Subject: [mile] DDoS Open Threat Signaling BOF

From: "Roman D. Danyliw" <[email-masked]>
Date: Sat, 21 Mar 2015 20:52:15 +0000

Hello!

In case there is interest, I'm cross posting the description of the DDoS Open Threat Signaling (DOTS) that will be occurring on Tuesday at 1520 in the Venetian conference room. Two drafts will frame the discussion:

** draft-teague-open-threat-signaling-00
** draft-fu-ipfix-network-security-00

Both involve information sharing of security threat information and network telemetry.  Please send any feedback you might have to the DOTS list [1].

Roman

[1] https://www.ietf.org/mailman/listinfo/dots

-----Original Message-----
From: Dots [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Saturday, March 21, 2015 4:29 PM
To: [email-masked]'
Subject: [Dots] DOTS Description

Hello!

>From the BOF summary page [1], the DOTS description is as follows:

"There is a need for a standards based approach for on-premise DDoS mitigation devices to communicate threat and telemetry data to service provider based solutions. On-premise DDoS mitigation devices are sophisticated entities which may already identify, profile and mitigate a wide range of attacks. Although flow export, syslog and SNMP are currently used by service providers to identify anomalies, there is no agreed standard allowing for any device to signal to any other device or service provider what the anomaly is and the subsequent threat telemetry data. 

DDoS open threat signaling (DOTS) would enable any on-premise DDoS mitigation device to effectively communicate the current threat landscape, load and response data to a mitigation service provider. The upstream solution would then have a clear view of the threat should the on-premise solution be required to offramp attack traffic to a more capable handler. A vendor agnostic approach would allow any combination of vendor, service provider or community driven efforts to interoperate. DOTS would be extensible and may, in future, be expanded as a method of real time information exchange between other security devices and, potentially across organizations.

Verisign and Juniper have supported this work on standardized DOTS, and this work has resulted in an input specification for this proposed non-working group forming BOF."

Roman

[1] http://tools.ietf.org/bof/trac/

_______________________________________________
Dots mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dots