Subject: Re: [Nea] 03 comments - IDS as Posture Collecotr

From: Stefan Winter <[email-masked]>
Date: Thu, 2 Aug 2007 11:02:53 +0200

> > I agree that the IDS will play an important role for detecting potential
> > mis-behaviour on the network and potentially interacting with the NEA
> > Server or enforcement devices on the network (or endpoint).  However the
> > posture the IDS can learn by observing traffic is likely a subset of the
>
> Absolutely not. An active scanner can detect actual vulnerabilities
> while listing installed software detects what vulnerabilities *should*
> exist on the endpoint. Both are interesting.

I agree with Leif. Imagine a linux box with an installed RPM which has no 
known vulnerabilities (NEA reports state is good), but the user installed a 
beta version of the next release in /usr/local (or in a VM on the same 
machine) and is using that one instead of the shipped one. The beta has 
vulnerabilities and is breached already. An IDS detects the strange behaviour 
while NEA possibly doesn't. That information *is* interesting, IMHO.

Stefan Winter

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [email-masked]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473
_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea

---

From: "TS Glassey" <[email-masked]>
Date: Thu, 2 Aug 2007 07:19:24 -0700

This is then about Configuration Management as well as Integrity?

T

---

From: "Mike Fratto" <[email-masked]>
Date: Thu, 2 Aug 2007 10:25:21 -0400

Why not just clarify the language to indicate a "Host Based IDS"
instead of "IDS"?

Host based stuff is certainly within the charter. There are such
beasties on the market and as part of posture validation, can be used
in assessments in the same way an anti-virus or patch management
product can.

Besides, there is nothing to be gained by removing the reference and
if removed, leaves a gap that is open to interpretation.

---

From: "TS Glassey" <[email-masked]>
Date: Thu, 2 Aug 2007 07:41:48 -0700

Mike - I agree with the idea... conceptually there are two very different 
things going on here, and one of them is IDS centric and the other isnt, 
that being the 'footprint' verification functionality of some 'change 
management/control' service. As to amending the wording, I think NEA will 
need to do both functions since they are both key aspects of an ongoing 
Integrity Of Operations constrol set which this clearly is one.

Todd
----- Original Message ----- 
From: "Mike Fratto" <[email-masked]>
To: "TS Glassey" <[email-masked]>
Cc: "Stefan Winter" <[email-masked]>; <[email-masked]>; "Paul 
Sangster" <[email-masked]>
Sent: Thursday, August 02, 2007 7:25 AM
Subject: Re: [Nea] 03 comments - IDS as Posture Collecotr

---

From: Frank Yeh Jr <[email-masked]>
Date: Thu, 2 Aug 2007 09:44:03 -0700

Greetings,

      Perhaps it would be useful to separate things based on what is being
measured and where the measurements are taken and validated.

      For our purposes, there are essentially two types of measurement_
state-based and behavior-based. The traditional IDS is  behavior-based. It
does not really tell you anything about the state of an endpoint but tells
you what it is doing on the network. Recent introduction of host-based IDS
(AKA Behavioral FireWall AKA HIPS Host-Based Intrusion Prevention System)
technology does not change the fact that behavior is being measured.

      Integrity measurements are traditionally about state from a
configuration standpoint. What software is installed, how it is configured,
what values are found in the system registry or environment variables are
examples of state. This is the traditional thinking in the various  camps
that are feeding the NEA effort.

      So there seems to be some confusion over the fact that some are
proposing a tighter coupling with IDS's be built into the protocol.

      IMHO, this would be a useless extension for which existing protocols
will serve perfectly well. There is no constraint on what is being
measured, transported and verified. It is all simply data that relates to a
single endpoint. If an endpoint has invalid state or is performing illegal
actions, either of these should cause the endpoint to be kicked off or
denied access to the network. There is nothing in the protocol that
specifies what content is to be transferred in the tunnel created between
the measurement collectors and the verifiers.

      Furthermore, there is nothing in the current approach that precludes
using an IDS on the verifier side and it will be just as easy to build an
integrity verifier on an IDS as to build a new interface to a new protocol.
In either case the code has to be written but will only have to be done
once.  So an endpoint could simply be queried for its MAC Address which
could be sent to an IDS with a simple "are there any violations found for
this MAC" query. Based on what the IDS reports, the decision can be made.
Why do we need anything else in the context of a network admission (or post
admission) decision?

Regards,
Frank Yeh
Sr. Security & Privacy Integration Architect
IBM Global Technology Services
Security & Privacy Technology Integration Team

Second Life: Yehoo Newall

             "TS Glassey"                                                  
             <tglassey@earthli                                             
             nk.net>                                                    To 
                                       "Mike Fratto" <[email-masked]>   
             08/02/2007 07:41                                           cc 
             AM                        [email-masked], Paul Sangster         
                                       <[email-masked]>        
                                                                   Subject 
                                       Re: [Nea] 03 comments - IDS as      
                                       Posture Collecotr                   

                                                                           

Todd

---

From: Leif Johansson <[email-masked]>
Date: Sat, 04 Aug 2007 22:05:39 +0200

> Why not just clarify the language to indicate a "Host Based IDS"
I agree. I do believe NEA will eventually have to revisit this
stuff but as Stephen Hanna pointed out it is outside the
charter for now.

    Cheers Leif

---

From: "todd glassey" <[email-masked]>
Date: Sun, 5 Aug 2007 16:07:30 -0700

Steve - all...

After re-reading the charter I want to propose before we go too much farther 
that we come to some conclusions about where the charter will go, so while 
we are building the lower levels of this animal, we dont build Legs where 
Arms are supposed to go.

Todd

----- Original Message ----- 
From: "Leif Johansson" <[email-masked]>
To: "Mike Fratto" <[email-masked]>
Cc: "TS Glassey" <[email-masked]>; <[email-masked]>; "Paul Sangster" 
<[email-masked]>
Sent: Saturday, August 04, 2007 1:05 PM
Subject: Re: [Nea] 03 comments - IDS as Posture Collecotr