P2600 Hardcopy Device and System Security August 2008 Working Group Meeting

1. P2600Hardcopy Device and System SecurityAugust 2008 Working Group Meeting Don Wright Director of Standards Lexmark International don@lexmark.com

2. Opening Agenda Items • Self Introductions • Approval of the Agenda

3. Agenda Items • Monday/Tuesday, August 11-12 • Welcome & Introductions • Update and Approve Agenda • Review and approve June Minutes • IEEE Patent Policy Review • 2008 Meeting Schedule • Update on TCG (Volkoff) • Update on INCITS CS1 Working Group (Thrasher) • Update of CC Vendor's Forum (Sukert) • Review of Action Items from June Meeting • PP Evaluation ad hoc status (Nevo)

4. Agenda Items • Monday/Tuesday, August 11-12 • Protection Profiles Review and Comments • PP-A (36c proto) • PP-B (36c proto) • PP-C (36c proto) • PP-D (36c proto) • Comments • Issues raised on e-mail • Function Access Control Policy • Guide to P2600 PPs ad hoc status (Sukert) • PP Guide Outline • Production Printing Profile (Sukert) • Draft (36c proto)

5. Agenda Items • Monday/Tuesday, August 11-12 • Schedule Review • Other items • Posting and Comment deadlines for the September Meeting • Next meeting details

6. Minutes from June Meeting • Minutes were published shortly after the meeting. • They are available at:http://grouper.ieee.org/groups/2600/minutes/P2600-minutes-Jun2008.pdf • Any additions, deletions or corrections to the June minutes?

7. Instructions for the WG Chair The IEEE-SA strongly recommends that at each WG meeting the chair or a designee: • Show slides #1 through #4 of this presentation • Advise the WG attendees that: • The IEEE’s patent policy is consistent with the ANSI patent policy and is described in Clause 6 of the IEEE-SA Standards Board Bylaws; • Early identification of patent claims which may be essential for the use of standards under development is strongly encouraged; • There may be Essential Patent Claims of which the IEEE is not aware. Additionally, neither the IEEE, the WG, nor the WG chair can ensure the accuracy or completeness of any assurance or whether any such assurance is, in fact, of a Patent Claim that is essential for the use of the standard under development. • Instruct the WG Secretary to record in the minutes of the relevant WG meeting: • That the foregoing information was provided and that slides 1 through 4 (and this slide 0, if applicable) were shown; • That the chair or designee provided an opportunity for participants to identify patent claim(s)/patent application claim(s) and/or the holder of patent claim(s)/patent application claim(s) of which the participant is personally aware and that may be essential for the use of that standard • Any responses that were given, specifically the patent claim(s)/patent application claim(s) and/or the holder of the patent claim(s)/patent application claim(s) that were identified (if any) and by whom. • The WG Chair shall ensure that a request is made to any identified holders of potential essential patent claim(s) to complete and submit a Letter of Assurance. • It is recommended that the WG chair review the guidance in IEEE-SA Standards Board Operations Manual 6.3.5 and in FAQs 12 and 12a on inclusion of potential Essential Patent Claims by incorporation or by reference. Note: WG includes Working Groups, Task Groups, and other standards-developing committees with a PAR approved by the IEEE-SA Standards Board. (Optional to be shown)

8. Participants, Patents, and Duty to Inform • All participants in this meeting have certain obligations under the IEEE-SA Patent Policy. Participants: • “Shall inform the IEEE (or cause the IEEE to be informed)” of the identity of each “holder of any potential Essential Patent Claims of which they are personally aware” if the claims are owned or controlled by the participant or the entity the participant is from, employed by, or otherwise represents • “Personal awareness” means that the participant “is personally aware that the holder may have a potential Essential Patent Claim,” even if the participant is not personally aware of the specific patents orpatent claims • “Should inform the IEEE (or cause the IEEE to be informed)” of the identity of “any other holders of such potential Essential Patent Claims” (that is, third parties that are not affiliated with the participant, with the participant’s employer, or with anyone else that the participant is from or otherwise represents) • The above does not apply if the patentclaim is already the subject of an Accepted Letter of Assurance that applies to the proposed standard(s) under consideration by this group (Quoted text excerpted from IEEE-SA Standards Board Bylaws subclause 6.2) • Early identification of holders of potential Essential Patent Claims is strongly encouraged • No duty to perform a patent search Slide #1

9. Patent Related Links All participants should be familiar with their obligations under the IEEE-SA Policies & Procedures for standards development. Patent Policy is stated in these sources: • IEEE-SA Standards Boards Bylaws http://standards.ieee.org/guides/bylaws/sect6-7.html#6 • IEEE-SA Standards Board Operations Manual http://standards.ieee.org/guides/opman/sect6.html#6.3 • Material about the patent policy is available at http://standards.ieee.org/board/pat/pat-material.html If you have questions, contact the IEEE-SA Standards Board Patent Committee Administrator at patcom@ieee.org or visit http://standards.ieee.org/board/pat/index.html This slide set is available at http://standards.ieee.org/board/pat/pat-slideset.ppt Slide #2

10. Call for Potentially Essential Patents • If anyone in this meeting is personally aware of the holder of any patent claims that are potentially essential to implementation of the proposed standard(s) under consideration by this group and that are not already the subject of an Accepted Letter of Assurance: • Either speak up now or • Provide the chair of this group with the identity of the holder(s) of any and all such claims as soon as possible or • Cause an LOA to be submitted Slide #3

