Subject: [I2nsf] Definition for "Network Security Functions"

From: Alexey Gorbunov <[email-masked]>
Date: Mon, 25 May 2015 17:42:13 -0500

Hi All

I agree with Diego definition:
"functions to ensure integrity, confidentiality and availability of network
communications, to detect unwanted activity, and to deter it or at least
mitigate its effects on the network"

>From my point of view that covers all cases of network security function.

Regarding Flow-based network security function:

“ A function that inspects network flows according to a policy intended for
enforcing security properties.  Flow-based security also means that packets
are inspected in the order they are received, and without modification to
the packet due to the inspection process (MAC rewrites, TTL decrement
action; even NAT would be outside the inspection process).

I'm not sure if it's valuable  to inspect packet without modification.
There are cases when it's more preferable to inspect and apply policy after
NAT.  This is common practice and it must be a good reason to change it.

Br, Alexey Gorbunov
Telco Cloud and Security Architect at Nokia
CCIE R&S 41088

---

From: "Natale, Bob" <[email-masked]>
Date: Tue, 26 May 2015 02:55:43 +0000

Given agreement around Diego’s definition, I believe it is sufficient to say “Functions to ensure the confidentiality, integrity, and available of network communications.” (Putting  the CIA in the traditional order.) The second part (“to detect unwanted activity, and to deter it or at least mitigate its effects on the network”) adds nothing that is not already included in the first part but implicitly (by omission) excludes some functions (e.g., preventive functions) that are (normally) included.

By extension, I would also say that the definition per above extends to the resources (devices, applications, services) necessary to support network communications … since a violation of security there has a potential  undesired effect in the network traffic.

So, I might suggest an extension of the definition to “Functions to ensure the confidentiality, integrity, and availability of network communications and the resources used to support network communications.” …?

Avanti,
BobN

From: I2nsf [mailto:[email-masked]] On Behalf Of Alexey Gorbunov
Sent: Monday, May 25, 2015 6:42 PM
To: [email-masked]; Linda Dunbar
Subject: [I2nsf] Definition for "Network Security Functions"

Hi All

I agree with Diego definition:
"functions to ensure integrity, confidentiality and availability of network communications, to detect unwanted activity, and to deter it or at least mitigate its effects on the network"

“ A function that inspects network flows according to a policy intended for enforcing security properties.  Flow-based security also means that packets are inspected in the order they are received, and without modification to the packet due to the inspection process (MAC rewrites, TTL decrement action; even NAT would be outside the inspection process).

I'm not sure if it's valuable  to inspect packet without modification. There are cases when it's more preferable to inspect and apply policy after NAT.  This is common practice and it must be a good reason to change it.

Br, Alexey Gorbunov

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 26 May 2015 08:23:59 +0000

Hi,

I like the definition because it’s concise and seems to cover a lot. I am not sure however what ‘deter’ means in this context. In some case NSFs dully block effects of unwanted activity.

Pending on clarifying what ‘deter’ means I suggest:

"functions to ensure integrity, confidentiality and availability of network communications, to detect unwanted activity, and to block it[, deter it] or at least mitigate its effects on the network"

Regards,

Dan

From: I2nsf [mailto:[email-masked]] On Behalf Of Alexey Gorbunov
Sent: Tuesday, May 26, 2015 1:42 AM
To: [email-masked]; Linda Dunbar
Subject: [I2nsf] Definition for "Network Security Functions"

Hi All

Br, Alexey Gorbunov

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Tue, 26 May 2015 08:35:05 +0000

Hi Dan,

In the New Oxford American Dictionary, the second meaning of "deter" is "preventing the occurrence of", so I think we could keep it. And remembering Bob's comments on pronouns, the definition should look like:

"functions to ensure integrity, confidentiality and availability of network communications, to detect unwanted activity, and to deter this unwanted activity or at least mitigate its effects on the network"

On 26 May 2015, at 10:23 , Romascanu, Dan (Dan) <[email-masked]<mailto:[email-masked]>> wrote:

Hi,

Regards,

Dan

From: I2nsf [mailto:[email-masked]] On Behalf Of Alexey Gorbunov
Sent: Tuesday, May 26, 2015 1:42 AM
To: [email-masked]<mailto:[email-masked]>; Linda Dunbar
Subject: [I2nsf] Definition for "Network Security Functions"

Hi All

Br, Alexey Gorbunov

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 26 May 2015 08:37:05 +0000

I believe that we need to add block. Preventing is good, but when 'unwanted activity' happens you need to limit it's spreading by dully blocking.

Regards,

Dan

From: DIEGO LOPEZ GARCIA [mailto:[email-masked]]
Sent: Tuesday, May 26, 2015 11:35 AM
To: Romascanu, Dan (Dan)
Cc: Alexey Gorbunov; [email-masked]; Linda Dunbar
Subject: Re: [I2nsf] Definition for "Network Security Functions"

Hi Dan,

Hi,

I like the definition because it's concise and seems to cover a lot. I am not sure however what 'deter' means in this context. In some case NSFs dully block effects of unwanted activity.

Pending on clarifying what 'deter' means I suggest:

Regards,

Dan

Hi All

" A function that inspects network flows according to a policy intended for enforcing security properties.  Flow-based security also means that packets are inspected in the order they are received, and without modification to the packet due to the inspection process (MAC rewrites, TTL decrement action; even NAT would be outside the inspection process).

Br, Alexey Gorbunov

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_i2nsf&d=AwMF-g&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=nv54JOWvN8cv_ybrd1qepm4NYCsL7geQN5x51dkPGUk&s=rbYXolFBmOpDJ7Y-uEXuSc2qnozkn7VoPj_p8ejFtL4&e=>

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/<https://urldefense.proofpoint.com/v2/url?u=http-3A__people.tid.es_diego.lopez_&d=AwMF-g&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=nv54JOWvN8cv_ybrd1qepm4NYCsL7geQN5x51dkPGUk&s=UhTX-41OlZCxq7CFsJ0MTC-SYCuhDBeH7jvaQtjaM2k&e=>

e-mail: [email-masked]<mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Tue, 26 May 2015 08:55:38 +0000

So "to deter and block"? Nothing to object from may side...

On 26 May 2015, at 10:37 , Romascanu, Dan (Dan) <[email-masked]<mailto:[email-masked]>> wrote:

I believe that we need to add block. Preventing is good, but when ‘unwanted activity’ happens you need to limit it’s spreading by dully blocking.

Regards,

Dan

From: DIEGO LOPEZ GARCIA [mailto:[email-masked]]
Sent: Tuesday, May 26, 2015 11:35 AM
To: Romascanu, Dan (Dan)
Cc: Alexey Gorbunov; [email-masked]<mailto:[email-masked]>; Linda Dunbar
Subject: Re: [I2nsf] Definition for "Network Security Functions"

Hi Dan,

Hi,

Regards,

Dan

Hi All

Br, Alexey Gorbunov

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 26 May 2015 09:02:27 +0000

wfm

Regards,

Dan

From: DIEGO LOPEZ GARCIA [mailto:[email-masked]]
Sent: Tuesday, May 26, 2015 11:56 AM
To: Romascanu, Dan (Dan)
Cc: Alexey Gorbunov; [email-masked]; Linda Dunbar
Subject: Re: [I2nsf] Definition for "Network Security Functions"

Regards,

Dan

Hi Dan,

Hi,

Regards,

Dan

Hi All

Br, Alexey Gorbunov

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/<https://urldefense.proofpoint.com/v2/url?u=http-3A__people.tid.es_diego.lopez_&d=AwMF-g&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=dp9qZ0xQIzCREQ_0PZzHXCkNPxMX2KZ08KG_IDLFLJ4&s=Qtmj6r0zptAEP6gRfmRzRBoE5QpQ7vTDVHlcTslzp8M&e=>

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Tue, 26 May 2015 09:13:42 +0000

So, for the record, the definition we have now is as follows:

"functions to ensure integrity, confidentiality and availability of network communications, to detect unwanted activity, and to deter and block this unwanted activity or at least mitigate its effects on the network"

Be goode,

On 26 May 2015, at 11:02 , Romascanu, Dan (Dan) <[email-masked]<mailto:[email-masked]>> wrote:

wfm

Regards,

Dan

Regards,

Dan

Hi Dan,

Hi,

Regards,

Dan

Hi All

Br, Alexey Gorbunov

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D

Dr Diego R. Lopez
Telefonica I+D