doc: Add RFC documents

1 files changed, 563 insertions, 0 deletions

diff --git a/doc/rfc/rfc1281.txt b/doc/rfc/rfc1281.txt
new file mode 100644
index 0000000..1327144
--- /dev/null
+++ b/doc/rfc/rfc1281.txt
@@ -0,0 +1,563 @@
+
+
+
+
+
+
+Network Working Group                                          R. Pethia
+Request for Comments: 1281                Software Engineering Institute
+                                                              S. Crocker
+                                       Trusted Information Systems, Inc.
+                                                               B. Fraser
+                                          Software Engineering Institute
+                                                           November 1991
+
+
+          Guidelines for the Secure Operation of the Internet
+
+Status of this Memo
+
+   This memo provides information for the Internet community.  It does
+   not specify an Internet standard.  Distribution of this memo is
+   unlimited.
+
+Preamble
+
+   The purpose of this document is to provide a set of guidelines to aid
+   in the secure operation of the Internet.  During its history, the
+   Internet has grown significantly and is now quite diverse.  Its
+   participants include government institutions and agencies, academic
+   and research institutions, commercial network and electronic mail
+   carriers, non-profit research centers and an increasing array of
+   industrial organizations who are primarily users of the technology.
+   Despite this dramatic growth, the system is still operated on a
+   purely collaborative basis.  Each participating network takes
+   responsibility for its own operation.  Service providers, private
+   network operators, users and vendors all cooperate to keep the system
+   functioning.
+
+   It is important to recognize that the voluntary nature of the
+   Internet system is both its strength and, perhaps, its most fragile
+   aspect.  Rules of operation, like the rules of etiquette, are
+   voluntary and, largely, unenforceable, except where they happen to
+   coincide with national laws, violation of which can lead to
+   prosecution.  A common set of rules for the successful and
+   increasingly secure operation of the Internet can, at best, be
+   voluntary, since the laws of various countries are not uniform
+   regarding data networking.  Indeed, the guidelines outlined below
+   also can be only voluntary.  However, since joining the Internet is
+   optional, it is also fair to argue that any Internet rules of
+   behavior are part of the bargain for joining and that failure to
+   observe them, apart from any legal infrastructure available, are
+   grounds for sanctions.
+
+
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 1]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+Introduction
+
+   These guidelines address the entire Internet community, consisting of
+   users, hosts, local, regional, domestic and international backbone
+   networks, and vendors who supply operating systems, routers, network
+   management tools, workstations and other network components.
+
+   Security is understood to include protection of the privacy of
+   information, protection of information against unauthorized
+   modification, protection of systems against denial of service, and
+   protection of systems against unauthorized access.
+
+   These guidelines encompass six main points.  These points are
+   repeated and elaborated in the next section.  In addition, a
+   bibliography of computer and network related references has been
+   provided at the end of this document for use by the reader.
+
+ Security Guidelines
+
+   (1)  Users are individually responsible for understanding and
+        respecting the security policies of the systems (computers and
+        networks) they are using.  Users are individually accountable
+        for their own behavior.
+
+   (2)  Users have a responsibility to employ available security
+        mechanisms and procedures for protecting their own data.  They
+        also have a responsibility for assisting in the protection of
+        the systems they use.
+
+   (3)  Computer and network service providers are responsible for
+        maintaining the security of the systems they operate.  They are
+        further responsible for notifying users of their security
+        policies and any changes to these policies.
+
+   (4)  Vendors and system developers are responsible for providing
+        systems which are sound and which embody adequate security
+        controls.
+
+   (5)  Users, service providers, and hardware and software vendors are
+        responsible for cooperating to provide security.
+
+   (6)  Technical improvements in Internet security protocols should be
+        sought on a continuing basis.  At the same time, personnel
+        developing new protocols, hardware or software for the Internet
+        are expected to include security considerations as part of the
+        design and development process.
+
+
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 2]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+Elaboration
+
+   (1)  Users are individually responsible for understanding and
+        respecting the security policies of the systems (computers and
+        networks) they are using.  Users are individually accountable
+        for their own behavior.
+
+        Users are responsible for their own behavior.  Weaknesses in
+        the security of a system are not a license to penetrate or
+        abuse a system.  Users are expected to be aware of the security
+        policies of computers and networks which they access and to
+        adhere to these policies.  One clear consequence of this
+        guideline is that unauthorized access to a computer or use of a
+        network is explicitly a violation of Internet rules of conduct,
+        no matter how weak the protection of those computers or networks.
