diff --git a/safelist.md b/safelist.md new file mode 100644 index 0000000..12d24b6 --- /dev/null +++ b/safelist.md @@ -0,0 +1,44 @@ +### Refined General Structure + +#### Hierarchical Approach + +1. **Manufacturer Level**: + - Contains general policies and information applicable to all devices from that manufacturer. + - Includes a `whitelist-ips.json` and `security-contact.json` relevant to the entire range of products. + +2. **Device-Specific Level**: + - Provides detailed, device-specific instructions and information. + - Contains its own `whitelist-ips.json`, `security-contact.json`, and `firewall-profile.json`. + - Device-specific information overrides manufacturer-level information when present. + +#### Example Structure + +```plaintext +/.well-known/device-instructions + /{manufacturer} + /safelist-ips.json # Manufacturer-level IP safelist + /security-contact.json # Manufacturer-level security contact + /{device-model} + /instructions.json # Specific device instructions + /firewall-profile.json # Device-specific firewall profile + /safelist-ips.json # Device-specific IP safelist + /security-contact.json # Device-specific security contact +``` + +#### Precedence Rules + +- **Device-Specific Over Manufacturer-Level**: Routers and other network management tools should prioritize device-specific instructions and settings. If a device-specific `whitelist-ips.json` or `security-contact.json` exists, it should override the manufacturer-level files. + +#### Goals for Hierarchical Safelist and Contacts + +- **Flexibility and Specificity**: Allow for both broad policies applicable across all devices and specific configurations tailored to individual models. +- **Clarity in Implementation**: Ensure that device-specific precedence over manufacturer-level information is clear and easy to implement in network management systems. +- **Enhanced Security and Compatibility**: Provide more precise security and operational guidelines, enhancing each device's security posture and operating compatibility. + +#### Additional Considerations + +- **Documentation and Communication**: Document the hierarchy and precedence rules, ensuring manufacturers and network administrators understand how to implement and interpret these files. +- **Update Mechanisms**: Establish efficient processes for updating manufacturer-level and device-specific files to keep them current and relevant. +- **Testing and Validation**: Rigorously test the hierarchical structure to ensure routers and network tools correctly apply the precedence rules in various scenarios. + +With this refined structure, you can create a robust framework for disseminating device and manufacturer-specific firewall profiles, IP safelists, and security contacts, greatly enhancing networked devices' security and operational efficiency. \ No newline at end of file