Subject: [Detnet] WG adoption poll draft-sdt-detnet-security-01

From: Lou Berger <[email-masked]>
Date: Tue, 12 Sep 2017 08:13:54 -0400

All,

This is start of a two week poll on making draft-sdt-detnet-security-01
a working group document. Please send email to the list indicating
"yes/support" or "no/do not support".  If indicating no, please state
your reservations with the document.  If yes, please also feel free to
provide comments you'd like to see addressed once the document is a WG
document.

The poll ends Sep 26.

Thanks,

Lou (and Pat)

---

From: "Grossman, Ethan A." <[email-masked]>
Date: Tue, 12 Sep 2017 17:21:56 +0000

Thanks Lou, 
Yes/support. 

On behalf of the DetNet Security Design Team, we are pleased and excited about achieving workgroup adoption, and we look forward to input from the broader DetNet community. Below is our current list of items which we would like to address next in the draft - if anyone has additional suggestions or would like to help with the next release of the draft, which we are planning for IETF 100, please reply. 

1) We need to make another pass through every section to clean up loose ends, unify the writing style and flesh out some of the statements.
2) Given that the Data Plane has been basically established, we need to extend the draft to address these specifics (e.g. implied by use of IPv6 and/or MPLS-PW).
3) We believe it would be helpful to establish solid requirements before we can expect external reviewers to review this draft, so our intent is to take the various use case statements in the appendix and turn them into more formal statement of requirements that a reviewer could measure our draft against.
4) We need to review and improve our threat model to reduce our chances of being blind-sided by threats we haven't addressed.  
5) The current structure of the document has some "unusual" things about it, for example the section about use cases in which there are statements that are phrased as questions (like "does the threat attack the timely arrival of packets?") - we need to come up with a better way to phrase this information.

Best,
Ethan Grossman
DetNet Security Draft editor

-----Original Message-----
From: detnet [mailto:[email-masked]] On Behalf Of Lou Berger
Sent: Tuesday, September 12, 2017 5:14 AM
To: DetNet WG <[email-masked]>
Cc: DetNet Chairs <[email-masked]>
Subject: [Detnet] WG adoption poll draft-sdt-detnet-security-01

All,

This is start of a two week poll on making draft-sdt-detnet-security-01 a working group document. Please send email to the list indicating "yes/support" or "no/do not support".  If indicating no, please state your reservations with the document.  If yes, please also feel free to provide comments you'd like to see addressed once the document is a WG document.

The poll ends Sep 26.

Thanks,

Lou (and Pat)

_______________________________________________
detnet mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/detnet

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 12 Sep 2017 17:34:06 +0000

Dear chairs,

Support.

Determinism introduces new capabilities on which applications will rely. 
This also means new threats to the application if an attack or a malfunction prevents the network from operating as expected. 
We need to clarify what the new threats are and how they can be discovered and mitigated.
This document is a great step towards that goal and for that reason I support the adoption as WG document

Cheers,

Pascal

-----Original Message-----
From: detnet [mailto:[email-masked]] On Behalf Of Lou Berger
Sent: mardi 12 septembre 2017 14:14
To: DetNet WG <[email-masked]>
Cc: DetNet Chairs <[email-masked]>
Subject: [Detnet] WG adoption poll draft-sdt-detnet-security-01

All,

The poll ends Sep 26.

Thanks,

Lou (and Pat)

---

From: Mach Chen <[email-masked]>
Date: Wed, 13 Sep 2017 09:29:49 +0000

Yes/support.

