Subject: RE: Minutes of the IDWG meetings at the 49th IETF

From: "Osterwald, Paul" <[email-masked]>
Date: Fri, 19 Jan 2001 20:01:45 -0600

Stuart:

I do not see that having a working draft by the next meeting as a problem.
I am in contact with Ben.  Once their semester starts they will have a
better idea (per Ben) as to how quickly one can be finished (already in
progress).

From my notes, the WG was going to proceed and submit then talk to Jeff so
that there was some obvious progress.

Cheers,

> Paul Osterwald
> Sr. Security Engineer
> Intrusion.com
> 3940 Ruffin Road
> Suite C
> San Diego, CA  92123
> (858) 268-1236 x2232 (Work)
> (858) 268-7755 (Fax)
> (619) 865-2775 (Cell)
> http://www.intrusion.com
> mailto:[email-masked]
> 
And if this be the last time I go down to the sea once more, I shall always
remember the men who have sailed and served with me.  It has been my honour
and privilege to be with you this day.

To the sea once more for England.  God save the King.

-- Lord Nelson, First Lord of the Admiralty at Trafalger

-----Original Message-----
From: Stuart Staniford [mailto:[email-masked]]
Sent: Monday, January 15, 2001 4:55 PM
To: [email-masked]
Cc: IDWG list
Subject: Re: Minutes of the IDWG meetings at the 49th IETF

John:

Many thanks for doing the minutes again; another fine, concise job.

"John C. C. White" wrote:

> The question of whether we should use BEEP, and if not why not, was
> raised. The group's consensus was that we should explore BEEP further,
> even though it will delay our moving ahead with IAP. Paul Osterwald,
> John White, and the Aerospace group from Harvey Mudd took on the task of
> examining BEEP prior to the next IWDG meeting.

All please note: given the late stage of our development of IAP, I really
want to see an actual internet draft that describes IDMEF over BEEP in
detail by the next meeting or I'm going to move to kill it and proceed to
last call on IAP.  If there's really energy to do BEEP, and it's the right
decision, then no doubt a document will be forthcoming.  Otherwise this
issue will just further delay our already frustratingly late delivery of
documents (and I want to get on with my life).

> Kevin Green spoke regarding the Vulnerability Detection Message. It has
> goals similar to those of the IDMEF, so the addition of the VDMEF is
> proposed as an alternative to establishing an independent WG. The VDMEF
> would require a new class of messages, but its elements would be very
> like the IDMEF's. Their goals are to prepare a requirements document, a
> model, and a DTD. It was noted that joining forces would appear to
> require some modification of the IDWG charter. The group consensus was
> that this should be pursued. It was observed that some restructure of
> the DTD would be appropriate; what about the data model? Also it was
> noted that the absence of a vulnerability is interesting, while the
> absence of an intrusion is generally not.
> 
> Action: Stuart and Mike talk to Jeff Schiller (IESG Security Area
> Director) about this.

I can't remember the details of the discussion on this.  Was the intent
that we talk to Jeff *prior* to the WG submitting our design docs?  Can
someone refresh my memory?

> Action: Dave Curry look at the IDMEF DTD to see how this might be
> handled.
> 
> Action: Kevin will start work independently of the IDWG for now.

I really want to encourage Kevin to do this.

Stuart.

-- 
Stuart Staniford  ---  President  ---  Silicon Defense
[email-masked]  http://www.silicondefense.com/
(707) 445-4355                     (707) 445-4222 (FAX)