Last Call Review of draft-ietf-intarea-server-logging-recommendations-

Request Review of draft-ietf-intarea-server-logging-recommendations
Requested rev. no specific revision (document currently at 04)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2011-03-15
Requested 2011-02-26
Authors Alain Durand, Donn Lee, Igor Gashinsky, Scott Sheppard
Draft last updated 2011-04-06
Completed reviews Secdir Last Call review of -?? by Kathleen Moriarty
Assignment Reviewer Kathleen Moriarty 
State Completed
Review review-ietf-intarea-server-logging-recommendations-secdir-lc-moriarty-2011-04-06
Review completed: 2011-04-06


I reviewed this document (draft-ietf-intarea-server-logging-recommendations-03) as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

The document looks pretty good from a security standpoint, but I would recommend adding a few other items to be considered out-of-scope or additional security considerations would be necessary.  Since the document already mentions that record retention is out-of-scope, I think it would be useful to add that server security and transport security is important for the protection of logs for Internet facing systems.    After stating that it is an important consideration, then state something to the effect of the service provider must consider the risks, including the data and services on the server to determine the appropriate measures.

The protection of logs is critical in incident investigations.  If logs are tampered with, evidence could be destroyed.

I did see a few grammar nits as well.  The Gen-Art review should cover that.  If you want me to take a look at it after these adjustments have been made, I would be happy to assist.

Best regards,