 10:42:17 2021 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E6EE3A209D for ; Fri, 13 Aug 2021 10:42:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.119 X-Spam-Level: X-Spam-Status: No, score=-1.119 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, SPF_HELO_NONE=0.001, SPF_NEUTRAL=0.779] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CQvZB8BlQ11b for ; Fri, 13 Aug 2021 10:42:03 -0700 (PDT) Received: from faui40.informatik.uni-erlangen.de (faui40.informatik.uni-erlangen.de [IPv6:2001:638:a000:4134::ffff:40]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEE163A20A2 for ; Fri, 13 Aug 2021 10:42:03 -0700 (PDT) Received: from faui48f.informatik.uni-erlangen.de (faui48f.informatik.uni-erlangen.de [IPv6:2001:638:a000:4134::ffff:52]) by faui40.informatik.uni-erlangen.de (Postfix) with ESMTP id 6EAA9548049 for ; Fri, 13 Aug 2021 19:41:57 +0200 (CEST) Received: by faui48f.informatik.uni-erlangen.de (Postfix, from userid 10463) id 62EED4400EF; Fri, 13 Aug 2021 19:41:57 +0200 (CEST) Date: Fri, 13 Aug 2021 19:41:57 +0200 From: Toerless Eckert To: opsec@ietf.org Message-ID: <20210813174157.GN23297@faui48f.informatik.uni-erlangen.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: [OPSEC] [opsec] considerations for and protection against misconfiguration attacks ? X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Aug 2021 17:42:16 -0000 In the process of reviews for draft-ietf-bier-te, i ran into the question what the BCP are wrt. attacks via intentional misconfiguration. A) Is this somehing that should it be mentioned in security considerations ? I can not remember examples of misconfig attack in RFC security considerations. At least not for common issues that i can think of. But those would relate all to older standards. Maybe newer standards are better. Example would be nice. B) Do we have any guidance or even explicit specs in support of minimizing the risk of misconfigurations attacks ? For example, the attacks in under question where against misconfiguring routing via e.g.: static routes or similar functionality directly impacting local forwading plane. If i built a router where there is no such local CLI, but i would only make it available via e.g.: via authenticated NetConf, and the router infra was set up to not allow to change this (locked down hardware so to speak), this would significantly change the attack vector. Do we have anything like this in any specs or even as options in YANG models ? Cheers Toerless From nobody Sun Aug 15 13:49:41 2021 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id BBD023A0AD4; Sun, 15 Aug 2021 13:49:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Nancy Cam-Winget via Datatracker To: Cc: draft-ietf-opsec-ipv6-eh-filtering.all@ietf.org, last-call@ietf.org, opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.36.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <162906057566.11176.6571419812700378889@ietfa.amsl.com> Reply-To: Nancy Cam-Winget Date: Sun, 15 Aug 2021 13:49:35 -0700 Archived-At: Subject: [OPSEC] Secdir telechat review of draft-ietf-opsec-ipv6-eh-filtering-08 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Aug 2021 20:49:36 -0000 Reviewer: Nancy Cam-Winget Review result: Ready I have reviewed version -08 based on comments I'd provided on -06 and thank the authors for addressing most of my comments. I find -08 in general to be ready but would like to see Tim Chown's nits to also be addressed.