Subject: Re: [Nsaas] Need your to reply to this email FW: A ore accurate name....

From: Myo Zarny <[email-masked]>
Date: Sun, 14 Sep 2014 21:27:25 -0400

Hi Brian,

I agree that the scopes of SACM and NSaaS aren't the same even though there
is overlap. NSaaS is broader. Its domain/scope is more than just endpoints,
consistent APIs, communication protocols between endpoints and
network-based security services. It's all that plus--as you've pointed
out--how security policies are translated and provisioned on the
"southbound" side--regardless of their form-factor (hardware, software,
hypervisor-based, container-based). And so on.

The challenge is in determining which ones should be prioritized. To me, as
a user (not a vendor) of services, being able to dynamically reserve
network (security) services and have appropriate (security) policies
dynamically applied is the holy grail. (Especially if those policies can be
defined in user friendly terms and the system be smart enough to translate
them.) The question is how do we define and prioritize the steps towards
achieving them.

Regards,

>  *From:* Nsaas [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Brian Ford (brford)
> *Sent:* Wednesday, September 10, 2014 7:10 PM
> *To:* [email-masked]
> *Subject:* [Nsaas] A ore accurate name....
>
>
>
>
>
> Linda,
>
>
>
> IMO someone can make the argument that just about any acronym is like a
> ‘Marketing program’.  Changing the name of the pre-WG effort for that
> reason alone doesn’t seem wise ego me.  Changing it from something …’was’
> to include ‘Open’ doesn’t seem like a big win.
>
>
>
> When I first read your messages about Network Security as a Service I was
> interested.  I still am even though I know little more than the name.
>
>
>
> I have been watching and involved in SACM, Security Automation and
> Continuous Monitoring.  One of my concerns that I have about SACM are its
> almost myopic endpoint focus.  I’m particularly interested in NSaaS because
> it could or might address the application of security policy in networks
> that protect all devices be they endpoints or VMs or intelligent lightbulbs
> in an IoT (or IoE).
>
>
>
> I see ‘daylight’ between SACM and NSaaS.  But they could help each other.
>  Let’s start working on the real problem.
>
>
>
> Liberty,
>
>
>
> Brian
>
>
>
>
>
>  Via the offline discussion with Melinda, I learned that many people may
> think that NSaaS is more like Marketing slogan.
>
>
>
> Since the goal is to define a common interface for network security
> functions (like what I2RS has done for routers), so that Service Providers
> or 3rd party operators can offer Network Security Functions that may not
> physically present in the client premises.
>
>
>
> Is  "I2NSF" (Open Interface to Network Security functions) a more
> appropriate name? Any more suggestions?
>
>
>
> Linda
>
>
>
>  --
>
>   *Brian Ford | OCTAO | [email-masked]* <:[email-masked]>* | Direct*
>  *212.714.4288 <212.714.4288> | Mobile: 516.769.5884 <516.769.5884> |
> twitter.com/ccie2106 <http://twitter.com/ccie2106>*
>

-- 
Regards,
Myo

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 15 Sep 2014 18:51:16 +0000

Agree with Myo that prioritization/scoping of NSaaS will be crucial.
IMHO, standard Interface to Virtual Network Security Functions (I2NSF, or I2VNSF)  is a tool to enable NSaaS.  NSaaS might have broader scope, which might touch upon services model, SLA, etc.

IETF has traditionally been good in building tools, instead of broad service model (not to say that IETF can’t do it).

Another important point, strictly speaking, API is normally referring to function calls among different functions on one system, what we want to achieve is the interface between separate entities (boxes), as what I2RS is doing.

Therefore,  “Programmatic interfaces” might be more accurate.

Any thoughts?

Linda

From: Myo Zarny [mailto:[email-masked]]
Sent: Sunday, September 14, 2014 8:27 PM
To: [email-masked]; [email-masked]
Cc: Zarny, Myo; Linda Dunbar
Subject: Re: FW: A ore accurate name....

Hi Brian,

I agree that the scopes of SACM and NSaaS aren't the same even though there is overlap. NSaaS is broader. Its domain/scope is more than just endpoints, consistent APIs, communication protocols between endpoints and network-based security services. It's all that plus--as you've pointed out--how security policies are translated and provisioned on the "southbound" side--regardless of their form-factor (hardware, software, hypervisor-based, container-based). And so on.

The challenge is in determining which ones should be prioritized. To me, as a user (not a vendor) of services, being able to dynamically reserve network (security) services and have appropriate (security) policies dynamically applied is the holy grail. (Especially if those policies can be defined in user friendly terms and the system be smart enough to translate them.) The question is how do we define and prioritize the steps towards achieving them.

Regards,

From: Nsaas [mailto:[email-masked]] On Behalf Of Brian Ford (brford)
Sent: Wednesday, September 10, 2014 7:10 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Nsaas] A ore accurate name....

Linda,

IMO someone can make the argument that just about any acronym is like a ‘Marketing program’.  Changing the name of the pre-WG effort for that reason alone doesn’t seem wise ego me.  Changing it from something …’was’ to include ‘Open’ doesn’t seem like a big win.

When I first read your messages about Network Security as a Service I was interested.  I still am even though I know little more than the name.

I have been watching and involved in SACM, Security Automation and Continuous Monitoring.  One of my concerns that I have about SACM are its almost myopic endpoint focus.  I’m particularly interested in NSaaS because it could or might address the application of security policy in networks that protect all devices be they endpoints or VMs or intelligent lightbulbs in an IoT (or IoE).

I see ‘daylight’ between SACM and NSaaS.  But they could help each other.  Let’s start working on the real problem.

Liberty,

Brian

Via the offline discussion with Melinda, I learned that many people may think that NSaaS is more like Marketing slogan.

Since the goal is to define a common interface for network security functions (like what I2RS has done for routers), so that Service Providers or 3rd party operators can offer Network Security Functions that may not physically present in the client premises.

Is  "I2NSF" (Open Interface to Network Security functions) a more appropriate name? Any more suggestions?

Linda

--
  Brian Ford | OCTAO | [email-masked]<mailto::[email-masked]> | Direct 212.714.4288<tel:212.714.4288> | Mobile: 516.769.5884<tel:516.769.5884> | twitter.com/ccie2106<http://twitter.com/ccie2106>

--
Regards,
Myo

---

From: Lisa Lorenzin <[email-masked]>
Date: Mon, 15 Sep 2014 19:14:55 +0000

Hi Linda,

I've been following this thread with great interest but no clear opinion up until now, but this framing, that I2NSF is a tool to enable NSaaS, really resonates with me.  I think it's a much more clear way of articulating - and differentiating between - the problem space in which we're having the conversation (which is clearly more broad than the space SACM has defined) vs. the work we're trying to scope to address that problem space.

FWIW, adding "open" feels unnecessary to me.  My personal perception is that anything standardized in the IETF is open by default, so it's implicit.

Regards,
Lisa

From: Nsaas [mailto:[email-masked]] On Behalf Of Linda Dunbar
Sent: Monday, September 15, 2014 2:51 PM
To: Myo Zarny; [email-masked]; [email-masked]
Cc: Zarny, Myo
Subject: Re: [Nsaas] : A ore accurate name....

Any thoughts?

Linda

To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

Hi Brian,

Regards,

Linda,

Liberty,

Brian

Linda

--
Regards,
Myo