Subject: Re: [Roll] [roll] #115: draft-ietf-roll-security-threats-01.txt --- Editorial Comments

From: "roll issue tracker" <[email-masked]>
Date: Sat, 22 Jun 2013 19:46:16 -0000

#115: draft-ietf-roll-security-threats-01.txt --- Editorial Comments

Comment (by [email-masked]):

 In version 02 of this draft :[[BR]]

 == Section 3.1: [[BR]]

 states:
 “The goal of the model is to be as detailed as possible so that
 corresponding assets, points of access, and process in an individual
 routing protocol can be readily identified” [[BR]]

 == Section 3.2:[[BR]]

 * CIA model was replaced for ISO 7498-2 model[[BR]]

 * misuse is not used in this section.[[BR]]

 == Section 3.4: [[BR]]

 * misappropriated, legitimacy are not used[[BR]]

 * truthfulness is still used[[BR]]

 * eavesdropping is still used.[[BR]]

 == Section 4.1  [[BR]]

 sniffing was not replaced for passive wiretapping[[BR]]

 == Section 4.2 [[BR]]

 Remains the same information.[[BR]]

 CIA is used and not defined in the document.  could be something like
 “Confidentiality, Integrity, and Availability (CIA)”[[BR]]

 == Section 5.1.3 [[BR]]

 TA still remains as ...may be passive....[[BR]]

 == Section 5.2.3 / 6 / 6.1 /6.2 /6.4 /6.5 /6.5.1 /8 [[BR]]

 Remains the same information as version 01

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |       Owner:
  [email-masked]          |  [email-masked]
     Type:  defect                   |      Status:  new
 Priority:  minor                    |   Milestone:
Component:  security-threats         |     Version:
 Severity:  Active WG Document       |  Resolution:
 Keywords:  Editorial                |
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/roll/trac/ticket/115#comment:1>
roll <http://tools.ietf.org/wg/roll/>

---

From: "roll issue tracker" <[email-masked]>
Date: Mon, 01 Jul 2013 04:35:27 -0000

In version 03 of this draft.

 Section 3.4:

     * truthfulness is still used

     * eavesdropping was changed by unauthorized exposure.

 Section 4.1 is section 5.3 in version 03

   Sniffing is not present in section 5.3, but it is still displayed in
 section 8.1 and 8.1.2

 Section 4.2/4.2.2 in version 02 is section 6/6.2 in version 03

   masquerade is not mentioned.

   [RFC4949] “$ masquerade(I) A type of threat action whereby an
 unauthorized entity gains access to a system or performs a malicious act
 by illegitimately posing as an authorized entity....”[[BR]]

   [RFC4949]” misappropriation(I) A type of threat action whereby an entity
 assumes unauthorized logical or physical control of a system
 resource....Theft of data... Theft of service…Theft of functionality...”

 Section 5.1.3 is section 8.1.3 in version 03

   Fixed - “The traffic analysis attack ...is passive...”

 Section 5.2.3 → 8.2.3

   Liveliness was not replace for liveness [RFC4949], and still appears in
 section 8.2.5 and 9.2 too

 Section 5.3.2  → 8.3.2[[BR]]

   quicker was fixed in “...nodes' enery store more quickly”, but it is
 still displayed further in this section in: “...depletes battery and
 energy scavenging nodes quicker and ...”

   routing traffic is not mentioned in this section.

 Section 6  is section 9 in version 03

   The opening sentence remains the same as version 02

 Section 6.1 → 9.1

   “… and improve vulnerability against other more direct attacks …”  was
 changed to “...and reduce consequences from other more direct attacks...”

 Section 6.2  → 9.2

 Section 6.4 → 9.4

   Title was changed to Key Management

 Section 6.5.1 → 9.5.1

   “ … diversified needs …” was not changed to “… diverse needs…”

 Section 8  is section 11 in version 03

   “….   is specified …” was not changed to “…are specified …”

 = Additional editorial errors in version 03

   * secion 5.1 is repeated.[[BR]]
   * the reference for iso 7498-2 is not added in references section[[BR]]
   * “...assetsRFC4949...” in section 3 [[BR]]
   * In section 3.2 “...confirguratin..” [[BR]]
   * In section 3.4 “...iintegrity...”[[BR]]
   * The paragraph of section 4 should start with capital letter.[[BR]]
   * In section 5.3 “...evesdropping...”.[[BR]]
   * In section 6.1 “....and a denial of service on the entire network....”
 should be “and a denial of service (DoS) on the entire network.”  ? and in
 7.3 should use only DoS?

Ticket URL: <http://trac.tools.ietf.org/wg/roll/trac/ticket/115#comment:2>
roll <http://tools.ietf.org/wg/roll/>