Subject: Re: [Nea] IETF67 NEA WG Meeting summary

From: Keith Moore <[email-masked]>
Date: Tue, 14 Nov 2006 09:32:48 -0500

> Couldn't the solution be as simple as allowing the client nodes the option
> of deciding what information they are prepared to make available and the
> network then using what is available to decide how they should be treated?

I really don't think so.  The problem is with giving the network a way 
to interrogate the host in detail.

> If not enough information is provided the node can be shunted off for some
> form of remediation, if the network deems it has enough information then the
> node can be allowed in.
> 
> Both parties have choices then, what information to provide and what is
> required to be accepted.  

say you want to attend a conference, like IETF.  but before we let you 
in the building where the conference is held we want to make sure you're 
okay.  so we're going to lock you in a room with an interrogator and 
he's going to ask you an arbitrary number of arbitrary questions - maybe 
about your sex life, drug use, whatever.  you're free to refuse to 
answer any question, but your failure to answer might determine whether 
we let you in or shunt you off for some form of remediation.  after all, 
you have nothing to hide, right?

while we're at it, maybe we should examine your laptop too.  maybe you 
have kiddie porn on there somewhere, maybe you have illegal mp3 files 
(despite the fact that we can't tell whether or not you have a license 
for such files - we'll decide for ourselves whether they're illegal or 
not).  maybe you have open source software.  that's bad enough - you 
never know what those guys will put in there.  maybe you have p2p file 
sharing software - you must be a pirate!  maybe you've even written some 
software of your own.  we certainly don't want to trust that.

I'm not joking.  there are people who would use this mechanism to do all 
kinds of invasive searches.  there are people in the us congress who 
would see nothing wrong with having networks search computers for 
"illegal" or "subversive" content if the mechanisms to do so were 
already in place.  it's simply not acceptable to standardize a mechanism 
that can be used to do invasive searches of a computer.

Keith

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 14 Nov 2006 10:57:15 -0500

> that can be used to do invasive searches of a computer.

  To re-phrase that, NEA can permit such searches only with the
consent of the end host.  And the party assessing posture has to prove
its identity to the end host, before the end host even admits it knows
about NEA.

  And all of that has to happen before the end host gains full network
access.  Remediation can be done later, but the initial assessment of
identities and consent has to be done before the end host is allowed
on the network, and before the end host accepts a connection to an
unknown network.

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog

---

From: Keith Moore <[email-masked]>
Date: Tue, 14 Nov 2006 11:12:29 -0500

> consent of the end host. 

that's not equivalent to what I was saying, and I'd have reservations 
about stretching things that far.

I'm very concerned about user privacy, and I don't accept as an axiom 
that the host can consent to searches that impact the user.

Keith

---

From: "Nelson, David" <[email-masked]>
Date: Tue, 14 Nov 2006 11:18:41 -0500

Keith Moore writes ...

But you just now suggested as a requirement:

> 1. NEA MUST NOT expose information about a host to any party 
> other than the owner of that host. (and a host has at most one owner)

Are we conflating owner and user?

I agree that it is the owner that should be making the decision to
provide information.  In the enterprise environment the owner is almost
always the IT department and the user is an individual employee.

Are you suggesting that, in an enterprise environment, the owner (IT) or
the user (employee) should be setting the information export policy for
the host?

---

From: Keith Moore <[email-masked]>
Date: Tue, 14 Nov 2006 11:27:39 -0500

>> other than the owner of that host. (and a host has at most one owner)

note that I didn't suggest a requirement that NEA MUST give whatever 
information the owner asks for.

> Are we conflating owner and user?

I'm trying not to do so.

> always the IT department and the user is an individual employee.

I don't agree with this a priori.  I think it might be useful to treat 
the owner and user as separate for the purpose of requirements 
discussion.  And I think we should avoid making assumptions like "the 
owner is the IT department" or "the user is an employee of the owner", 
or for that matter "a host has only one user".  Even in enterprise 
environments I can find exceptions to all of these.

Keith

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 14 Nov 2006 13:33:18 -0500

> >   To re-phrase that, NEA can permit such searches only with the
...
> that the host can consent to searches that impact the user.

  To be pedantic, the user doesn't consent to anything.  The user
naively belives that the information the host presents to him is
accurate, and the the host is doing something related to what he
instructs it to do.

  Users don't take actions on networks.  Computers do.

  The end host decides if the user has consented to something, usually
by asking for input.  Other hosts on the network don't see users, they
see hosts.  For all practical network-related purposes, hosts consent
to actions, users don't.

  It is still good to talk about users, of course, but only in so far
as their relationship with the end host.  Do they trust it?  Do they
own it?  Do they control it?

  Alan DeKok.

---

From: Keith Moore <[email-masked]>
Date: Tue, 14 Nov 2006 14:06:00 -0500

> accurate, and the the host is doing something related to what he

you are overgeneralizing.

>   Users don't take actions on networks.  Computers do.

incorrect.  users interact with networks in many different ways,
including deciding whether to connect to them, which network services
to buy, when to complain, etc.

> see hosts.  For all practical network-related purposes, hosts consent

for the purposes of this discussion, we could decide that a requirement
of the NEA protocol is for an implementation to require user consent
before releasing certain information.  and later on we could design an
NEA protocol that imposed this requirement on implementations as a
condition of conformance to the protocol specification.  we have no
mechanism to force implementations to do this, but implementations that
didn't do this would not conform - and vendors who claimed conformance
would be lying.  customers and users could
take action against such vendors for misleading them, especially if they
could show that harm was done as a result.

> as their relationship with the end host.  

false.  users can and do interact with other hosts besides the end
host.  even if the end host is an intermediary, it is not necessarily
able to consent on a user's behalf.  (ever hear of OTPs or secureID?)

Keith

---

From: "Darryl \(Dassa\) Lynch" <[email-masked]>
Date: Wed, 15 Nov 2006 07:55:45 +1100

Keith Moore wrote:
>>> Couldn't the solution be as simple as allowing the client nodes the
>>> option of deciding what information they are prepared to make
>>> available and the network then using what is available to
>> decide how they should be treated?
>> 
>> I really don't think so.  The problem is with giving the
>> network a way to interrogate the host in detail.
>> 
>>> If not enough information is provided the node can be shunted off
>>> for some form of remediation, if the network deems it has enough
>>> information then the node can be allowed in.
>>> 
>>> Both parties have choices then, what information to provide and what
>>> is required to be accepted.
>> 
>> say you want to attend a conference, like IETF.  but before
>> we let you in the building where the conference is held we
>> want to make sure you're okay.  so we're going to lock you
>> in a room with an interrogator and he's going to ask you an
>> arbitrary number of arbitrary questions - maybe about your
>> sex life, drug use, whatever.  you're free to refuse to
>> answer any question, but your failure to answer might
>> determine whether we let you in or shunt you off for some
>> form of remediation.  after all, you have nothing to hide, right?

I often avoid situations where I may be requested to provide information I'm
not willing to provide.  There is nothing new in that.  Providing I have the
choice to provide the information or not it isn't a problem for me.
Consumers have enough market force to ensure organisations will not request
more than what may be reasonable.  It is considered reasonable to put people
through security before they can fly out of the country or even often,
within a country.  The amount of security the public is willing to put up
with is still being worked out, personally I find it intrusive but am
willing to go along as it is for the public good.

>> while we're at it, maybe we should examine your laptop too.
>> maybe you have kiddie porn on there somewhere, maybe you
>> have illegal mp3 files (despite the fact that we can't tell
>> whether or not you have a license for such files - we'll
>> decide for ourselves whether they're illegal or not).  maybe
>> you have open source software.  that's bad enough - you
>> never know what those guys will put in there.  maybe you
>> have p2p file sharing software - you must be a pirate!
>> maybe you've even written some software of your own.  we
>> certainly don't want to trust that.
>> 
>> I'm not joking.  there are people who would use this
>> mechanism to do all kinds of invasive searches.  there are
>> people in the us congress who would see nothing wrong with
>> having networks search computers for "illegal" or
>> "subversive" content if the mechanisms to do so were already
>> in place.  it's simply not acceptable to standardize a
>> mechanism that can be used to do invasive searches of a computer.

There are already mechanisms that will do such searches and they are being
used, at a higher level than NEA.  NEA should provide a suitable mix of
attributes so that higher level scanning will be minimal and less intrusive.
If I know a system connecting to my network is patched up and has it's own
reasonable protection measures in place I'm less likely to be concerned
about it and doing more intrusive investigations to ensure there isn't any
risk associated with it.  I'm more inclined to allow it out of a DMZ.  At
present I can only do this manually or after the system has been allowed
into the network unless I enforce even worse mechanisms than NEA could ever
be.

Darryl (Dassa) Lynch