Subject: [Raven] Fidnet

From: [email-masked]
Date: Fri, 5 Nov 1999 16:25:43 -0500

On  Thu, 4 Nov 1999 09:18:45 -0700 (MST), Vernon Schryver
<[email-masked]> wrote:
>
>> From: Robert Marshall <[email-masked]>
>
>> In a recent discussion with FidNet  staff (the proposed Federal
Intrusion
>> Detection Network), it was clear that the Federal Government is trying
to
>> get a handle on IPv6 and the ability to encrypt all Internet traffic.
The
> >concern was that this would negate all traditional Intrusion Detection
and
> >other sniffer systems .  Well, we can say too bad for them and all
> >government "snoops" but aren't we also going to make it more difficult
for
> >all system managers to monitor and manage their own networks -- with or
> >without a law enforcement agents' field (LEAF) or similar backdoor?
>
>In a word, "yes."

Any form of encryption makes network based intrusion detection difficult to
say the least.   Host based intrusion detection at the end-point are
another matter.   This is true regardless of whether we talk about Fidnet
or a business trying improve their security.   It also creates new
opportunities with their own set of challenges -- just think carefully
about all of the implications of remote VPN solutions and personal
computers.

{I find it interesting that network based intrusion detection, which is at
least commercially relatively recent, is considered as "traditional
intrusion detection".}

>Systems managers are no more or less human or corruptible than the local
>police, FBI, CIA, NSA, etc.  ...

Agreed.  But there may be less systematic pressure on them.  After all,
most everyone is measured on something.   System managers on up-time.  Cops
on arrests and tickets.  Prosecutors on convictions.  In general, most
system mangers are probably less motivated to catch and convict a criminal
than to keep some intruder from screwing up the availability numbers.
Furthermore, many organizations are disinclined to pursue any form of
legal action against intruders (if they can find them) over the fear of bad
publicity.

> ... They are not doing more socially necessary
>work, ...

While they may not be directly protecting society from terrorists, serial
killers and organized crime.  I would say that this point is debatable.
Doesn't a system manager supporting their secure functioning of their
business and the overall e-commerce infrastructure have a positive impact
on society?

> ... and so their convenience is no more of a justification for breaking
>security than that of the FBI.

Agreed.

>Moreover, the intentional and unintentional
>security holes inevitable with any wiretapping or encryption backdoors
>would hurt their long term goals far more than their daily work would be
>eased.

Highly likely.

[snip ... bulk of intrusion detection discussion skipped]

>However, since unlike wiretapping it is an optional and voluntary security
>hole, there is no reason for the IETF to squash efforts to standardize it.

Agreed.

David Gamey

Any opinions expressed above are mine and not those of IBM or IBM Security
and Privacy Services.

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven