[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Where does security belong?
Conspicuously absent from the discussion is any mention of access
control, which would have to be done at the IP level since routers
might need to restrict routes based on that information. It is
also interesting that access control is about the only thing the
current RIPSO/CIPSO provides. Is the lack of mention of access
control because no one really wants/needs it, or because it is
assumed as a given?
In a complex network, RIPSO/CIPSO do no good without encryption or
at least authentication. If you can't can't trust parts of the network,
you can't trust them not to insert bogus security options. If your
topology is restricted enough, you might be ok -- but that's not the
general case. Part of the specs for things like SP3 include looking
at the security label to pick the appropriate skey, so they do interact.