Subject: RE: [Nea] Device compromise and NEA?

From: "Joseph Tardo" <[email-masked]>
Date: Thu, 18 May 2006 01:02:41 -0700

Vidya,

I personally believe NEA is purely a proactive play, that is, it strives
to remediate the truthful but vulnerable endpoint before that endpoint
becomes infected. It does this by not admitting the vulnerable or
questionable endpoint onto the network until it is brought into
compliance, thus keeping malware from infecting that client.

NEA is not necessarily effective as a reactive mechanism. It provides no
guarantee that it will detect an already infected endpoint, since that
endpoint cannot be trusted not to lie. In such a case, NEA might not
prevent an infected and out of compliance endpoint from being admitted
onto the network. Such an event would have limited consequence anyway if
you have deployed NEA everywhere, or so it is said, since there will be
very few available victims around.

Thus you can only be sure that if an endpoint is in compliance then it
will be admitted, and if an endpoint is not admitted then it is not in
compliance, but not vice-versa. That is, these are not if-an-only-if. If
an endpoint is admitted if might or might not be in compliance, and if
it is out of compliance it might or might not be admitted.

It would thus be highly unadvisable to rely on NEA alone for preventing
malware from entering the network. Other reactive measures should be
used as well.

Of course, all this applies to today's software-only implementations on
available OS. With hardware or other isolation in place, things would be
quite different 

Thanks,
--Joe

-----Original Message-----
From: Narayanan, Vidya [mailto:[email-masked]] 
Sent: Wednesday, May 17, 2006 9:42 PM
To: [email-masked]
Subject: [Nea] Device compromise and NEA?

All,
I have a fundamental question regarding the NEA work. If a device is
compromised, how can there be any trust in the posture attributes that
it may be reporting? 

Vidya

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: Lakshminath Dondeti <[email-masked]>
Date: Thu, 18 May 2006 01:44:46 -0700

Hi,

I am naive here, so, please bear with me:

>compliance, thus keeping malware from infecting that client.

Pardon the analogy, but this sounds like that old airport security 
question "did you pack your bags?"  It was not effective there and so 
why would it be in an IETF protocol?

>very few available victims around.

Big assumption!  But, I don't think it matters.  An adversary can 
still introduce a non-compliant device (as you note above) into the 
network, which of course can go on to infect compliant devices and 
make them non-compliant but undetectable (or admittable into the network).

I guess the natural course from there on is that the attack is 
detected and the network (or in some cases, humans) may have to force 
*all* devices to install a fix, and change the parameters for NEA 
reporting.  And the cycle would continue.  Is this the expected mode 
of operation?  Since all devices need to install the fix and in some 
cases, humans may have to be involved, what's NEA buying us?  I am 
sure I am missing something here, so looking for a clue.  Thanks.

>malware from entering the network. Other reactive measures should be

Some details on the "other reactive measures" would be educative to me.

>available OS. With hardware or other isolation in place, things would be

I have been told this about h/w before, and was at some point willing 
to believe it at face value, but need some education here as 
well.  Perhaps you might point me to a document that explains 
how.  Thanks in advance.

best regards,
Lakshminath

---

From: Frank Yeh Jr <[email-masked]>
Date: Thu, 18 May 2006 11:36:06 -0700

Greetings,

      In and of itself, I would agree that NEA is not a good reactive
mechanism. However, other developments in the area of trusted computing
would allow NEA to leverage a trusted computing model to ensure that
endpoints CAN be trusted not to lie. IMHO, NEA can support the deployment
of trusted computing solutions. I question whether this dynamic needs to
bespecifically accomodated by the NEA work or if we can just leave things
transparent to each other.

Regards,
Frank Yeh
Corporate Security Strategy Team
IBM
Tivoli Software

             "Joseph Tardo"                                                
             <joseph.tardo@nev                                             
             isnetworks.com>                                            To 
                                       "Narayanan, Vidya"                  
             05/18/2006 01:02          <[email-masked]>,              
             AM                        <[email-masked]>                      
                                                                        cc 
                                                                           
                                                                   Subject 
                                       RE: [Nea] Device compromise and     
                                       NEA?                                

                                                                           

Vidya,

Thanks,
--Joe

-----Original Message-----
From: Narayanan, Vidya [mailto:[email-masked]]
Sent: Wednesday, May 17, 2006 9:42 PM
To: [email-masked]
Subject: [Nea] Device compromise and NEA?

All,

Vidya