IETF Last Call Review of draft-ietf-opsawg-collected-data-manifest-14
review-ietf-opsawg-collected-data-manifest-14-secdir-lc-orman-2026-09-01-00

Do not be alarmed.  I generated this review of this document as part
of the security directorate's ongoing effort to review all IETF
documents being processed by the IESG.  These comments were written
with the intent of improving security requirements and considerations
in IETF drafts.  Comments not addressed in last call may be included
in AD reviews during the IESG review.  Document editors and WG chairs
should treat these comments just like any other last call comments.

The document describes YANG modules for metadata about network data
sets that have been collected and reported: the details of the platform
that collected the data, the times when the data was actually
collected, etc.

The security considerations mentions that some data is sensitive:

   "platforms/platform contains details about the platform that an
      attacker could use to find the known vulnerabilities of the
      platform."

I would add that the description of the data collection period
is also sensitive.  It could reveal the schedule of data collection,
and that could be helpful if an attacker wants conduct nefarious
activity when data is not being collected.

The transport layer for the collected data and the new data collection
metadata must be protected and authenticated.  The document mentions
that data origin authenticity and integrity could be provided by 
methods described in draft-ietf-opsawg-yang-provenance.

  "As the present approach reuses an existing telemetry system, the
   security considerations lie with the new content divulged in the new
   manifests.  Appropriate access control filters must be associated to
   the corresponding leafs and containers, as well as the databases
   storing them."

I am not sure if access control filters are a standard part of
existing YANG deployments.  Might it be the case that an existing
system assumes that it handles non-sensitive data only and therefore
has no means of adding filters?  Are they required?

The telemetry collection systems can presumably be configured to
send some of the defined data items and not send others.  The document
should mention that administrators of machines should not send all of
this new metadata if it will expose sensitive information about the
machines or their operation.

Hilarie