Subject: Re: [Nea] 03 comments - IDS as Posture Collecotr

From: Frank Yeh Jr <[email-masked]>
Date: Thu, 2 Aug 2007 14:46:10 -0700

Greetings,

      I understand your points but consider them to be out of scope for
NEA, which is about establishing and using a tunnel to pass data. What
happens to the data outside of the tunnel, how it is collected, etc are
outside the scope of the protocol.

      What you want is a standard way of dealing with the data once it is
passed through the tunnel. NEA is purposely generic about this to make it
as flexible as possible. If you want to define a standard way to then pass
that data to an IDS and figure out what to do, great. That would require
another specification which would use NEA as transport and as a network
admission control point.

Regards,
Frank Yeh
Sr. Security & Privacy Integration Architect
IBM Global Technology Services
Security & Privacy Technology Integration Team

Second Life: Yehoo Newall

             "TS Glassey"                                                  
             <tglassey@earthli                                             
             nk.net>                                                    To 
                                       Frank Yeh Jr/Irvine/IBM@IBMUS       
             08/02/2007 09:52                                           cc 
             AM                        "Mike Fratto" <[email-masked]>,  
                                       <[email-masked]>, "Paul Sangster"     
                                       <[email-masked]>        
                                                                   Subject 
                                       Re: [Nea] 03 comments - IDS as      
                                       Posture Collecotr                   

                                                                           

pardon the blue-sky rant here but... The real value from a philosophical
point I see for NEA is that it could be a collection point for a number of
Policy Service tools, and that it can tie this in with a set of attestation
practice models for running secured and reliable infrastructure. That said,
the point is that there keenly is a need to handle the stateful compliance
with 'pre-specified policy and configuration management' and that this is
specific not only to just plugging a system into a network but in prefacing
the connections of two distributed systems from untrusted networks
together.

OK -- so what does all that really mean? - Simple - it means that there in
the IETF's bag of tricks needs to be a really cool messaging and policy
communication language and protocol which can be used not only to qualify a
machine for action in an environment, but also for operations as a
pre-event transaction qualification as well. This possibly makes NEA it.
The one and only qualifer and setup infrastructure needed to bring machines
in or take them out, and to have applications use.

t.
 ----- Original Message -----
 From: Frank Yeh Jr
 To: TS Glassey
 Cc: Mike Fratto ; [email-masked] ; Paul Sangster
 Sent: Thursday, August 02, 2007 9:44 AM
 Subject: Re: [Nea] 03 comments - IDS as Posture Collecotr

 Greetings,

 Perhaps it would be useful to separate things based on what is being
 measured and where the measurements are taken and validated.

 For our purposes, there are essentially two types of measurement_
 state-based and behavior-based. The traditional IDS is behavior-based. It
 does not really tell you anything about the state of an endpoint but tells
 you what it is doing on the network. Recent introduction of host-based IDS
 (AKA Behavioral FireWall AKA HIPS Host-Based Intrusion Prevention System)
 technology does not change the fact that behavior is being measured.

 Integrity measurements are traditionally about state from a configuration
 standpoint. What software is installed, how it is configured, what values
 are found in the system registry or environment variables are examples of
 state. This is the traditional thinking in the various camps that are
 feeding the NEA effort.

 So there seems to be some confusion over the fact that some are proposing
 a tighter coupling with IDS's be built into the protocol.

 IMHO, this would be a useless extension for which existing protocols will
 serve perfectly well. There is no constraint on what is being measured,
 transported and verified. It is all simply data that relates to a single
 endpoint. If an endpoint has invalid state or is performing illegal
 actions, either of these should cause the endpoint to be kicked off or
 denied access to the network. There is nothing in the protocol that
 specifies what content is to be transferred in the tunnel created between
 the measurement collectors and the verifiers.

 Furthermore, there is nothing in the current approach that precludes using
 an IDS on the verifier side and it will be just as easy to build an
 integrity verifier on an IDS as to build a new interface to a new
 protocol. In either case the code has to be written but will only have to
 be done once. So an endpoint could simply be queried for its MAC Address
 which could be sent to an IDS with a simple "are there any violations
 found for this MAC" query. Based on what the IDS reports, the decision can
 be made. Why do we need anything else in the context of a network
 admission (or post admission) decision?

 Regards,
 Frank Yeh
 Sr. Security & Privacy Integration Architect
 IBM Global Technology Services
 Security & Privacy Technology Integration Team

 Second Life: Yehoo Newall

 Inactive hide details for "TS Glassey" <[email-masked]>"TS
 Glassey" <[email-masked]>

                         "TS Glassey"                                      
                         <tglassey@ear                                     
                         thlink.net>                                       
                                                                           
                                                                        To 
                         08/02/2007                                        
                         07:41 AM               "Mike Fratto"              
                                                <[email-masked]>        
                                                                           
                                                                        cc 
                                                                           
                                                [email-masked], Paul         
                                                Sangster                   
                                                <[email-masked] 
                                                m>                         
                                                                           
                                                                   Subject 
                                                                           
                                                Re: [Nea] 03 comments -    
                                                IDS as Posture Collecotr   

                                                                           

 Mike - I agree with the idea... conceptually there are two very different
 things going on here, and one of them is IDS centric and the other isnt,
 that being the 'footprint' verification functionality of some 'change
 management/control' service. As to amending the wording, I think NEA will
 need to do both functions since they are both key aspects of an ongoing
 Integrity Of Operations constrol set which this clearly is one.

 Todd
 ----- Original Message -----
 From: "Mike Fratto" <[email-masked]>
 To: "TS Glassey" <[email-masked]>
 Cc: "Stefan Winter" <[email-masked]>; <[email-masked]>; "Paul
 Sangster" <[email-masked]>
 Sent: Thursday, August 02, 2007 7:25 AM
 Subject: Re: [Nea] 03 comments - IDS as Posture Collecotr

 > Why not just clarify the language to indicate a "Host Based IDS"
 > instead of "IDS"?
 >
 > Host based stuff is certainly within the charter. There are such
 > beasties on the market and as part of posture validation, can be used
 > in assessments in the same way an anti-virus or patch management
 > product can.
 >
 > Besides, there is nothing to be gained by removing the reference and
 > if removed, leaves a gap that is open to interpretation.
 >
 > On 8/2/07, TS Glassey <[email-masked]> wrote:
 >> This is then about Configuration Management as well as Integrity?
 >>
 >> T
 >> ----- Original Message -----
 >> From: "Stefan Winter" <[email-masked]>
 >> To: <[email-masked]>
 >> Cc: "Paul Sangster" <[email-masked]>
 >> Sent: Thursday, August 02, 2007 2:02 AM
 >> Subject: Re: [Nea] 03 comments - IDS as Posture Collecotr
 >>
 >>
 >> > _______________________________________________
 >> > Nea mailing list
 >> > [email-masked]
 >> > https://www1.ietf.org/mailman/listinfo/nea
 >> >
 >>
 >>
 >> _______________________________________________
 >> Nea mailing list
 >> [email-masked]
 >> https://www1.ietf.org/mailman/listinfo/nea
 >>

 _______________________________________________
 Nea mailing list
 [email-masked]
 https://www1.ietf.org/mailman/listinfo/nea
_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea