Subject: [bmwg] draft-green-bmwg-seceff-bench-meth-00

From: Kenneth Green <[email-masked]>
Date: Tue, 25 Oct 2011 02:53:20 +0000

Hi Team,

A new Internet Draft has been posted addressing benchmark testing of Security Effectiveness.

http://www.ietf.org/id/draft-green-bmwg-seceff-bench-meth-00.txt

We would like to solicit discussion about the concepts described in this draft and look forward to your comments, questions and suggestions.

Regards,
Kenneth

Kenneth Green
Solution Architect
Ixia

---

From: "Jan Novak (janovak)" <[email-masked]>
Date: Thu, 27 Oct 2011 14:00:33 +0200

Hi,

It sounds intuitive (I am not very familiar with this

area), but maybe you should include a definition of

an attack - is each  Evil Packet equivalent to one

attack or is it the whole transaction/flow which represents

an attack ??

Jan

The climate of Edinburgh is such that the weak succumb young .... 

and the strong envy them.

                                 Dr. Johnson

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Kenneth Green
Sent: 25 October 2011 03:53
To: [email-masked]
Subject: [bmwg] draft-green-bmwg-seceff-bench-meth-00

Hi Team,

A new Internet Draft has been posted addressing benchmark testing of
Security Effectiveness.

We would like to solicit discussion about the concepts described in this
draft and look forward to your comments, questions and suggestions. 

Regards,

Kenneth

Kenneth Green

Solution Architect

Ixia

---

From: Kenneth Green <[email-masked]>
Date: Thu, 27 Oct 2011 15:33:15 +0000

Good suggestion Jan, thank you. We will certainly need to flesh out the terminology and indeed, publish an associated terminology draft.

An attack is indeed the whole flow/transaction set.

Vulnerability/Malware (more terms we will define) attacks are a flow that triggers a vulnerability, exercises an exploit and performs its evil intent.

A DDoS attack would be a series of flows within a defined period that together can be seen to be attempting to deny service to legitimate users. An example would be a botnet sending thousands of pings from spoofed IP addresses to the target host.

In the case of access to banned sites or application an "attack" is the flow that attempts the access. An example would be an attempt to use Torrent or to play a popular game on Facebook from inside a corporate network.

In the case of Data Leakage Prevention (DLP) an "attack" is an attempt to send banned material out of the protected network. An example would be sending an email with an attachment containing customer details.

Regards,
Kenneth

Kenneth Green
Solution Architect
Ixia

From: Jan Novak (janovak) [mailto:[email-masked]]
Sent: Thursday, 27 October 2011 11:01 PM
To: Kenneth Green; [email-masked]
Subject: RE: [bmwg] draft-green-bmwg-seceff-bench-meth-00

Hi,

Jan

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Kenneth Green
Sent: 25 October 2011 03:53
To: [email-masked]<mailto:[email-masked]>
Subject: [bmwg] draft-green-bmwg-seceff-bench-meth-00

Hi Team,

Regards,
Kenneth

Kenneth Green
Solution Architect
Ixia

---

From: David Newman <[email-masked]>
Date: Thu, 27 Oct 2011 12:16:03 -0700

On 10/27/11 8:33 AM, Kenneth Green wrote:
> Good suggestion Jan, thank you. We will certainly need to flesh out the
> terminology and indeed, publish an associated terminology draft.

RFC 2647 defines "illegal traffic" and "rejected traffic" as,
respectively, anything prohibited by a rule set and anything a rule set
drops.

This isn't anywhere near as detailed as what you're going for here with
separate definitions for DDoS, malware, etc., but it would be a useful
starting point in considering what a DUT/SUT should and should not
forward. Oh, and both definitions already cover the whole
flow/transaction set...

dn

---

From: Kenneth Green <[email-masked]>
Date: Thu, 27 Oct 2011 21:32:07 +0000

Thank you for this very appropriate pointer David,  it is great to be able to be able to benefit from the collective wisdom of this talented group.

I will review and make appropriate reference to RFC2647.

