Subject: Re: [I2nsf] Definition for "Network Security Functions"

From: "Dacheng Zhang" <[email-masked]>
Date: Tue, 26 May 2015 11:01:46 +0800

发件人:  "Natale, Bob" <[email-masked]>
日期:  2015年5月26日 星期二 上午10:55
至:  Alexey Gorbunov <[email-masked]>, Linda Dunbar
<[email-masked]>
抄送:  "[email-masked]" <[email-masked]>
主题:  Re: [I2nsf] Definition for "Network Security Functions"

Given agreement around Diego’s definition, I believe it is sufficient to say
“Functions to ensure the confidentiality, integrity, and available of
network communications.” (Putting  the CIA in the traditional order.) The
second part (“to detect unwanted activity, and to deter it or at least
mitigate its effects on the network”) adds nothing that is not already
included in the first part but implicitly (by omission) excludes some
functions (e.g., preventive functions) that are (normally) included.

Dacheng:// I think CIA cannot really take place of the second part. The CIA
is about ensuring data ‘securely' transported over the network. The second
part is about detecting the improper content in the data or improper
signaling which may affect the normal operators of network systems.

 
By extension, I would also say that the definition per above extends to the
resources (devices, applications, services) necessary to support network
communications … since a violation of security there has a potential
undesired effect in the network traffic.
 
So, I might suggest an extension of the definition to “Functions to ensure
the confidentiality, integrity, and availability of network communications
and the resources used to support network communications.” …?
 
Avanti,
BobN
 
From: I2nsf [mailto:[email-masked]] On Behalf Of Alexey Gorbunov
Sent: Monday, May 25, 2015 6:42 PM
To: [email-masked]; Linda Dunbar
Subject: [I2nsf] Definition for "Network Security Functions"

Hi All

I agree with Diego definition:

"functions to ensure integrity, confidentiality and availability of network
communications, to detect unwanted activity, and to deter it or at least
mitigate its effects on the network"

>From my point of view that covers all cases of network security function.

Regarding Flow-based network security function:

“ A function that inspects network flows according to a policy intended for
enforcing security properties.  Flow-based security also means that packets
are inspected in the order they are received, and without modification to
the packet due to the inspection process (MAC rewrites, TTL decrement
action; even NAT would be outside the inspection process).

I'm not sure if it's valuable  to inspect packet without modification. There
are cases when it's more preferable to inspect and apply policy after NAT.
This is common practice and it must be a good reason to change it.

Br, Alexey Gorbunov

Telco Cloud and Security Architect at Nokia

CCIE R&S 41088

 

_______________________________________________ I2nsf mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/i2nsf

---

From: "Natale, Bob" <[email-masked]>
Date: Tue, 26 May 2015 03:42:54 +0000

Hi Dacheng,

I guess it depends on what sources you rely on for the underlying definitions. I referenced NIST Special Publication 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations. While there are numerous existence proofs in 800-53 to refute your assertion below with respect to detection, I would just point to the definition of AC-4, Information Flow Enforcement, in Appendix F, Security Control Catalog, especially enhancement clauses (3) and (15). As I said, there are many others.

Of course, it could be that 800-53 is not an acceptable source for foundational definitions for I2NSF.

Avanti,
BobN

From: I2nsf [mailto:[email-masked]] On Behalf Of Dacheng Zhang
Sent: Monday, May 25, 2015 11:02 PM
To: Natale, Bob; Alexey Gorbunov; Linda Dunbar
Cc: [email-masked]
Subject: Re: [I2nsf] Definition for "Network Security Functions"

发件人: "Natale, Bob" <[email-masked]<mailto:[email-masked]>>
日期: 2015年5月26日 星期二 上午10:55
至: Alexey Gorbunov <[email-masked]<mailto:[email-masked]>>, Linda Dunbar <[email-masked]<mailto:[email-masked]>>
抄送: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
主题: Re: [I2nsf] Definition for "Network Security Functions"

Given agreement around Diego’s definition, I believe it is sufficient to say “Functions to ensure the confidentiality, integrity, and available of network communications.” (Putting  the CIA in the traditional order.) The second part (“to detect unwanted activity, and to deter it or at least mitigate its effects on the network”) adds nothing that is not already included in the first part but implicitly (by omission) excludes some functions (e.g., preventive functions) that are (normally) included.