11. Other Guidelines for IEEE WG Meetings • All IEEE-SA standards meetings shall be conducted in compliance with all applicable laws, including antitrust and competition laws. • Don’t discuss the interpretation, validity, or essentiality of patents/patent claims. • Don’t discuss specific license rates, terms, or conditions. • Relative costs, including licensing costs of essential patent claims, of different technical approaches may be discussed in standards development meetings. • Technical considerations remain primary focus • Don’t discuss or engage in the fixing of product prices, allocation of customers, or division of sales markets. • Don’t discuss the status or substance of ongoing or threatened litigation. • Don’t be silent if inappropriate topics are discussed … do formally object. --------------------------------------------------------------- See IEEE-SA Standards Board Operations Manual, clause 5.3.10 and “Promoting Competition and Innovation: What You Need to Know about the IEEE Standards Association's Antitrust and Competition Policy” for more details. Slide #4

12. 2008 Meeting Schedule • September 9-10: Arlington, VA @ Sharp • October 24: Lexington, KY @ Lexmark (with PWG) • December 11-12: Plantation, FL @ Equitrac

13. Trusted Computing Group Update

14. INCITS CS1 : Cyber-Security Update Thrasher

15. CS1 topics that might be of interest to P2600 • CS1 Project -- Small Organization Baseline Information Security Handbook(approved in CS1 and forwarded to INCITS EB) • Presentation of the NIST proposal for a new project in CS1 – The Policy Machine(no definitive decision, created ad-hoc to further discuss) • ISO/IEC 3rd FCD 15408-1 -- Information technology -- Security techniques -- Evaluation criteria for IT security -- Part 1: Introduction and general model(approved without comment)

16. CS1 topics for Sept. meeting that might be of interest to P2600 • ISO/IEC 1st CD 27033-1, Information technology -- Security techniques -- Network security -- Part 1: Guidelines for network security • ISO/IEC 3rd WD 27033-2 (18028-2) -- Information technology -- Security techniques -- Network security -- Part 2: Guidelines for the design and implementation of network security • ISO/IEC 2nd WD 27033-3 -- Information technology -- Security techniques - Network security Part 3: Reference network scenarios Risks, design techniques and control issues

17. CC Vendors Forum Update Sukert/Thrasher

18. Action Items from Previous Meetings • Review entries in P2600-action-items excel spreadsheet • Pre-meeting Spreadsheet • ??

19. Old Business • PP Evaluation ad hoc (Nevo) • Report

20. Protection Profiles • Protection Profiles Comments • PP-A • PP-B • PP-C • PP-D

21. Issues raised on e-mail • Function Access Control Policy • Document

22. Current Status: PP Guide Version 37a posted Contains expanded outline for all sections plus first draft of sections 1-3. Draft of Section 5.2.1 (Vendor Guidelines) under review Plan Post PP Guide Version 38a for Sep 08 P2600 Meeting by Aug 26th Will incorporate Chapter 5.2.1 plus as many additional sections as are available Have initial text for all sections for posting and review at Oct P2600 Meeting available by Oct 10th Will try to have as much as we can by then Approve initial PP Guide at Dec P2600 Meeting PP Guide Ad Hoc Team

23. Production Printing Protection Profile • Production Printing Profile Status (Sukert) • Report • Current draft (version 36c proto) • Issues/Comments/Ideas?

24. Project Schedule

25. Other Items • 2009 Meeting Plan? • Is February all we need? • Others?

26. September Meeting Deadlines • All PPs are under change control • All comments must be in the tool • The editor may not make changes EXCEPT based on submitted and accepted comments. • Posting of Documents: August 26, 2008 • Posting of Comments: September 2, 2008

27. Next Meeting Details • September 9-10, 2008 • Sharp1300 Wilson Blvd., Suite 800Arlington VA 22209 • No hotel block • Rosslyn Metro station is diagonally across the street. This area is close to the Key Bridge across the Potomac from Georgetown. • Parking in bldg -- $12 per day ($8 if you arrive before 8 AM). Use the garage entrance on the Fort Meyer Drive side of the building. Take the elevator to the 8th floor.

28. Next Meeting Location Map

29. Thanks! • See you in Washington!!

30. Back-up Charts BACK-UP CHARTS

31. Existing Project Schedule • May Meeting (May 21-22) • Feedback from atsec • Recommendation on “family” versus “packages” • June Meeting (June 23-24 in Longmont CO) • WG Comments on “packages” draft • Feedback from atsec • Feedback from IPA from JBMIA meeting • Update on Production Printing Profile • Make a decision on getting a PAR for Production Printing Profile • Make a decision on the SCHEME(s) to be used • Create new sponsor ballot bodies (After June 28) • August Meeting (Aug 11 & 12) @ Sharp in Portland OR • Revisit NIAP CIM comments • Deal with SCHEME comments • Deal with WG comments • Draft of Guide • Start Evaluation of PPs (post meeting) • Start .1, .2, .3, & .4 Sponsor Ballot (post meeting) • September Meeting (Sept 9 & 10 at Sharp in Washington DC) • Deal with any comments received from SCHEME/atsec • Work on Guide • October Meeting (Oct 24 at Lexmark in Lexington) • Process sponsor ballot comments on .1, .2, .3, .4 • Deal with any comments received from SCHEME/atsec • Discuss if PP’s still match Std 2600 – if not, process amendment PAR • Work on Guide • December (Dec 11-12 at Equitrac in Hollywood, FL) Meeting • Deal with any comments received from SCHEME/atsec • Process Sponsor Ballot *recirculation” Comments • Finish Guide

32. Mailing List and Web Site • Web Site: http://grouper.ieee.org/groups/2600 • Mailing list: • Listserv run by the IEEE • An archive is available on the web site • Subscribe via a note to: listserv@listserv.ieee.orgcontaining the line:subscribe stds-2600 • Only subscribers may send e-mail to the mailing list. No Change