Subject: [I2nsf] SACM vs. I2NSF in the draft-zhang-gap-analysis-03 - security

From: Linda Dunbar <[email-masked]>
Date: Wed, 1 Jul 2015 18:32:19 -0500

One more comment on comparing SACM with I2NSF:

SACM is to collect, verify, and update system security configurations on
end points (such as servers).

Whereas I2NSF is about dynamically setting/retrieving Security rules
to/from NSFs that provide treatment to the packets traversing through

On Wed, Jul 1, 2015 at 5:58 PM, Linda Dunbar <[email-masked]>
wrote:

>  Sue, Robert, DaCheng and  Hosnieh,
>
>
>
> Thank you very much for adding  a lot of good content to the
> draft-zhang-gap-analysis-03. It is really good that you introduced the
> concepts of I2NSF Client, I2NSF Agent, etc.
>
>
>
> A few questions on the terminologies:
>
>  What does I2NSF SPDP represent?
>
>
>
> How about I2NSF SEP?
>
>
>
> One minor comment:
>
>
>
> Since I2NSF latest charter has been reduced to Flow-Based NSF (with
> definition defined in I2NSF Problem Statement), Introduction Section should
> remove examples of “Remote Identity Management” and “Secure Key
> Management”.
>
>
>
> Thanks,
>
>
>
> Linda
>
>
>
>
>
> *From:* I2nsf [mailto:[email-masked]] *On Behalf Of *Susan Hares
> *Sent:* Wednesday, June 10, 2015 1:52 PM
> *To:* [email-masked]
> *Cc:* 'Kathleen Moriarty'
> *Subject:* [I2nsf] draft-zhang-gap-analysis - security
>
>
> Hi all The gap  analysis took time to really look at how the security
> work in the IETF work fits together.   I published this draft, and I‘ve
> received no input on the security area gap analysis.   I’d really like
> feedback.    Sue    =========
>
>    On early focus on ACL policy enforcement on traffic entering a
>
>    network is the 1990s COPS design (PEP and PDP) as shown in figure 1.
>
>    The Policy decision point kept network-wide policy (E.g. ACLs) and
>
>    sent it to Policy enforcements who then would control what data flows
>
>    between the two These decision points controlled flow from PEP to
>
>    PEP.
>
>
>
>
>
>                  PDP
>
>       +-----+    /  \    +-----+
>
>       |PEP1 |--/     \---|PEP2 |
>
>       |     | ACL/policy |     |
>
>       |     |                |     |
>
>     --| ----|------------|-----|-----
>
>       +-----+  data flow +-----+
>
>
>
>               Figure 1
>
>    Today's security devices in 2015 replicate the same concept.The I2NSF
>
>    Security provisioning policy/filter decision point (SPDP) and the
>
>    I2NSF Agent Security Enforcement point (SEP) still look to control
>
>    this flow through secure devices (see figure 2.).
>
>
>
>
>
>                 +---------+
>
>                 | I2NSF   |
>
>                 | SPDP    |
>
>                 |         |
>
>                 +---------+
>
>       +-----+    /  \    +-----+
>
>       | SEP |--/     \---| SEP |
>
>       |     |            |     |
>
>     --| ----|------------|-----|-----
>
>       +-----+  data flow +-----+
>
>
>
>         Figure 2
>
>    The other security protocols work to interact to create the
>
>    additional pieces of security the flows for users as follows (see
>
>
>
>    figure 3):
>
>
>
>    o SACM - examines if policy and reality match.It asks the questions
>
>    "Have proper policies been pushed to the proper place", and "Has any
>
>    policy been compromised?"
>
>
>
>    o MILE - looks at events that go Bump in night in the Security 2015.
>
>    MILE examines when events need to be reported or correlated.A MILE
>
>    configuration is a policy pushed out by the SPDP
>
>
>
>    o DOTS - picks up security the flow for when things go really wrong
>
>    during security attacks.In this case, an SEP needs to be able to
>
>    SCREAM for help, to get other SEP to ease its pain.DOTS policy is
>
>    pushed out via SPDP.
>
>
>
>    o I2NSF may connect to all of these devices to gather information
>
>    about the security policy that is pushes down to I2NSF agent. I2NSF
>
>    provides a common interface between an I2NSF client as a SPDP and the
>
>    NSF security boxes with SEP agents (which may also DOTS agent or Mile
>
>    agent).
>
>
>
>                 +---------+     +------+
>
>       +------+  | I2NSF   |=====| DOTS |
>
>       |SCAM  |  | SPDP    |     |client|----
>
>       |client|==|         |     +------+   |
>
>       +------+  |         |     +------+   |
>
>                 |         |     |MILES |   |
>
>     +------+    |         |     |client|   |
>
>     |SCAM  |    +---------+     +----:-+   |
>
>     |Agent |       / \               :     |
>
>     +------+      /   \              :     |
>
>       +-----+    /     \    +-----+  :     |
>
>       | SEP |--/        \---| SEP |  :     |
>
>       |     |               |     |  :     |
>
>       |     |               |MILES|..:     |
>
>       |     |               |Agent|        |
>
>       |     |               |DOTS |        |
>
>       |     |               |Agent|---------
>
>     --| ----|---------------|-----|-----
>
>       +-----+  data flow    +-----+
>
>
>
>         Figure 3
>
>
>
> _______________________________________________
> I2nsf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i2nsf
>
>