+
+        There is growing international attention to legal prohibition
+        against unauthorized access to computer systems, and several
+        countries have recently passed legislation that addresses the
+        area (e.g., United Kingdom, Australia).  In the United States,
+        the Computer Fraud and Abuse Act of 1986, Title 18 U.S.C.
+        section 1030 makes it a crime, in certain situations, to access
+        a Federal interest computer (federal government computers,
+        financial institution computers, and a computer which is one of
+        two or more computers used in committing the offense, not all of
+        which are located in the same state) without authorization.
+        Most of the 50 states in the U.S have similar laws.
+
+        Another aspect of this part of the policy is that users are
+        individually responsible for all use of resources assigned to
+        them, and hence sharing of accounts and access to resources is
+        strongly discouraged.  However, since access to resources is
+        assigned by individual sites and network operators, the
+        specific rules governing sharing of accounts and protection of
+        access is necessarily a local matter.
+
+   (2)  Users have a responsibility to employ available security
+        mechanisms and procedures for protecting their own data.  They
+        also have a responsibility for assisting in the protection of
+        the systems they use.
+
+        Users are expected to handle account privileges in a
+        responsible manner and to follow site procedures for the
+        security of their data as well as that of the system.  For
+        systems which rely upon password protection, users should
+        select good passwords and periodically change them.  Proper
+        use of file protection mechanisms (e.g., access control lists)
+        so as to define and maintain appropriate file access control
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 3]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+        is also part of this responsibility.
+
+   (3)  Computer and network service providers are responsible for
+        maintaining the security of the systems they operate.  They are
+        further responsible for notifying users of their security
+        policies and any changes to these policies.
+
+        A computer or network service provider may manage resources on
+        behalf of users within an organization (e.g., provision of
+        network and computer services with a university) or it may
+        provide services to a larger, external community (e.g., a
+        regional network provider).  These resources may include host
+        computers employed by users, routers, terminal servers, personal
+        computers or other devices that have access to the Internet.
+
+        Because the Internet itself is neither centrally managed nor
+        operated, responsibility for security rests with the owners and
+        operators of the subscriber components of the Internet.
+        Moreover, even if there were a central authority for this
+        infrastructure, security necessarily is the responsibility of
+        the owners and operators of the systems which are the primary
+        data and processing resources of the Internet.
+
+        There are tradeoffs between stringent security measures at a
+        site and ease of use of systems (e.g., stringent security
+        measures may complicate user access to the Internet).  If a site
+        elects to operate an unprotected, open system, it may be
+        providing a platform for attacks on other Internet hosts while
+        concealing the attacker's identity.  Sites which do operate
+        open systems are nonetheless responsible for the behavior of
+        the systems' users and should be prepared to render assistance
+        to other sites when needed.  Whenever possible, sites should
+        try to ensure authenticated Internet access.  The readers are
+        directed to appendix A for a brief descriptive list of elements
+        of good security.
+
+        Sites (including network service providers) are encouraged to
+        develop security policies.  These policies should be clearly
+        communicated to users and subscribers.  The Site Security
+        Handbook (FYI 8, RFC 1244) provides useful information and
+        guidance on developing good security policies and procedures
+        at both the site and network level.
+
+   (4)  Vendors and system developers are responsible for providing
+        systems which are sound and which embody adequate security
+        controls.
+
+
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 4]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+        A vendor or system developer should evaluate each system in
+        terms of security controls prior to the introduction of the
+        system into the Internet community.  Each product (whether
+        offered for sale or freely distributed) should describe the
+        security features it incorporates.
+
+        Vendors and system developers have an obligation to repair
+        flaws in the security relevant portions of the systems they
+        sell (or freely provide) for use in the Internet.  They are
+        expected to cooperate with the Internet community in
+        establishing mechanisms for the reporting of security flaws and
+        in making security-related fixes available to the community in
+        a timely fashion.
+
+   (5)  Users, service providers, and hardware and software vendors are
+        responsible for cooperating to provide security.
+
+        The Internet is a cooperative venture.  The culture and
+        practice in the Internet is to render assistance in security
+        matters to other sites and networks.  Each site is expected to
+        notify other sites if it detects a penetration in progress at
+        the other sites, and all sites are expected to help one another
+        respond to security violations.  This assistance may include
+        tracing connections, tracking violators and assisting law
+        enforcement efforts.