Best regards,
Mach

> Sent: Tuesday, September 12, 2017 8:14 PM
> This is start of a two week poll on making draft-sdt-detnet-security-01 a
> working group document. Please send email to the list indicating
> "yes/support" or "no/do not support".  If indicating no, please state your
> reservations with the document.  If yes, please also feel free to provide
> comments you'd like to see addressed once the document is a WG
> document.
> 
> The poll ends Sep 26.
> 
> Thanks,
> 
> Lou (and Pat)
>

---

From: "Maik Seewald (maseewal)" <[email-masked]>
Date: Wed, 13 Sep 2017 14:22:44 +0000

Hello Ethan,

Only a few comments on the use cases for the industries, especially in the
utility environment:

- Especially in power automation, there is more and more regulation
including standards (e.g.: NERC CIP in North America)
- Availability and integrity are the most important security objectives
(and requirements), confidentiality and privacy are relevant if customer
or market data is involved
- Along these lines, there is a requirement for end-to-end security which
is already standardised (and implemented) for many automation and control
protocols (protecting the app layer and/or transport[typically using TLS])
- Another security control which is also standardised and implemented is
segmentation (zones and conduits including access control)
- These are two trends any communication architecture need to deal with
- The requirements in industrial automation are quite similar, especially
in new scenarios such as Industry 4.0/Digital Factory where workflows and
protocols cross zones, segments, and entities
- IEC 62443 (ISA99) defines security for Industrial Automation and Control
Systems (IACS), typically for installations in the critical infrastructure
- It comprises domains such as industrial automation, oil&gas, and
electricity transmission and distribution; the foundational requirements
are a great source for industrial security

Regarding the Detnet specifics, IMHO, it is imperative to protect the
network controller (wherever a controller is used) using strong security
controls and mitigation technologies.
A hacked/compromised controller would allow any disastrous (attack)
scenario.

Cheers,
Maik 

On 12.09.17, 19:21, "detnet on behalf of Grossman, Ethan A."
<[email-masked] on behalf of [email-masked]> wrote:

>Thanks Lou, 
>Yes/support. 
>
>On behalf of the DetNet Security Design Team, we are pleased and excited
>about achieving workgroup adoption, and we look forward to input from the
>broader DetNet community. Below is our current list of items which we
>would like to address next in the draft - if anyone has additional
>suggestions or would like to help with the next release of the draft,
>which we are planning for IETF 100, please reply.
>
>1) We need to make another pass through every section to clean up loose
>ends, unify the writing style and flesh out some of the statements.
>2) Given that the Data Plane has been basically established, we need to
>extend the draft to address these specifics (e.g. implied by use of IPv6
>and/or MPLS-PW).
>3) We believe it would be helpful to establish solid requirements before
>we can expect external reviewers to review this draft, so our intent is
>to take the various use case statements in the appendix and turn them
>into more formal statement of requirements that a reviewer could measure
>our draft against.
>4) We need to review and improve our threat model to reduce our chances
>of being blind-sided by threats we haven't addressed.
>5) The current structure of the document has some "unusual" things about
>it, for example the section about use cases in which there are statements
>that are phrased as questions (like "does the threat attack the timely
>arrival of packets?") - we need to come up with a better way to phrase
>this information.
>
>Best,
>Ethan Grossman

---

From: "Patrick Wetterwald (pwetterw)" <[email-masked]>
Date: Wed, 13 Sep 2017 14:51:40 +0000

Sure, we need it. 

Support.

Thanks,

Patrick

On 12/09/2017, 14:13, "detnet on behalf of Lou Berger" <[email-masked] on behalf of [email-masked]> wrote:

    All,

    The poll ends Sep 26.
    
    Thanks,
    
    Lou (and Pat)

---

From: "Maik Seewald (maseewal)" <[email-masked]>
Date: Wed, 13 Sep 2017 14:59:04 +0000

Yes/Support.

I missed this in my previous mail.

Cheers, Maik

---

From: "Andrew G. Malis" <[email-masked]>
Date: Thu, 14 Sep 2017 09:35:59 +0300

Yes/support. As others have noted, it’s a good start for a comprehensive WG
draft on detnet security.

Cheers,
Andy

---

From: Loa Andersson <[email-masked]>
Date: Thu, 14 Sep 2017 09:50:22 +0200

WG,

Yes I agree with Andy, we should adopt this draft.