Dacheng:// I think CIA cannot really take place of the second part. The CIA is about ensuring data ‘securely' transported over the network. The second part is about detecting the improper content in the data or improper signaling which may affect the normal operators of network systems.

By extension, I would also say that the definition per above extends to the resources (devices, applications, services) necessary to support network communications … since a violation of security there has a potential  undesired effect in the network traffic.

So, I might suggest an extension of the definition to “Functions to ensure the confidentiality, integrity, and availability of network communications and the resources used to support network communications.” …?

Avanti,
BobN

From: I2nsf [mailto:[email-masked]] On Behalf Of Alexey Gorbunov
Sent: Monday, May 25, 2015 6:42 PM
To: [email-masked]<mailto:[email-masked]>; Linda Dunbar
Subject: [I2nsf] Definition for "Network Security Functions"

Hi All

I agree with Diego definition:
"functions to ensure integrity, confidentiality and availability of network communications, to detect unwanted activity, and to deter it or at least mitigate its effects on the network"

“ A function that inspects network flows according to a policy intended for enforcing security properties.  Flow-based security also means that packets are inspected in the order they are received, and without modification to the packet due to the inspection process (MAC rewrites, TTL decrement action; even NAT would be outside the inspection process).

I'm not sure if it's valuable  to inspect packet without modification. There are cases when it's more preferable to inspect and apply policy after NAT.  This is common practice and it must be a good reason to change it.

Br, Alexey Gorbunov

_______________________________________________ I2nsf mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/i2nsf

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Tue, 26 May 2015 08:07:11 +0000

Hi Bob,

Having spent my professional life trying to apply good-ole Friar William's razor, I agree the shorter version you propose would be correct and complete. But according to my experience I think it would be good to leave the second part ask well in order to avoid misunderstandings like the concern expressed by Dacheng.

There is a value in being somehow redundant if it is the price you pay to avoid misconception.

Be goode,

On 26 May 2015, at 05:42 , Natale, Bob <[email-masked]<mailto:[email-masked]>> wrote:

Hi Dacheng,

Avanti,
BobN

Cc: [email-masked]<mailto:[email-masked]>

Dacheng:// I think CIA cannot really take place of the second part. The CIA is about ensuring data‘securely' transported over the network. The second part is about detecting the improper content in the data or improper signaling which may affect the normal operators of network systems.

Avanti,
BobN

Hi All

Br, Alexey Gorbunov

_______________________________________________ I2nsf mailing list [email-masked]<mailto:[email-masked]>https://www.ietf.org/mailman/listinfo/i2nsf
_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: "Natale, Bob" <[email-masked]>
Date: Tue, 26 May 2015 13:01:11 +0000

Agreed.

Avanti,
BobN

From: I2nsf [mailto:[email-masked]] On Behalf Of DIEGO LOPEZ GARCIA
Sent: Tuesday, May 26, 2015 4:07 AM
To: Natale, Bob
Cc: [email-masked]; Alexey Gorbunov; Dacheng Zhang; Linda Dunbar
Subject: Re: [I2nsf] Definition for "Network Security Functions"

Hi Bob,

Be goode,

Hi Dacheng,

Avanti,
BobN

Avanti,
BobN

Hi All

Br, Alexey Gorbunov

Dr Diego R. Lopez
Telefonica I+D

e-mail: [email-masked]<mailto:[email-masked]>
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

---

From: "Dacheng Zhang" <[email-masked]>
Date: Tue, 26 May 2015 22:01:09 +0800

Make a lot of sense. Thanks Bob and Diego for clarifying it.

Cheers

Dacheng

发件人:  "Natale, Bob" <[email-masked]>
日期:  2015年5月26日 星期二 下午9:01
至:  DIEGO LOPEZ GARCIA <[email-masked]>
抄送:  "[email-masked]" <[email-masked]>, Alexey Gorbunov
<[email-masked]>, dacheng de <[email-masked]>,
Linda Dunbar <[email-masked]>
主题:  RE: [I2nsf] Definition for "Network Security Functions"

Agreed.