Regards,
Kenneth

Kenneth Green
Solution Architect
Ixia

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of David Newman
Sent: Friday, 28 October 2011 6:16 AM
To: [email-masked]
Subject: Re: [bmwg] draft-green-bmwg-seceff-bench-meth-00

On 10/27/11 8:33 AM, Kenneth Green wrote:
> Good suggestion Jan, thank you. We will certainly need to flesh out 
> the terminology and indeed, publish an associated terminology draft.

RFC 2647 defines "illegal traffic" and "rejected traffic" as, respectively, anything prohibited by a rule set and anything a rule set drops.

This isn't anywhere near as detailed as what you're going for here with separate definitions for DDoS, malware, etc., but it would be a useful starting point in considering what a DUT/SUT should and should not forward. Oh, and both definitions already cover the whole flow/transaction set...

dn

_______________________________________________
bmwg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/bmwg

---

From: Dennis Cox <[email-masked]>
Date: Sat, 29 Oct 2011 12:49:31 +0000

Kenneth,

 I read the draft you provided. Some questions and suggestions since you are soliciting for them.

How will you select the attacks? Will you leverage CVEs? Or is this draft meant to be away of measuring two different flows? The reason I ask is that one companies data leakage is another companies standard traffic. You state that "all of these defensive solutions have in common ... distinguish between evil ... and good traffic". With the list such as anti-virus and anti-spam to data leakage listed, I would have to disagree. Solutions such as these at the eye of the beholder and each users requirements and each technologies inspection is quite different.

One example: Anti-Spam companies use technologies from reputation based (Cisco IronPort) to RBL.

How about evasions? Quite a large number of evasion techniques are used by people how attack networks. Will the draft take into account multiple language evasions? Or fragmentation and reassembly evasions? Will you rate the effectiveness of the device in handling attacks each type of evasion?

In order to test security effectiveness it comparing between "good" traffic and "evil" traffic, I would think that whatever application protocol the "evil" traffic uses the good traffic would need to use as well. That should make section 3.1 easy to determine.

Also, evil may not be the best word, perhaps malicious might be a bit used instead.

Dennis

________________________________
From: [email-masked] [[email-masked]] on behalf of Kenneth Green [[email-masked]]
Sent: Monday, October 24, 2011 9:53 PM
To: [email-masked]
Subject: [bmwg] draft-green-bmwg-seceff-bench-meth-00

Hi Team,

Regards,
Kenneth

Kenneth Green
Solution Architect
Ixia

---

From: Al Morton <[email-masked]>
Date: Sat, 29 Oct 2011 09:53:42 -0400

Guys,

Thanks for engaging on this topic, but...

The messages in this thread are too big;
please use unformatted text and trim to less than 25 KB in size.
I'm sure you don't want to wait for me to approve future posts,
and since I'll be traveling next week, my response time will be
much less than interactive.

regards,
Al
bmwg chair

At 08:49 AM 10/29/2011, Dennis Cox wrote:
>Content-Language: en-US
>Content-Type: multipart/alternative;
> 
>boundary="_000_B41C90D2B5DF4F41A62DC6A462E7E0DC4FA2D3E2EXCHANGEsecurit_"
>
>Kenneth,
>
>...
>Dennis

---

From: Al Morton <[email-masked]>
Date: Sat, 29 Oct 2011 10:02:53 -0400

At 08:49 AM 10/29/2011, Dennis Cox wrote:
>...Also, evil may not be the best word, perhaps malicious might be a 
>bit used instead.

Both terms are used in http://tools.ietf.org/html/rfc3514
Al
(as participant)

---

From: Dennis Cox <[email-masked]>
Date: Sat, 29 Oct 2011 18:44:26 +0000

Al,

 Yes "evil" is used in a previous RFC, however that is a April Fools Day RFC. While it's a great RFC and we have actually implemented it in our product, all in good fun of course, I don't know if its the best term when talking about traffic that may only be slightly evil :)

For your reference
http://www.breakingpointsystems.com/community/blog/rfc3514-setting-the-evil-bit/

Dennis

________________________________________
From: Al Morton [[email-masked]]
Sent: Saturday, October 29, 2011 9:02 AM
To: Dennis Cox; Kenneth Green; [email-masked]
Subject: Re: [bmwg] draft-green-bmwg-seceff-bench-meth-00