Subject: [websec] An alternative approach to Security Policy

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 29 Oct 2011 12:47:01 -0400

I submitted a version of this document last week but wanted to get some
additional examples in using the new ni URI proposal before raising it on
the list. This has now been done:

http://www.ietf.org/id/draft-hallambaker-securitypolicy-01.txt

This is related to the 'Must use TLS', CA-Pinning and Strict Security work
here but separates the security policy framework from the mode of
distribution completely.

We have been discussing security policy in IETF for quite some time. There
seem to be two major technical issues that cause problems:

1) Choice of distribution mechanism
2) False positives due to badly administered systems

I think I have found the solution to the first: It does not need to be a
choice. There are advantages and disadvantages to each approach. DNS is the
authoritative source for statements on the DNS but DNSSEC will not be ready
for prime time for many, many years. HTTP headers are expedient but only
give security after first contact. And DNS and HTTP headers both suffer from
the problem of what to do when the attacker blocks access to the online
confirmation mechanism completely. Meanwhile pushing out blocklists of 'hot
sites' provides effective security but does not scale'

Why choose? Each approach has advantages and disadvantages. So why not have
a single language for policy statements that is strictly limited to
restrictive statements that can be used to create statements that can be
carried over any available transport?

The false positives problem is a much bigger problem conceptually than in
practice. In theory DKIM policy should be causing all sorts of legitimate
mail to be refused delivery. What saves the system is the fact that DKIM
statements are only one input into anti-spam filters and is only given the
weight the data justifies.

I see security policy being applied in HTTP and similar cases in the same
way. Statements made by domain name owners will in the first instance serve
as advice to companies that provide Internet safety products who will
combine the data in the security policy statements with data from other
sources to arrive at security decisions.

Every attack has a human intelligence in there somewhere. Expecting to have
effective security without any human intelligence in the defense is probably
a mistake.

The second approach to overcoming the 'false positives' issue is to observe
that reporting a policy violation has much more value than blocking sites.
Blocking sites only protects the users who have the security policy
capability configured and enabled. Reporting a policy violation enables
remediation that can protect the whole Internet community.

Next Steps:

This particular draft is intentionally targeted at use in a static
interchange format. This would be used for defining local security policies
(e.g. configuring all the web browsers at bigcorp.com to impose a particular
policy for corporate servers) and to be used for emergency, data-driven
response.

Clearly this should converge with the Google Policy proposal for HTTP. I
don't think that there are major differences and would be astonished if this
was incompatible. But a general purpose format designed to support more
protocols than HTTP will look a little different to one that is designed to
tackle the problem at a higher level.

-- 
Website: http://hallambaker.com/