Subject: [I2nsf] Merging draft-lopez-i2nsf-packet-00 and draft-xia-i2nsf-capability-interface-im-01

From: Joseph Salowey <[email-masked]>
Date: Mon, 8 Jun 2015 12:25:24 -0700

Since these two drafts are really talking about the same thing it would be
good to merge them into.  I think they are reasonably close so I don't see
too many issues, but it would be good to get them both on the same page
with respect to terminology and maybe look into how to handle vendor
specific functionality.

Does this sound reasonable?

Thanks,

Joe

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 8 Jun 2015 19:59:51 +0000

Joe,

Thank you for the good suggestion. One more comment:

Section 1 from draft-lopez-i2nsf-packet provides the good framework of I2NSF work items. It would be beneficial to be merged with draft-merged-i2nsf-framework.

The remaining sections of draft-lopez-i2nsf-packet and the i2nsf-capability-interface-im can be merged.

Linda

From: I2nsf [mailto:[email-masked]] On Behalf Of Joseph Salowey
Sent: Monday, June 08, 2015 2:25 PM
To: [email-masked]
Subject: [I2nsf] Merging draft-lopez-i2nsf-packet-00 and draft-xia-i2nsf-capability-interface-im-01

Since these two drafts are really talking about the same thing it would be good to merge them into.  I think they are reasonably close so I don't see too many issues, but it would be good to get them both on the same page with respect to terminology and maybe look into how to handle vendor specific functionality.

Thanks,

Joe

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 18 Jun 2015 14:19:56 +0000

Hi all,
Sorry for late response.
Actually, we have the same idea. We are doing the update of the capability-interface-im draft to  merge all the related contents, hope to finish it in next week.

Thanks for your good suggestions!

B.R.
Frank

发件人: I2nsf [mailto:[email-masked]] 代表 Linda Dunbar
发送时间: 2015年6月8日 22:00
收件人: Joseph Salowey; [email-masked]
抄送: 'Edward Lopez'
主题: Re: [I2nsf] Merging draft-lopez-i2nsf-packet-00 and draft-xia-i2nsf-capability-interface-im-01

Joe,

Linda

From: I2nsf [mailto:[email-masked]] On Behalf Of Joseph Salowey
Sent: Monday, June 08, 2015 2:25 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [I2nsf] Merging draft-lopez-i2nsf-packet-00 and draft-xia-i2nsf-capability-interface-im-01

Thanks,

Joe

---

From: Linda Dunbar <[email-masked]>
Date: Wed, 24 Jun 2015 15:22:11 +0000

Frank, Ed, and Nicolas,

As described in today’s WallStreetJournal http://www.wsj.com/articles/breached-networks-security-is-criticized-1435103680:

“The security system in place at xxx, is incapable in most cases of stopping previously unknown malware from penetrating government networks. It mostly relies instead on “signatures” from past computer breaches, and then looks for similar digital fingerprints.”

“Stopping hacks from never-before-seen spyware—called “zero-day exploits” , i.e. promptly update the “signatures” as soon as a Malwares is detected, is essential.

Today, different vendors have different ways to apply patches to the “signatures”, which can be a complicated and tedious process for operators to pass the new “signatures” to all the NSFs in the networks.

The “draft-xia-i2nsf-capability-interface-im-01” has a category for “Profile Type” in section 3.2.

| Profile types |   Vendor specific                         |
|               |   Flexible Profile URL                    |
|               |   Accept external                         |
|               |                                           |

I think more detailed description should be added to the draft, to specify the proper identifiers for “signatures”, and the actions to change them.

Linda

Thanks,

Joe

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Fri, 26 Jun 2015 06:20:56 +0000

Hi Linda,
Good point. I also think it’s a key feature for NSF at present. How about I add the following description in draft:
“To deal with the situation of emerging new threats, i.e., zero-day exploits, unknown malwares, APTs, NSF’s advanced actions (aka functions) should have the capability of dynamic update. A NSF should be able to load the new advanced action and/or update the signature used by existing functions when an unknown threat is identified. The new advanced actions and signature can be provided by different security vendors after their research on the new threats and sent and stored in a centralized policy repository or stored separately in their local policy repository. Anyway, a standard interface is needed when the NSF negotiates with the policy repository about the new functions/signatures needed. Additionally, I2NSF capability interface should have the unified information model to configure and apply all these functions/signatures. The details will be added in future version.”

Of course, It’s just a start, we maybe need more contents about this part later. Let’s discuss.

Your comments?