Avanti,
BobN

Hi Bob, 

Having spent my professional life trying to apply good-ole Friar William's
razor, I agree the shorter version you propose would be correct and
complete. But according to my experience I think it would be good to leave
the second part ask well in order to avoid misunderstandings like the
concern expressed by Dacheng.

There is a value in being somehow redundant if it is the price you pay to
avoid misconception.

Be goode,

On 26 May 2015, at 05:42 , Natale, Bob <[email-masked]> wrote:

> Hi Dacheng,
> 
>  
> 
> I guess it depends on what sources you rely on for the underlying definitions.
> I referenced NIST Special Publication 800-53 Revision 4, Security and Privacy
> Controls for Federal Information Systems and Organizations. While there are
> numerous existence proofs in 800-53 to refute your assertion below with
> respect to detection, I would just point to the definition of AC-4,
> Information Flow Enforcement, in Appendix F, Security Control Catalog,
> especially enhancement clauses (3) and (15). As I said, there are many others.
> 
>  
> 
> From: I2nsf [mailto:[email-masked] <mailto:[email-masked]> ]
> On Behalf Of Dacheng Zhang
> Cc: [email-masked] <mailto:[email-masked]>
> 发件人: "Natale, Bob" <[email-masked] <mailto:[email-masked]> >
> 至: Alexey Gorbunov <[email-masked]
> <mailto:[email-masked]> >, Linda Dunbar <[email-masked]
> <mailto:[email-masked]> >
> 抄送: "[email-masked] <mailto:[email-masked]> " <[email-masked]
> <mailto:[email-masked]> >
> “Functions to ensure the confidentiality, integrity, and available of network
> communications.” (Putting  the CIA in the traditional order.) The second part
> (“to detect unwanted activity, and to deter it or at least mitigate its
> effects on the network”) adds nothing that is not already included in the
> first part but implicitly (by omission) excludes some functions (e.g.,
> preventive functions) that are (normally) included.
> 
>  
> 
> Dacheng:// I think CIA cannot really take place of the second part. The CIA is
> about ensuring data‘securely' transported over the network. The second part is
> about detecting the improper content in the data or improper signaling which
> may affect the normal operators of network systems.
> 
>  
> 
>  
> 
>  
> 
>  
> 
>  
> 
>  
> 
>  
> 
> So, I might suggest an extension of the definition to “Functions to ensure the
> confidentiality, integrity, and availability of network communications and the
> resources used to support network communications.” …?
> 
>  
> 
> Avanti,
> 
> BobN
> 
>  
> 
> From: I2nsf [mailto:[email-masked] <mailto:[email-masked]> ]
> On Behalf Of Alexey Gorbunov
> To: [email-masked] <mailto:[email-masked]> ; Linda Dunbar
> are inspected in the order they are received, and without modification to the
> packet due to the inspection process (MAC rewrites, TTL decrement action; even
> NAT would be outside the inspection process).
> 
>  
> 
> [email-masked] <mailto:[email-masked]>
> <https://www.ietf.org/mailman/listinfo/i2nsf>
> [email-masked] <mailto:[email-masked]>
> <https://www.ietf.org/mailman/listinfo/i2nsf>

Dr Diego R. Lopez
Telefonica I+D

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario,
puede contener información privilegiada o confidencial y es para uso
exclusivo de la persona o entidad de destino. Si no es usted. el
destinatario indicado, queda notificado de que la lectura, utilización,
divulgación y/o copia sin autorización puede estar prohibida en virtud de la
legislación vigente. Si ha recibido este mensaje por error, le rogamos que
nos lo comunique inmediatamente por esta misma vía y proceda a su
destrucción.

The information contained in this transmission is privileged and
confidential information intended only for the use of the individual or
entity named above. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution or
copying of this communication is strictly prohibited. If you have received
this transmission in error, do not read it. Please immediately reply to the
sender that you have received this communication in error and then delete
it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário,
pode conter informação privilegiada ou confidencial e é para uso exclusivo
da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário
indicado, fica notificado de que a leitura, utilização, divulgação e/ou
cópia sem autorização pode estar proibida em virtude da legislação vigente.
Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique
imediatamente por esta mesma via e proceda a sua destruição