Subject: [sacm] FW: [I2nsf] SACM vs. I2NSF in the draft-zhang-gap-analysis-03 - security

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 2 Jul 2015 07:21:19 +0000

From: I2nsf [mailto:[email-masked]] On Behalf Of Linda Dunbar
Sent: Thursday, July 02, 2015 2:32 AM
To: Linda Dunbar
Cc: [email-masked]; Kathleen Moriarty; Susan Hares
Subject: [I2nsf] SACM vs. I2NSF in the draft-zhang-gap-analysis-03 - security

One more comment on comparing SACM with I2NSF:

SACM is to collect, verify, and update system security configurations on end points (such as servers).

Whereas I2NSF is about dynamically setting/retrieving Security rules to/from NSFs that provide treatment to the packets traversing through

On Wed, Jul 1, 2015 at 5:58 PM, Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:
Sue, Robert, DaCheng and  Hosnieh,

Thank you very much for adding  a lot of good content to the draft-zhang-gap-analysis-03. It is really good that you introduced the concepts of I2NSF Client, I2NSF Agent, etc.

A few questions on the terminologies:
What does I2NSF SPDP represent?

How about I2NSF SEP?

One minor comment:

Since I2NSF latest charter has been reduced to Flow-Based NSF (with definition defined in I2NSF Problem Statement), Introduction Section should remove examples of “Remote Identity Management” and “Secure Key Management”.

Thanks,

Linda

From: I2nsf [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Susan Hares
Sent: Wednesday, June 10, 2015 1:52 PM
To: [email-masked]<mailto:[email-masked]>
Cc: 'Kathleen Moriarty'
Subject: [I2nsf] draft-zhang-gap-analysis - security

Hi all
The gap  analysis took time to really look at how the security work in the IETF work fits together.   I published this draft, and I‘ve received no input on the security area gap analysis.   I’d really like feedback.

Sue

=========

   On early focus on ACL policy enforcement on traffic entering a

   network is the 1990s COPS design (PEP and PDP) as shown in figure 1.

   The Policy decision point kept network-wide policy (E.g. ACLs) and

   sent it to Policy enforcements who then would control what data flows

   between the two These decision points controlled flow from PEP to

   PEP.

                 PDP

      +-----+    /  \    +-----+

      |PEP1 |--/     \---|PEP2 |

      |     | ACL/policy |     |

      |     |                |     |

    --| ----|------------|-----|-----

      +-----+  data flow +-----+

              Figure 1

   Today's security devices in 2015 replicate the same concept.The I2NSF

   Security provisioning policy/filter decision point (SPDP) and the

   I2NSF Agent Security Enforcement point (SEP) still look to control

   this flow through secure devices (see figure 2.).

                +---------+

                | I2NSF   |

                | SPDP    |

                |         |

                +---------+

      +-----+    /  \    +-----+

      | SEP |--/     \---| SEP |

      |     |            |     |

    --| ----|------------|-----|-----

      +-----+  data flow +-----+

        Figure 2

   The other security protocols work to interact to create the

   additional pieces of security the flows for users as follows (see

   figure 3):

   o SACM - examines if policy and reality match.It asks the questions

   "Have proper policies been pushed to the proper place", and "Has any

   policy been compromised?"

   o MILE - looks at events that go Bump in night in the Security 2015.

   MILE examines when events need to be reported or correlated.A MILE

   configuration is a policy pushed out by the SPDP

   o DOTS - picks up security the flow for when things go really wrong

   during security attacks.In this case, an SEP needs to be able to

   SCREAM for help, to get other SEP to ease its pain.DOTS policy is

   pushed out via SPDP.

   o I2NSF may connect to all of these devices to gather information

   about the security policy that is pushes down to I2NSF agent. I2NSF

   provides a common interface between an I2NSF client as a SPDP and the

   NSF security boxes with SEP agents (which may also DOTS agent or Mile

   agent).

                +---------+     +------+

      +------+  | I2NSF   |=====| DOTS |

      |SCAM  |  | SPDP    |     |client|----

      |client|==|         |     +------+   |

      +------+  |         |     +------+   |

                |         |     |MILES |   |

    +------+    |         |     |client|   |

    |SCAM  |    +---------+     +----:-+   |

    |Agent |       / \               :     |

    +------+      /   \              :     |

      +-----+    /     \    +-----+  :     |

      | SEP |--/        \---| SEP |  :     |

      |     |               |     |  :     |

      |     |               |MILES|..:     |

      |     |               |Agent|        |

      |     |               |DOTS |        |

      |     |               |Agent|---------

    --| ----|---------------|-----|-----

      +-----+  data flow    +-----+

        Figure 3

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_i2nsf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=krtkS29dCJ943V8reMfC7Px8S7kq9eoCpFiHibo0DbE&s=ZE_abBRxEQihUr3eOQ1zaDoAnAVK7mcjexgLi12ZB_A&e=>