Subject: [secdir] YANG Reviews

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 8 Jan 2018 16:43:59 -0500

Hello,

We will be seeing many YANG module reviews come through, please don't
let page counts scare you on these.  One of the main things to look
for is that they used the Security Considerations template and filled
it out, catching any data nodes that need to be enumerated in the
considerations.

Templates like this tend to get updated every time there's a new
SecAD, :-) . As such, it'll likely be updated again in a few months.
Here's the draft with the current template.  Have a look so you know
key things to look for (transport security is called out and
subtrees/data nodes of concern should be listed out).  Sometimes more
is needed specific to the draft, but often times, this covers it.

https://tools.ietf.org/html/draft-ietf-netmod-rfc6087bis-10#page-52

Thanks again for all your reviews, it is a tremendous help to us!

-- 

Best regards,
Kathleen

---

From: Russ Housley <[email-masked]>
Date: Tue, 9 Jan 2018 13:46:27 -0500

For MIB modules, we came up with a short list of things or the SecDir Reviewer to do.  This is a quote from an email message in 2007:

> The job of the security reviewers, then, is three-fold: first, to
> verify the existence of the boilerplate; second, to verify the adequacy
> of the explanations given for particular items; third -- and this is
> the hardest -- to scan the document to see if other items should have
> been identified as sensitive but aren't.

The real guidance appears here: http://www.ops.ietf.org/mib-security.html

It would be very helpful if we can come up with an equivalent yang-security.html document.

Russ

> On Jan 8, 2018, at 4:43 PM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hello,
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 9 Jan 2018 14:15:22 -0500

Hi Russ,

Sent from my mobile device

> On Jan 9, 2018, at 1:46 PM, Russ Housley <[email-masked]> wrote:
> 

The guidance is very similar.
> It would be very helpful if we can come up with an equivalent yang-security.html document.
We can work with Benoit &Warren as it’s better for those writing the drafts to see it first, so I think the home should be the same.

Best,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 11 Jan 2018 11:21:25 -0500

Hello,

As it turns out, there is a page:

https://www.ietf.org/iesg/directorate/yang-doctors.html

If anyone has comments on the bis draft with current security
considerations template, please provide them to the WG.  Here is the
link again for your convenience:
https://tools.ietf.org/html/draft-ietf-netmod-rfc6087bis-10#page-52

Thank you!

-- 

Best regards,
Kathleen

---

From: Russ Housley <[email-masked]>
Date: Thu, 11 Jan 2018 11:52:44 -0500

https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines

This is exactly what a SecDir reviewer will need.  Awesome.

Russ

> On Jan 11, 2018, at 11:21 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hello,
>

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 11 Jan 2018 16:58:56 -0600

> https://www.ietf.org/iesg/directorate/yang-doctors.html

Was this a casualty of the "new IETF website broke old links"?
Or was the intended link actually
https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines as
appeared later?

-Ben