+
+        There is a growing appreciation within the Internet community
+        that security violators should be identified and held
+        accountable.  This means that once a violation has been detected,
+        sites are encouraged to cooperate in finding the violator and
+        assisting in enforcement efforts.  It is recognized that many
+        sites will face a trade-off between securing their sites as
+        rapidly as possible versus leaving their site open in the hopes
+        of identifying the violator.  Sites will also be faced with the
+        dilemma of limiting the knowledge of a penetration versus
+        exposing the fact that a penetration has occurred.  This policy
+        does not dictate that a site must expose either its system or
+        its reputation if it decides not to, but sites are encouraged
+        to render as much assistance as they can.
+
+   (6)  Technical improvements in Internet security protocols should be
+        sought on a continuing basis.  At the same time, personnel
+        developing new protocols, hardware or software for the Internet
+        are expected to include security considerations as part of the
+        design and development process.
+
+        The points discussed above are all administrative in nature,
+        but technical advances are also important.  Existing protocols
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 5]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+        and operating systems do not provide the level of security that
+        is desired and feasible today.  Three types of advances are
+        encouraged:
+
+        (a)  Improvements should be made in the basic security
+             mechanisms already in place.  Password security is
+             generally poor throughout the Internet and can be
+             improved markedly through the use of tools to administer
+             password assignment and through the use of better
+             authentication technology.  At the same time, the
+             Internet user population is expanding to include a
+             larger percentage of technically unsophisticated users.
+             Security defaults on delivered systems and the controls
+             for administering security must be geared to this growing
+             population.
+
+         (b)  Security extensions to the protocol suite are needed.
+              Candidate protocols which should be augmented to improve
+              security include network management, routing, file
+              transfer, telnet, and mail.
+
+         (c)  The design and implementation of operating systems should
+              be improved to place more emphasis on security and pay
+              more attention to the quality of the implementation of
+              security within systems on the Internet.
+
+APPENDIX A
+
+   Five areas should be addressed in improving local security:
+
+   (1)  There must be a clear statement of the local security policy,
+        and this policy must be communicated to the users and other
+        relevant parties.  The policy should be on file and available
+        to users at all times, and should be communicated to users as
+        part of providing access to the system.
+
+   (2)  Adequate security controls must be implemented.  At a minimum,
+        this means controlling access to systems via passwords,
+        instituting sound password management, and configuring the
+        system to protect itself and the information within it.
+
+   (3)  There must be a capability to monitor security compliance and
+        respond to incidents involving violation of security.  Logs of
+        logins, attempted logins, and other security-relevant events
+        are strongly advised, as well as regular audit of these logs.
+        Also recommended is a capability to trace connections and other
+        events in response to penetrations.  However, it is important
+        for service providers to have a well thought out and published
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 6]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+        policy about what information they gather, who has access to it
+        and for what purposes.  Maintaining the privacy of network
+        users should be kept in mind when developing such a policy.
+
+   (4)  There must be an established chain of communication and control
+        to handle security matters.  A responsible person should be
+        identified as the security contact.  The means for reaching the
+        security contact should be made known to all users and should
+        be registered in public directories, and it should be easy for
+        computer emergency response centers to find contact information
+        at any time.
+
+        The security contact should be familiar with the technology and
+        configuration of all systems at the site or should be able to
+        get in touch with those who have this knowledge at any time.
+        Likewise, the security contact should be pre-authorized to make
+        a best effort to deal with a security incident, or should be
+        able to contact those with the authority at any time.
+
+   (5)  Sites and networks which are notified of security incidents
+        should respond in a timely and effective manner.  In the case
+        of penetrations or other violations, sites and networks should
+        allocate resources and capabilities to identify the nature of
+        the incident and limit the damage.  A site or network cannot be
+        considered to have good security if it does not respond to
+        incidents in a timely and effective fashion.
+
+        If a violator can be identified, appropriate action should be
+        taken to ensure that no further violations are caused.  Exactly
+        what sanctions should be brought against a violator depend on
+        the nature of the incident and the site environment.  For
+        example, a university may choose to bring internal disciplinary
+        action against a student violator.
+
+        Similarly, sites and networks should respond when notified of
+        security flaws in their systems.  Sites and networks have the
+        responsibility to install fixes in their systems as they become
+        available.
+
+
+
+
+
+
+
+
+
+
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 7]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+A Bibliography of Computer and Network Security Related Documents
+
+United States Public Laws (PL) and Federal Policies
+
+   [1] P.L. 100-235, "The Computer Security Act of 1987", (Contained in
+       Appendix C of Citation No. 12, Vol II.), Jan. 8, 1988.