B.R.
Frank

发件人: Linda Dunbar
发送时间: 2015年6月24日 23:22
收件人: Joseph Salowey; [email-masked]; Xialiang (Frank); 'Edward Lopez'; Nicolas BOUTHORS
主题: WSJ article on Breached Network as result of not being able to quickly patch Malware Signature files. I2NSF should specify ways to dynamically update sign

Frank, Ed, and Nicolas,

Linda

Thanks,

Joe

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Fri, 26 Jun 2015 06:28:45 +0000

Hi all,
About the point, we are looking forward to see more comments and inputs to help us improve the related contents.
Thanks!

B.R.
Frank

发件人: Xialiang (Frank)
发送时间: 2015年6月26日 14:21
收件人: Linda Dunbar
抄送: Joseph Salowey; [email-masked]; 'Edward Lopez'; Nicolas BOUTHORS
主题: 答复: WSJ article on Breached Network as result of not being able to quickly patch Malware Signature files. I2NSF should specify ways to dynamically update sign

Hi Linda,

Your comments?

B.R.
Frank

发件人: Linda Dunbar
发送时间: 2015年6月24日 23:22
收件人: Joseph Salowey; [email-masked]<mailto:[email-masked]>; Xialiang (Frank); 'Edward Lopez'; Nicolas BOUTHORS
主题: WSJ article on Breached Network as result of not being able to quickly patch Malware Signature files. I2NSF should specify ways to dynamically update sign

Frank, Ed, and Nicolas,

Linda

Thanks,

Joe

---

From: Linda Dunbar <[email-masked]>
Date: Fri, 26 Jun 2015 15:39:50 -0500

Frank,

Thank you very much for adding the paragraph.

Linda

On Fri, Jun 26, 2015 at 1:20 AM, Xialiang (Frank) <[email-masked]
> wrote:

>  Hi Linda,
>
> Good point. I also think it’s a key feature for NSF at present. How about
> I add the following description in draft:
>
> “*To deal with the situation of emerging new threats, i.e., zero-day
> exploits, unknown malwares, APTs, NSF’s advanced actions (aka functions)
> should have the capability of dynamic update. A NSF should be able to load
> the new advanced action and/or update the signature used by existing
> functions when an unknown threat is identified. The new advanced actions
> and signature can be provided by different security vendors after their
> research on the new threats and sent and stored in a centralized policy
> repository or stored separately in their local policy repository. Anyway, a
> standard interface is needed when the NSF negotiates with the policy
> repository about the new functions/signatures needed. Additionally, I2NSF
> capability interface should have the unified information model to configure
> and apply all these functions/signatures. The details will be added in
> future version.*”
>
>
>
> *发件人:* Linda Dunbar
> *发送时间:* 2015年6月24日 23:22
> *收件人:* Joseph Salowey; [email-masked]; Xialiang (Frank); 'Edward Lopez';
> Nicolas BOUTHORS
> *主题:* WSJ article on Breached Network as result of not being able to
> quickly patch Malware Signature files. I2NSF should specify ways to
> dynamically update sign
>
>
>
> Frank, Ed, and Nicolas,
>
>
>
> As described in today’s WallStreetJournal
> http://www.wsj.com/articles/breached-networks-security-is-criticized-1435103680:
>
>
>
>
> *“The security system in place at xxx, is incapable in most cases of
> stopping previously unknown malware from penetrating government networks.
> It mostly relies instead on “signatures” from past computer breaches, and
> then looks for similar digital fingerprints.”*
>
>
>
> *“Stopping hacks from never-before-seen spyware—called “zero-day exploits”
> *, i.e. promptly update the “signatures” as soon as a Malwares is
> detected, is essential.
>
>
>
> Today, different vendors have different ways to apply patches to the
> “signatures”, which can be a complicated and tedious process for operators
> to pass the new “signatures” to all the NSFs in the networks.
>
>
>
> I think more detailed description should be added to the draft, to specify
> the proper identifiers for “signatures”, and the actions to change them.
>
>
>
> Linda
>
>
>
> *From:* I2nsf [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Joseph Salowey
> *Sent:* Monday, June 08, 2015 2:25 PM
> *To:* [email-masked]
> *Subject:* [I2nsf] Merging draft-lopez-i2nsf-packet-00 and
> draft-xia-i2nsf-capability-interface-im-01
>
>
>
> _______________________________________________
> I2nsf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i2nsf
>
>

---

From: Shaibal Chakrabarty <[email-masked]>
Date: Fri, 26 Jun 2015 17:12:21 -0500

Team: The I2NSF "security gateway's" ability to patch with known digital
signatures at the interface will reduce the propagation delay of rolling
out existing patches, as well as comparison for similar digital
fingerprints. regards, shaibal

On Wed, Jun 24, 2015 at 10:22 AM, Linda Dunbar <[email-masked]>
wrote:

> *From:* I2nsf [mailto:[email-masked]] *On Behalf Of *Joseph
> Salowey