Subject: [mile] Review and contribution requested: draft-boesch-idxp-idpef-01 (Bjoern-C. Boesch)

From: "B.-C. Boesch" <[email-masked]>
Date: Sun, 6 Sep 2015 12:57:09 +0200

Dear community,

I have post the attached draft and looking for feedback from people with 
security management and / or security (IDS) operations expertise 
(including IDS developer). I am particularly interested in your opinions 
on the communication proceedings, the parametrization methodology and 
the provided attributes (and such I did not think of). If the text needs 
updating by your point of view, please let me know that as well. Here is 
the link to the new draft:

http://www.ietf.org/id/draft-boesch-idxp-idpef-01.txt

At the first view the draft looks very long but after page 44 a lot of 
examples and definitions are included for better understanding. So the 
first 43 pages are primary in scope for feedback but feedback for the 
other pages is welcome, too.

Abstract

The Intrusion Detection Parametrization Exchange Format (IDPEF) defines 
data formats and exchange procedures to standardize parametrization 
information exchange into intrusion detection and response systems from 
an independent central Manager to any Analyzer. The IDPEF enables a 
combination of different (vendor and analyzing technique) IDS Analyzers 
under one independent central Manager. A separate operations of IDS is 
not longer needed. Base is a new parametrization methodology where IDS 
operating parameters (configurations) are separated in an environmental 
parametrization part and a vendor-specific analyzing part.

This Internet-Draft describes a data model to represent parametrization 
information of intrusion detection system entities, and explains the 
rationale for using this model. An implementation of the data model in 
the Extensible Markup Language (XML) is presented, a XML Document Type 
Definition is developed, and parametrization examples are provided.

I am looking forward to your suggestions, feedback, notations, hints, 
recommendations, etc. to improve the Internet Draft. Also native speaker 
feedback with scope on wording and typo is welcome.

Kind regards,

Bjoern-C.

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Thu, 10 Sep 2015 02:26:54 +0000

Hi Bjoern-C,

I think this draft would require a significant amount of effort and I am not sure if it aligns with MILE’s charter.  Also one more concern I have is that the fact that IDMEF and IDXP have been out for so long without getting too much vendor implementations, so why would the industry find the parametrized version useful? Additionally, I believe that vendor differences cannot be covered. There are so much different features and differences in vendor products that it would be impractical to try to incorporate them in one protocol.

I think that unless there are compelling arguments I didn’t consider, this draft should not be a WG item.

Panos

From: mile [mailto:[email-masked]] On Behalf Of B.-C. Boesch
Sent: Sunday, September 06, 2015 6:57 AM
To: [email-masked]
Subject: [mile] Review and contribution requested: draft-boesch-idxp-idpef-01 (Bjoern-C. Boesch)

Dear community,

I have post the attached draft and looking for feedback from people with security management and / or security (IDS) operations expertise (including IDS developer). I am particularly interested in your opinions on the communication proceedings, the parametrization methodology and the provided attributes (and such I did not think of). If the text needs updating by your point of view, please let me know that as well. Here is the link to the new draft:

At the first view the draft looks very long but after page 44 a lot of examples and definitions are included for better understanding. So the first 43 pages are primary in scope for feedback but feedback for the other pages is welcome, too.

Abstract

The Intrusion Detection Parametrization Exchange Format (IDPEF) defines data formats and exchange procedures to standardize parametrization information exchange into intrusion detection and response systems from an independent central Manager to any Analyzer. The IDPEF enables a combination of different (vendor and analyzing technique) IDS Analyzers under one independent central Manager. A separate operations of IDS is not longer needed. Base is a new parametrization methodology where IDS operating parameters (configurations) are separated in an environmental parametrization part and a vendor-specific analyzing part.

This Internet-Draft describes a data model to represent parametrization information of intrusion detection system entities, and explains the rationale for using this model. An implementation of the data model in the Extensible Markup Language (XML) is presented, a XML Document Type Definition is developed, and parametrization examples are provided.

