RFC 3871           Operational Security Requirements      September 2004

   Examples.

      An RS232 (EIA232) interface that provides the capability to load

      new versions of the system software and to perform configuration

      via a command line interface.  RS232 interfaces are ubiquitous and

      well understood.

      A simple embedded device that provides management and

      configuration access via an Ethernet or USB interface.

      As of this writing, RS232 is still strongly recommended as it

      provides the following benefits:

      *  Simplicity.  RS232 is far simpler than the alternatives.  It is

         simply a hardware specification.  By contrast an Ethernet based

         solution might require an ethernet interface, an operating

         system, an IP stack and an HTTP server all to be functioning

         and properly configured.

      *  Proven.  RS232 has more than 30 years of use.

      *  Well Understood.  Operators have a great deal of experience

         with RS232.

      *  Availability.  It works even in the presence of network

         failure.

      *  Ubiquity.  It is very widely deployed in mid to high end

         network infrastructure.

      *  Low Cost.  The cost of adding a RS232 port to a device is

         small.

      *  CLI Friendly.  An RS232 interface and a CLI are sufficient in

         most cases to manage a device.  No additional software is

         required.

      *  Integrated.  Operators have many solutions (terminal servers,

         etc.) currently deployed to support management via RS232.

         While other interfaces may be supplied, the properties listed

         above should be considered.  Interfaces not having these

         properties may present challenges in terms of ease of use,

         integration or adoption.  Problems in any of these areas could

         have negative security impacts, particularly in situations

         where the console must be used to quickly respond to incidents.

Jones                        Informational                     [Page 18]