/Loa

On 2017-09-14 08:35, Andrew G. Malis wrote:
> Yes/support. As others have noted, it’s a good start for a comprehensive 
> WG draft on detnet security.
> 
> Cheers,
> Andy
> 
> 
> On Tue, Sep 12, 2017 at 3:13 PM, Lou Berger <[email-masked] 
> <mailto:[email-masked]>> wrote:
> 
>     All,
> 
>     [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/detnet>
> 
> 
> 
> 

-- 

Loa Andersson                        email: [email-masked]
Senior MPLS Expert                          [email-masked]
Huawei Technologies (consultant)     phone: +46 739 81 21 64

---

From: Rodney Cummings <[email-masked]>
Date: Thu, 14 Sep 2017 20:45:31 +0000

Yes/support.

In a future draft, it would be helpful to describe the impact of a data-plane delay attack on the end application, especially uses cases for real-time control (e.g. industrial automation, automotive). For example, if the network promises a bounded latency of 2ms for a flow, what happens when my destination receives it with 5ms latency? The control loop processes data that is "old" in the real world, which can potentially threaten safety. One mitigation is to timestamp the data at the source, and timestamp again at the destination, and if the resulting latency exceeds the promised bound, discard that data and warn the operator (and/or enter a fail-safe mode).

> Sent: Tuesday, September 12, 2017 7:14 AM
> https://urldefense.proofpoint.com/v2/url?u=https-
> 3A__www.ietf.org_mailman_listinfo_detnet&d=DwICAg&c=I_0YwoKy7z5LMTVdyO6YCi
> E2uzI1jjZZuIPelcSjixA&r=WA71sf2o7Dw7CbYhFt24DPjt3lJuupswWYdnboKbZ8k&m=7-
> ezH-
> ZZZ1WtMQJKZFCxbUmOD40MSj0Dw8S78bg5qdg&s=vGEbadje3J9dVol_jPL8ewwdJDTzhZqb9l
> WiwyRw0N4&e=

---

From: Henrik Austad <[email-masked]>
Date: Fri, 15 Sep 2017 14:40:09 +0200

Yes/Support.

-- 
Henrik Austad

---

From: Tal Mizrahi <[email-masked]>
Date: Mon, 18 Sep 2017 09:49:19 +0300

As a coauthor, I support the adoption of this draft.

Cheers,
Tal.

---

From: János Farkas <[email-masked]>
Date: Wed, 27 Sep 2017 18:47:43 +0200

Hi,

I support the adoption of this draft.

Best regards,
Janos

---

From: Balázs Varga A <[email-masked]>
Date: Thu, 28 Sep 2017 08:47:26 +0000

Hi, I support the adoption of this draft. Cheers Bala'zs

-----Original Message-----
From: detnet [mailto:[email-masked]] On Behalf Of Lou Berger
Sent: 2017. szeptember 12. 14:14
To: DetNet WG <[email-masked]>
Cc: DetNet Chairs <[email-masked]>
Subject: [Detnet] WG adoption poll draft-sdt-detnet-security-01

All,

The poll ends Sep 26.

Thanks,

Lou (and Pat)

---

From: Jiangyuanlong <[email-masked]>
Date: Fri, 29 Sep 2017 11:09:52 +0000

Yes/support.

-----Original Message-----
From: detnet [mailto:[email-masked]] On Behalf Of Lou Berger
Sent: Tuesday, September 12, 2017 8:14 PM
To: DetNet WG
Cc: DetNet Chairs
Subject: [Detnet] WG adoption poll draft-sdt-detnet-security-01

All,

The poll ends Sep 26.

Thanks,

Lou (and Pat)

---

From: Lou Berger <[email-masked]>
Date: Fri, 29 Sep 2017 12:20:32 -0400

All,

    This poll is complete (as of Sept 26).  The document is adopted.

Authors,

    Please republish the draft-sdt-detnet-security-01 as
draft-ietf-detnet-security-00 with the filename and date being the only
changes.

Thank you!

Lou (and Pat)