I am looking forward to your suggestions, feedback, notations, hints, recommendations, etc. to improve the Internet Draft. Also native speaker feedback with scope on wording and typo is welcome.

Kind regards,

Bjoern-C.

---

From: "B.-C. Boesch" <[email-masked]>
Date: Thu, 10 Sep 2015 12:46:45 +0200

Hi Panos,

thanks for your quick and open minded feedback. Maybe it is not part of 
your WG agenda but the participants of the WG mailing list could provide 
a valuable feedback for me to improve the Internet Draft.

IDMEF and IDXP are out without getting too much IDS vendor 
implementations but there is a wide usability on site of the SIEM 
vendors. By my point of view the lack of implementations are due to the 
fact, that the IDS Manager entity is still vendor-specific and defines 
the border of the IDS. So IDS of different vendors work still in 
independent coexistence limited by the IDS Manager. With IMPEF this 
limiting factor will be eliminated.

As result, the vendors could focus their development streams on IDS 
management or IDS analyzing. Currently many vendors neglect the 
development of the management interface and provide command line 
interfaces for parametrization and management. The IDS management 
development stream will be focused improve the usability, reporting and 
integration in the common (existing and independent) management systems 
landscapes. The development stream for analyzing will be improving the 
attack identification and prevention. So IDPEF is the missing stone to 
get more implementations of IDXP and IDMEF and improve cooperation and 
interaction of different IDS vendors. This first step is a huge 
evolution and will be set up a new methodology. Cloud and Telco provider 
will be appreciate this modularity. So a broader implementation will be 
coming up.

Kind regards

Bjoern-C.

Am 10.09.2015 um 04:26 schrieb Panos Kampanakis (pkampana):
>
> Hi Bjoern-C,
>
> I think this draft would require a significant amount of effort and I 
> am not sure if it aligns with MILE’s charter.  Also one more concern I 
> have is that the fact that IDMEF and IDXP have been out for so long 
> without getting too much vendor implementations, so why would the 
> industry find the parametrized version useful? Additionally, I believe 
> that vendor differences cannot be covered. There are so much different 
> features and differences in vendor products that it would be 
> impractical to try to incorporate them in one protocol.
>
> *From:*mile [mailto:[email-masked]] *On Behalf Of *B.-C. Boesch
> *Sent:* Sunday, September 06, 2015 6:57 AM
> *To:* [email-masked]
> *Subject:* [mile] Review and contribution requested: 
> draft-boesch-idxp-idpef-01 (Bjoern-C. Boesch)
>
> Dear community,
>
> I have post the attached draft and looking for feedback from people 
> with security management and / or security (IDS) operations expertise 
> (including IDS developer). I am particularly interested in your 
> opinions on the communication proceedings, the parametrization 
> methodology and the provided attributes (and such I did not think of). 
> If the text needs updating by your point of view, please let me know 
> that as well. Here is the link to the new draft:
>
> The Intrusion Detection Parametrization Exchange Format (IDPEF) 
> defines data formats and exchange procedures to standardize 
> parametrization information exchange into intrusion detection and 
> response systems from an independent central Manager to any Analyzer. 
> The IDPEF enables a combination of different (vendor and analyzing 
> technique) IDS Analyzers under one independent central Manager. A 
> separate operations of IDS is not longer needed. Base is a new 
> parametrization methodology where IDS operating parameters 
> (configurations) are separated in an environmental parametrization 
> part and a vendor-specific analyzing part.
>
> This Internet-Draft describes a data model to represent 
> parametrization information of intrusion detection system entities, 
> and explains the rationale for using this model. An implementation of 
> the data model in the Extensible Markup Language (XML) is presented, a 
> XML Document Type Definition is developed, and parametrization 
> examples are provided.
>
> recommendations, etc. to improve the Internet Draft. Also native 
> speaker feedback with scope on wording and typo is welcome.
>
> Kind regards,
>
> Bjoern-C.
>