Subject: Re: [Raven] Fidnet

From: Vernon Schryver <[email-masked]>
Date: Thu, 4 Nov 1999 09:18:45 -0700 (MST)

> From: Robert Marshall <[email-masked]>

> In a recent discussion with FidNet  staff (the proposed Federal Intrusion 
> Detection Network), it was clear that the Federal Government is trying to 
> get a handle on IPv6 and the ability to encrypt all Internet traffic.  The 
> concern was that this would negate all traditional Intrusion Detection and 
> other sniffer systems .  Well, we can say too bad for them and all 
> government "snoops" but aren't we also going to make it more difficult for 
> all system managers to monitor and manage their own networks -- with or 
> without a law enforcement agents' field (LEAF) or similar backdoor?

In a word, "yes."
Systems managers are no more or less human or corruptible than the local
police, FBI, CIA, NSA, etc.  They are not doing more socially necessary
work, and so their convenience is no more of a justification for breaking
security than that of the FBI.  Moreover, the intentional and unintentional
security holes inevitable with any wiretapping or encryption backdoors
would hurt their long term goals far more than their daily work would be
eased.

By the way, what the intrusion detection mavens have been selling for
the last at least 15 years I've been watching them has had many connections
to artificial intelligence.  It's not only that AI has been offered as
how intrusion detection works (sic), but that like AI, useful intrusion
detection is an extremely difficult problem with very few and very limited
successes or foreseeable prospects.  AI has found some real uses, but
intrusion detection has never done more than offer promises in prototypes
that detect non-events such as port-scanning.  For the near future, the
only intrusions you can reasonably hope to detect are those which you
already know about and so surely have already defended against.

What most of the new information warfare gurus have been peddling cannot
be discussed in polite society.

As far as I can see, the IETF's intrusion detection protocol is a security
hole, since it is intended for telling strangers that your systems are
suffering an attack.  Strange good guys care a lot less about hearing that
bad guys exploiting holes in your defenses than those same bad guys.
However, since unlike wiretapping it is an optional and voluntary security
hole, there is no reason for the IETF to squash efforts to standardize it.

Vernon Schryver    [email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven