Subject: [I2nsf] Definitions in draft-merged-i2nsf-problem-statement-use-cases-00

From: Robert Moskowitz <[email-masked]>
Date: Fri, 11 Dec 2015 13:04:08 -0500

I have been working with Sue and Linda on reviewing and cleaning up this 
ID.  I looked at;

Network Security Function (NSF): A function which ensures integrity, 
confidentiality and availability of network communications; detects 
unwanted activity,  blocks or mitigates the effect of such unwanted 
activity on the network.

And I took exception with at least 'ensures'.  This is too strong of a 
statement.  Nothing we do with this technology will 'ensure' CIA. First 
what is 'CIA':

Confidentiality by restricting access to the internal assets.
Integrity by, (well gee, what IS Integrity)?  Integrity by enabling 
users to trust using their assets.
Availablity by blocking attacks that make assets unusable.

So first, do we agree what CIA means and that it is important?  If so, 
we might get something like:

A function that detects unwanted activity and blocks/mitigates the 
effect of such unwanted activity in order to support availability of a 
network.  In addition, the NSF   helps support communication stream 
“integrity and confidentiality”.

Even this is too self-assured.  An NSF detects unwanted activity? 
Really?  It detects what we have so far have classified as unwanted 
activity.  I know that IPS NSF devices are marketed to 'learn' and 
adapt, but without sophisticated AI, even here there are limits. Perhaps 
I am too pedantic, but this document includes 'user expectations', and I 
don't want an expectation of '6 sigmas of detection'.

My sixpence worth.

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Mon, 14 Dec 2015 01:34:45 +0000

Bob, please see inline:

-----邮件原件-----
发件人: I2nsf [mailto:[email-masked]] 代表 Robert Moskowitz
发送时间: 2015年12月12日 2:04
收件人: [email-masked]
主题: [I2nsf] Definitions in draft-merged-i2nsf-problem-statement-use-cases-00

I have been working with Sue and Linda on reviewing and cleaning up this ID.  I looked at;

Network Security Function (NSF): A function which ensures integrity, confidentiality and availability of network communications; detects unwanted activity,  blocks or mitigates the effect of such unwanted activity on the network.

And I took exception with at least 'ensures'.  This is too strong of a statement.  Nothing we do with this technology will 'ensure' CIA. First what is 'CIA':

Confidentiality by restricting access to the internal assets.
Integrity by, (well gee, what IS Integrity)?  Integrity by enabling users to trust using their assets.
Availablity by blocking attacks that make assets unusable.

So first, do we agree what CIA means and that it is important?  If so, we might get something like:

A function that detects unwanted activity and blocks/mitigates the effect of such unwanted activity in order to support availability of a 
network.  In addition, the NSF   helps support communication stream 
“integrity and confidentiality”.
[Frank]: Support to replace the word "ensures", this definition makes sense more.

[Frank]: Maybe some constraints are useful here. For example: "A function that detects unwanted activity (known or possibly some new) ...".

My sixpence worth.

_______________________________________________
I2nsf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i2nsf

---

From: DIEGO LOPEZ GARCIA <[email-masked]>
Date: Tue, 15 Dec 2015 21:48:57 +0000

Hi Bob,

I would support your proposal without the quotes and a “can” before what the NSF can help to achieve. Thus:

A function that detects unwanted activity and blocks/mitigates the effect of such unwanted activity in order to support availability of a network. In addition, the NSF can help in supporting communication stream integrity and confidentiality

I don’t think detecting unwanted activity is too self-assured: unwanted activity is what the user and/or provider of the NSF has defined they do not want. Whatever the activity that matches with this definition is unwanted and the NSF will do whatever they can to stop it.

Be goode,

On 11 Dec 2015, at 13:04 , Robert Moskowitz <[email-masked]<mailto:[email-masked]>> wrote:

A function that detects unwanted activity and blocks/mitigates the effect of such unwanted activity in order to support availability of a network.  In addition, the NSF   helps support communication stream “integrity and confidentiality”.

Even this is too self-assured.  An NSF detects unwanted activity? Really?  It detects what we have so far have classified as unwanted activity.  I know that IPS NSF devices are marketed to 'learn' and adapt, but without sophisticated AI, even here there are limits. Perhaps I am too pedantic, but this document includes 'user expectations', and I don't want an expectation of '6 sigmas of detection'.

My sixpence worth.

_______________________________________________
I2nsf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i2nsf

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição