[Fwd: [netmod] first draft for yang module security considerations]

Forwarded as suggested by DAn in our OPS-AREA open meeting.

Disucssion will initially take place on NETMOD WG mailing list

Bert

-------- Original Message --------
Subject: 	[netmod] first draft for yang module security considerations
Date: 	Tue, 23 Mar 2010 13:07:00 -0700
From: 	Bert (IETF) Wijnen <[email protected]>
To: 	NETMOD Working Group <[email protected]>



This is the text I presented this morning at the end of the netmod
session.

Comments to the netmod mailing list pls

Bert

--- first draft ----->

X. Security Considerations

-- if you have any writeable data nodes (those are all the
-- "config true" nodes, and remember, that is the default)
-- describe their specific sensitivity or vulnerability.

There are a number of data nodes defined in this YANG module
which are writable/creatable/deletable (i.e. config true, which
is the default).  These data nodes may be considered sensitive
or vulnerable in some network environments.  Write operations
(e.g. edit-config) to these data nodes without proper protection
can have a negative effect on network operations.  These are
the subtrees and data nodes and their sensitivity/vulnerability:

<list subtrees and data nodes and state why they are sensitive>

-- for all YANG modules you must evaluate whether any readable data
-- nodes (those are all the "config false" nodes, but also all other
-- nodes, because they can also be read via operations like get or
-- get-config) are sensitive or vulnerable (for instance, if they
-- might reveal customer information or violate personal privacy
-- laws such as those of the European Union if exposed to
-- unathorized parties)

Some of the readable data nodes in this YANG module may be
considered sensitive or vulnerable in some network environments.
It is thus important to control read access (e.g. via get,
get-config or notification) to these data nodes.  These are the
subtrees and data nodes and their sensitivity/vulnerability:

<list subtrees and data nodes and state why they are sensitive>



_______________________________________________
netmod mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/netmod