+
+   [2] P.L. 99-474 (H.R. 4718), "Computer Fraud and Abuse Act of 1986",
+       Oct. 16, 1986.
+
+   [3] P.L. 99-508 (H.R. 4952), "Electronic Communications Privacy Act
+       of 1986", Oct. 21, 1986.
+
+   [4] P.L. 99-591, "Paperwork Reduction Reauthorization Act of 1986",
+       Oct. 30, 1986.
+
+   [5] P.L. 93-579, "Privacy Act of 1984", Dec. 31, 1984.
+
+   [6] "National Security Decision Directive 145", (Contained in
+       Appendix C of Citation No. 12, Vol II.).
+
+   [7] "Security of Federal Automated Information Systems", (Contained
+       in Appendix C of Citation No. 12, Vol II.), Appendix III of,
+       Management of Federal Information Resources, Office of Management
+       and Budget (OMB), Circular A-130.
+
+   [8] "Protection of Government Contractor Telecommunications",
+       (Contained in Appendix C of Citation No. 12, Vol II.), National
+       Communications Security Instruction (NACSI) 6002.
+
+Other Documents
+
+   [9] Secure Systems Study Committee, "Computers at Risk: Safe
+       Computing in the Information Age", Computer Science and
+       Technology Board, National Research Council, 2101 Constitution
+       Avenue, Washington, DC 20418, December 1990.
+
+  [10] Curry, D., "Improving the Security of Your UNIX System", Report
+       No. ITSTD-721-FR-90-21, SRI International, 333 Ravenswood Ave.,
+       Menlo Park, CA, 94025-3493, April 1990.
+
+  [11] Holbrook P., and J. Reynolds, Editors, "Site Security Handbook",
+       FYI 8, RFC 1244, CICNet, ISI, July 1991.
+
+  [12] "Industry Information Protection, Vols. I,II,III", Industry
+       Information Security Task Force, President's National
+       Telecommunications Advisory Committee, June 1988.
+
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 8]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+  [13] Jelen, G., "Information Security: An Elusive Goal", Report No.
+       P-85-8, Harvard University, Center for Information Policy
+       Research, 200 Akin, Cambridge, MA.  02138, June 1985.
+
+  [14] "Electronic Record Systems and Individual Privacy", OTA-CIT-296,
+       Congress of the United States, Office of Technology Assessment,
+       Washington, D.C. 20510, June 1986.
+
+  [15] "Defending Secrets, Sharing Data", OTA-CIT-310, Congress of the
+       United States, Office of Technology Assessment, Washington, D.C.
+       20510, October 1987.
+
+  [16] "Summary of General Legislation Relating to Privacy and Computer
+       Security", Appendix 1 of, COMPUTERS and PRIVACY: How the
+       Government Obtains, Verifies, Uses and Protects Personal Data,
+       GAO/IMTEC-90-70BR, United States General Accounting Office,
+       Washington, DC 20548, pp.  36-40, August 1990.
+
+  [17] Stout, E., "U.S. Geological Survey System Security Plan - FY
+       1990", U.S. Geological Survey ISD, MS809, Reston, VA, 22092, May
+       1990.
+
+Security Considerations
+
+   If security considerations had not been so widely ignored in the
+   Internet, this memo would not have been possible.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Pethia, Crocker, & Fraser                                       [Page 9]
+
+RFC 1281          Guidelines for the Secure Operation      November 1991
+
+
+Authors' Addresses
+
+   Richard D. Pethia
+   Software Engineering Institute
+   Carnegie Mellon University
+   Pittsburgh, Pennsylvania 15213-3890
+
+   Phone:  (412) 268-7739
+   FAX:    (412) 268-6989
+
+   EMail:  rdp@cert.sei.cmu.edu
+
+
+   Stephen D. Crocker
+   Trusted Information Systems, Inc.
+   3060 Washington Road
+   Glenwood, Maryland 21738
+
+   Phone:  (301) 854-6889
+   FAX:    (301) 854-5363
+
+   EMail:  crocker@tis.com
+
+
+   Barbara Y. Fraser
+   Software Engineering Institute
+   Carnegie Mellon University
+   Pittsburgh, Pennsylvania 15213-3890
+
+   Phone:  (412) 268-5010
+   FAX:    (412) 268-6989
+
+   EMail:  byf@cert.sei.cmu.edu
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Pethia, Crocker, & Fraser                                      [Page 10]
+
\ No newline at end of file