Re: [bmwg] draft-green-bmwg-seceff-bench-meth-00

[Dennis Cox <[e-mail]>]

Kenneth,

 I read the draft you provided. Some questions and suggestions since you are soliciting for them.

How will you select the attacks? Will you leverage CVEs? Or is this draft meant to be away of measuring two different flows? The reason I ask is that one companies data leakage is another companies standard traffic. You state that "all of these defensive solutions have in common ... distinguish between evil ... and good traffic". With the list such as anti-virus and anti-spam to data leakage listed, I would have to disagree. Solutions such as these at the eye of the beholder and each users requirements and each technologies inspection is quite different.

One example: Anti-Spam companies use technologies from reputation based (Cisco IronPort) to RBL.

How about evasions? Quite a large number of evasion techniques are used by people how attack networks. Will the draft take into account multiple language evasions? Or fragmentation and reassembly evasions? Will you rate the effectiveness of the device in handling attacks each type of evasion?

In order to test security effectiveness it comparing between "good" traffic and "evil" traffic, I would think that whatever application protocol the "evil" traffic uses the good traffic would need to use as well. That should make section 3.1 easy to determine.

Also, evil may not be the best word, perhaps malicious might be a bit used instead.

Dennis


________________________________
From: [e-mail] [[e-mail]] on behalf of Kenneth Green [[e-mail]]
Sent: Monday, October 24, 2011 9:53 PM
To: [e-mail]
Subject: [bmwg] draft-green-bmwg-seceff-bench-meth-00

Hi Team,

A new Internet Draft has been posted addressing benchmark testing of Security Effectiveness.

http://www.ietf.org/id/draft-green-bmwg-seceff-bench-meth-00.txt

We would like to solicit discussion about the concepts described in this draft and look forward to your comments, questions and suggestions.

Regards,
Kenneth

Kenneth Green
Solution Architect
Ixia