Subject: [I2nsf] Security event reporting management - the firstMILE

From: Robert Moskowitz <[email-masked]>
Date: Tue, 22 Mar 2016 12:08:57 -0400

One of the functions described within the I2NSF environment is 
monitoring security events.  I have not found any IETF work covering 
general security alerts from security defense devices aside from the 
specific DDoS reporting in DOTS.  So I have developed firstMILE:

https://www.ietf.org/internet-drafts/draft-moskowitz-firstmile-00.txt

Which proposes a sub/pub model including initial registration for 
security alerts reporting.

At this point the draft is more a skeleton for hanging how the three 
components work:

Registration of security device to monitor(s).
Subscription of monitors for specific reporting.
Publication of security reports to subscribed monitors.

I have covered some of the requirements for these components.  I bring 
this to the I2NSF workgroup for:

Is this something the I2NSF wg should talk on?
And am I correct that currently security alert reporting is not covered 
within the IETF.

For the pub portion, I hold that the requirements align with the DOTS 
requirements, other than the bi-directional communications needs.  Do 
others agree?  If so, I have a DOTS draft:

https://www.ietf.org/internet-drafts/draft-moskowitz-dots-ssls-02.txt

DOTS Secure Session Layer Services

This introduces a real session layer, something really not present in 
the IETF stack, that provides a set of services.  SSLS and its services 
are laid out in:

https://www.ietf.org/internet-drafts/draft-hares-i2nsf-ssls-00.txt

Sue and I developed the design for SSLS, as it is broadly applicable in 
a number of areas under i2nsf.

Two other drafts that fit into this architecture are:

https://www.ietf.org/internet-drafts/draft-moskowitz-sse-03.txt
and
https://www.ietf.org/internet-drafts/draft-moskowitz-gpcomp-00.txt

SO.....

I open the floor to discussion.

I would be interested in how others see this part of the security 
defense environment.

I am interested in how others see SLS and particularly SSLS and its use 
for firstMILE pub.  I have requested a slot in the meeting to cover my work.

---

From: "Susan Hares" <[email-masked]>
Date: Thu, 24 Mar 2016 18:29:55 -0400

I2NSF people: 

The I2NSF gap analysis and I2RS work on management flows during DDoS or
network attacks (I'm a co-chair) cause me to realize there was something
different during periods of outage/network attack.  The growth of this is
expanding beyond the management interfaces to BGP.   BGP's Flow
Specification is being expanded to spread flow filters (RFC5575++++)
(another WG I co-chair) that help stop DDoS attacks in carriers.   After
being hit with the perfect storm of needs in 3 WGs, Bob and I looked at the
problem (draft-hares-i2nsf-mgtflow) and solutions. 

I suspect the first thing to look at is the problem and provide us feedback.
If you want to discuss the solutions, we are glad to chat about it as well. 

Sue 

-----Original Message-----
From: I2nsf [mailto:[email-masked]] On Behalf Of Robert Moskowitz
Sent: Tuesday, March 22, 2016 12:09 PM
To: [email-masked]
Subject: [I2nsf] Security event reporting management - the firstMILE

One of the functions described within the I2NSF environment is monitoring
security events.  I have not found any IETF work covering general security
alerts from security defense devices aside from the specific DDoS reporting
in DOTS.  So I have developed firstMILE:

Which proposes a sub/pub model including initial registration for security
alerts reporting.

I have covered some of the requirements for these components.  I bring this
to the I2NSF workgroup for:

For the pub portion, I hold that the requirements align with the DOTS
requirements, other than the bi-directional communications needs.  Do others
agree?  If so, I have a DOTS draft:

This introduces a real session layer, something really not present in the
IETF stack, that provides a set of services.  SSLS and its services are laid
out in:

Sue and I developed the design for SSLS, as it is broadly applicable in a
number of areas under i2nsf.

SO.....

I would be interested in how others see this part of the security defense
environment.

I am interested in how others see SLS and particularly SSLS and its use for
firstMILE pub.  I have requested a slot in the meeting to cover my work.

_______________________________________________
I2nsf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i2nsf