Subject: [I2nsf] A different perspective on I2NSF

From: Edward Lopez <[email-masked]>
Date: Thu, 5 Feb 2015 15:52:35 +0000

Folks,

First, I will admit that I’ve been exceedingly busy on internal projects, but I’ve been trying to keep up with the various threads on the discussion of elements for the I2NSF WG charter.

From my perspective, I am very concerned with statements which tend to classify distinct security functions (FW, IPS, etc), and therefore would result in limiting the effectiveness of the WGs efforts with narrow (and to be blunt … wrong) views of what network security functions actually are.  It’s not as if attackers are limited by a set of of attack and vulnerability standards on how to maliciously parse packets, so a scope that limits the available network security functions to a few buzzwords and stereotypes isn’t very useful.

For example, the term intrusion prevention system (IPS) is often used, but I would challenge the WG to provide an inclusive definition of one.  Signature-based vs. heuristic IPS?  Is application control, a term bandied about by next-generation firewall (NGFW, a marketing term rather than a concise definition of features) really just an IPS that detects application types rather than vulnerabilities?  Can web filtering or anti-malware detection via flow inspection using signatures be a form of IPS?

Instead, I feel we should be taking the approach that focuses on the integration of NSFs into network architectures, rather than attempt to define the NSFs themselves.  An NSF is in essence a physical or virtual black-box that has definable networking characteristics relative to the traffic it processes, and management characteristics as to how it is functions are configured, as well as information on its functions it can provide back to administrators.  Our focus should more focus on how in integrate NSFs into networks (including service function chaining), rather than trying to strictly define NSFs or limit our efforts to a small subset of what we think they are.

The reality is that as the characteristics of IP networking change over time, how we respond to security concerns will equally change.  For example, the evolving Internet-of-things is an interesting security concept.  Perhaps my hot tub will be Internet-connected, so that I can control it remotely or watch video streams while I’m in it.  But I don’t want my hot tub joining a botnet.  The reality of the IoT is that we’re talking about putting IP stacks on devices with very specific functionality, and we are therefore concerned if traffic to/from a given endpoint matches is congruent with that endpoints intended functionality.  My WiFi-enabled lighting should be limited to lighting applications, and shouldn’t become a rogue wireless sniffer.

As a security technologist, I’m known to have three general statements:

-	Security is not a requirement for the creation of productivity, which is why so many otherwise productive solutions are fundamentally vulnerable to attack
-	Effective network-based security is transparent to the network it is implemented upon.  Security solutions must not convert into networking problems
-	Nobody wants the complexity of challenging new technology, but everybody wants the simplicity of stuff that works

 Our efforts should be less focused on what NSFs are, and more focused on their transparent implementation within networks.  I hope to have a more detailed I-D on this topic published in time for review in Dallas in March.

Regards,
Ed Lopez

***  Please note that this message and any attachments may contain confidential 
and proprietary material and information and are intended only for the use of 
the intended recipient(s). If you are not the intended recipient, you are hereby 
notified that any review, use, disclosure, dissemination, distribution or copying 
of this message and any attachments is strictly prohibited. If you have received 
this email in error, please immediately notify the sender and destroy this e-mail 
and any attachments and all copies, whether electronic or printed.
Please also note that any views, opinions, conclusions or commitments expressed 
in this message are those of the individual sender and do not necessarily reflect 
the views of Fortinet, Inc., its affiliates, and emails are not binding on 
Fortinet and only a writing manually signed by Fortinet's General Counsel can be 
a binding commitment of Fortinet to Fortinet's customers or partners. Thank you. ***

---

From: Linda Dunbar <[email-masked]>
Date: Thu, 5 Feb 2015 17:38:42 +0000

Ed, 

Thank you very much for the perspective! 

Are you suggesting that I2NSF should focus more on Security Service to network (like what Russ White suggested), and less about which device executed the policies? So it is the Service Layer of I2NSF charter:

-	Security Policy Layer, which is for clients to express & monitor the needed security policies for their specific flows. 

For the example you gave about IoT, is it along the line of having an interface for IoT Service controller to dynamically inform network to Open/Close a security pinhole (or other security service) with specific characteristics (Src/Dst/Port/length/Label/...)? The IoT Service controller doesn't really care which device executed the desired security service?

Looking forward to your detailed contribution at Dallas IETF. 

Linda  

-----Original Message-----
From: I2nsf [mailto:[email-masked]] On Behalf Of Edward Lopez
Sent: Thursday, February 05, 2015 9:53 AM
To: [email-masked]
Subject: [I2nsf] A different perspective on I2NSF

Folks,

Regards,
Ed Lopez

***  Please note that this message and any attachments may contain confidential and proprietary material and information and are intended only for the use of the intended recipient(s). If you are not the intended recipient, you are hereby notified that any review, use, disclosure, dissemination, distribution or copying of this message and any attachments is strictly prohibited. If you have received this email in error, please immediately notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.
Please also note that any views, opinions, conclusions or commitments expressed in this message are those of the individual sender and do not necessarily reflect the views of Fortinet, Inc., its affiliates, and emails are not binding on Fortinet and only a writing manually signed by Fortinet's General Counsel can be a binding commitment of Fortinet to Fortinet's customers or partners. Thank you. *** _______________________________________________
I2nsf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i2nsf