Fwd: [Nea] Re: use of a design team to develop requirements

["Mike Fratto" <mfratto at gmail.com>]

>   I would like to see the requirements stated as a series of stages,
> from "anyone is allowed on the network with no checks", to "you must
> submit to invasive probes", with a graduated range of assessments in
> between.

Alan, this needs to be generalized to something like "products must
have configurable actions based on posture assessment" but this is a
policy or action statement that will be defined by oranganizations and
is beyond the scope of the working group. It's important and perhaps
an informational RFC on best practices would be a good spot for those
types of discussions.

At this point, it looks like the requirements are focusing on features
that should be in PA and PB.

For example, I think it is critical:

1) that a set of basic attributes such as MAC, IP, and NEA client
time, be defined that MUST be exchanged between a NEA client and NEA
server

2) that the NEA attributes sent to the NEA server from the NEA client
be secured in such a way that only the NEA server can open and view
them

3) that prior to attribute exchange there is a mechanism in place
where the NEA server requests attributes and the NEA client makes a
choice according to it's local policy whether to send those attributes
or not.  Perhaps a negotiation MUST take place even if that means the
server policy dictates all attributes must be returned. (default NAK).
I am thinking of something similar to PPP.

_______________________________________________
Nea mailing list
Nea at ietf.org
https://www1.ietf.org/mailman/listinfo/nea