Re: [savi] SAVI FCFS & Logging

"Joel M. Halpern" <jmh@joelhalpern.com> Sat, 05 March 2011 16:45 UTC

Message-ID: <4D7268E9.8000202@joelhalpern.com>
Date: Sat, 05 Mar 2011 11:46:33 -0500
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.14) Gecko/20110221 Lightning/1.0b2 Thunderbird/3.1.8
MIME-Version: 1.0
To: draft-ietf-savi-fcfs@tools.ietf.org, SAVI Mailing List <savi@ietf.org>
References: <4D71CDE6.1000707@joelhalpern.com> <4D71FF5A.8040800@it.uc3m.es>
In-Reply-To: <4D71FF5A.8040800@it.uc3m.es>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 8bit
Subject: Re: [savi] SAVI FCFS & Logging
Precedence: list

I asked the SAVI FCFS the question below.  In response they quite 
reasonably asked that I provide text.  Following the note excerpt is the 
suggestion on placement and text.  THe text could include a reference to 
the savi threats document.  I was not sure if that would be helpful, so 
I left it out.  Also, as logging is basically an internal activity, I 
have written this suggestion as non-normative text.

> El 05/03/11 6:45, Joel M. Halpern escribió:
>> Looking at the traceability issues we raise in the threats document,
>> and looking at the uses I see people wanting to make of SAVI for
>> SLAAC, should we put some descriptive (not normative) text into SAVI
>> FCFS that talks about loggin?
>>
>> I wanted to check with you folks directly before raising this on the
>> list.
>>
>> Thank you,
>> Joel

I would suggest adding a section between 2.4 and 2.5 (i.e., it would be 
2.5, and the current 2.5 SAVI enforcement perimeter would become 2.6.)
---------
2.x SAVI Logging

While the primary goal of SAVI is simply to prevent improper use of IP 
addresses, a secondary goal is to assist in traceability for determining 
who an imp-roper actor is.  For example, if a remote site reports that a 
DoS (or component of a DDoS) is coming from the SAVI site, SAVI 
enforcement can be a useful component in a response.

In order to support these and other similar activities, it is a good 
idea if SAVI devices perform logging of the creation, modification, or 
removal of address bindings.  Any protocol support, such as SYSLOG 
support for sending those logs to a common server, would be a topic for 
a future separate document.
-----
If instead we want to make that normative, we could put a SHOULD in and 
put this in section 3.2.6 instead.

In addition, it would seem useful to add a short paragraph in the 
security considerations section.  (If Denial of service attacks and 
Residual threats were 4.1 and 4.2, then I would would att this as 4.3 
Security Logging)
-------------
In order to improve the integration of SAVI into an overall security 
environment, and enable response to additional indirect security issues 
which SAVI can help ameliorate, it is helpful if SAVI systems log the 
creation, modification, and deletion of binding entries.
---------
I realize this basically duplicates the 2.x text.  I think it deserves 
mention in the security considerations, because it is a security 
consideration.  But I don't think that should be the first occurrence.
If the duplication is bothersome, then just use the 2.x text.

Thank you,
Joel

Re: [savi] SAVI FCFS & Logging Joel M. Halpern
Re: [savi] SAVI FCFS & Logging Jean-Michel Combes
Re: [savi] SAVI FCFS & Logging Eric Levy-Abegnoli
Re: [savi] SAVI FCFS & Logging Jean-Michel Combes