Re: [Covidimpacts-workshop] asking hard questions

Hi all,

I'm glad to see discussion branching out beyond traffic volumes, and the conclusion of "we did really well to build capacity and cope". Though a valuable takeaway and good feels, declaring universal success would be to ignore a lot of the challenges that could have been dealt with better.

For security specifically, of course malware isn't a new threat, as Mirja noted yesterday - but the security picture did change, due to COVID. There was a pivot in attack lures, increased threat surface from home working, and increased user vulnerability (due to (1) demographic shift, with less experienced users spending more time online and (2) isolation and thirst for information in a pandemic situation).

Defenders dealt with a shift in attack techniques due to a shifted threat surface (I think Lixia called out Zoom-bombing yesterday - Zoom isn't a new technology but we only saw Zoom-bombing when it was an attack worth making due to Zoom's increased popularity). We also saw new organisations/sectors being aggressively targeted. NCSC launched a manual email reporting service (https://www.ncsc.gov.uk/information/report-suspicious-emails), which has been very successful... but could we have done better in our security response?

In my position paper, I posed a few questions for discussion on these points. Reposting in case they are of use for Friday:

  1.  What IETF engineering has already helped to protect users and improve security against these attacks?
  2.  What does the pandemic situation amplify or reduce in RFC 8890 and other user-specific initiatives?
  3.  Given reduced user vigilance to phishing in a pandemic situation and in isolated working environments, and a longer-term shift in working patterns and locations, what protocol-level work can be started to make it difficult for attackers to reach users?
  4.  What protocol design and deployment decisions can be taken to reduce vulnerability of remote working infrastructure?

I'd also like to see discussion of user experiences continue, beyond just quality of service. e.g. users in a pandemic situation are keener for news - to mitigate fake news spread, individual services made stronger efforts than ever before to direct users to valid news sites/official sources. Is that the best way to mitigate misinformation? Could we have done better there too?

Kirsty

________________________________
From: Covidimpacts-workshop <covidimpacts-workshop-bounces@iab.org> on behalf of Larry Masinter <LMM@acm.org>
Sent: 11 November 2020 21:53
To: Lixia Zhang <lixia@cs.ucla.edu>
Cc: Dominique Lazanski <dml@lastpresslabel.com>; covidimpacts-workshop@iab.org <covidimpacts-workshop@iab.org>
Subject: Re: [Covidimpacts-workshop] asking hard questions

https://youtu.be/tleJg1_SGXM<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fyoutu.be%2FtleJg1_SGXM&data=04%7C01%7CKirsty.p%40ncsc.gov.uk%7C5596126b52334e024eed08d8868c4927%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C1%7C637407284365788282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=lp6ZxyypjRAZEX%2FnubriuiPbF%2F2Sm95t7sPqd7SE0FI%3D&reserved=0> about 1 hour and 46 minutes in.

I'll try to wake up in time on Friday

I'd like to make a pitch for https://going-remote.info<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgoing-remote.info%2F&data=04%7C01%7CKirsty.p%40ncsc.gov.uk%7C5596126b52334e024eed08d8868c4927%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C1%7C637407284365788282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=1wktFtb1MsffyyMZ4W%2Bmml19wPd%2BCYhofsx9OjlaouA%3D&reserved=0> or something like it as a way of getting feedback from users or admins. And also to ask if any think a "community group" (such as https://w3.org/community/covid-19<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fw3.org%2Fcommunity%2Fcovid-19&data=04%7C01%7CKirsty.p%40ncsc.gov.uk%7C5596126b52334e024eed08d8868c4927%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C1%7C637407284365798240%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=zBz78qlb4pGUbGRTwOopN%2Feug8Dcs0pDwywDRgVnBbA%3D&reserved=0> ) might be a way to work on a document laying out some of the "big problems" that Lixia alluded to.
The "big problem" that I looked/listened for was around "broadband" coverage for distance learning.
If you optimize for "user" experience (QoE) you might not be including the experience of those who aren't users but want to be. (Maybe this was discussed but I didn't find it skimming the white-papers.)

On Wed, Nov 11, 2020 at 10:26 AM Lixia Zhang <lixia@cs.ucla.edu<mailto:lixia@cs.ucla.edu>> wrote:

On Nov 11, 2020, at 9:27 AM, Dominique Lazanski <dml@lastpresslabel.com<mailto:dml@lastpresslabel.com>> wrote:

Lixia,

I completely agree with you. It is a good question and how do we start the conversation?

Dominique

the title of our whitepaper submission to this workshop:
"Identifying the Disease from the Symptoms: Lessons for Networking in the COVID-19 Era"
that suggests a start point;)

i.e. to start from articulating the root cause, as deep as we can go, beyond the symptoms of a problem.  I dont know which ones people would like to start with, e.g. the loss of E2E? the app security challenge? or internet centralization? (I know this topic is outside the scope of this workshop, although I think all thee above are actually related at a deeper level).

And let's expect to hear very different opinions, and that's a very good thing.  I hope discussions could lead to a deepened understanding, which in turn could help us see the solution space better, for short term and long term goals.

Lixia
PS: I dont mean Friday is the right time for all the above, perhaps just more discussions and assessment of opinions and interests. Nothing achievable without dedicated people.

On 11 Nov 2020, at 16:46, Lixia Zhang <lixia@cs.ucla.edu<mailto:lixia@cs.ucla.edu>> wrote:

folks, I feel sorry for throwing out some hard issues at the end of today's call, these hard issues might make one feel a bit uncomfortable.

those issues exist independent from how one feels about them.
the only question is whether IAB should/wants to put them on the table; and if not, who else's table should they be on.
Unless they get addressed, I personally worry that they would get much worse.

Lixia
--
Covidimpacts-workshop mailing list
Covidimpacts-workshop@iab.org<mailto:Covidimpacts-workshop@iab.org>
https://www.google.com/url?q=https://www.iab.org/mailman/listinfo/covidimpacts-workshop&source=gmail-imap&ust=1605718006000000&usg=AOvVaw3XuH_gySjBB-Lt2Y5kBpCC<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.iab.org%2Fmailman%2Flistinfo%2Fcovidimpacts-workshop%26source%3Dgmail-imap%26ust%3D1605718006000000%26usg%3DAOvVaw3XuH_gySjBB-Lt2Y5kBpCC&data=04%7C01%7CKirsty.p%40ncsc.gov.uk%7C5596126b52334e024eed08d8868c4927%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C1%7C637407284365798240%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=vjd1lV4dvApd8Z%2FqVR2mFRE93TgAJxPHaQ%2FiSna2em8%3D&reserved=0>

--
Covidimpacts-workshop mailing list
Covidimpacts-workshop@iab.org<mailto:Covidimpacts-workshop@iab.org>
https://www.iab.org/mailman/listinfo/covidimpacts-workshop<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.iab.org%2Fmailman%2Flistinfo%2Fcovidimpacts-workshop&data=04%7C01%7CKirsty.p%40ncsc.gov.uk%7C5596126b52334e024eed08d8868c4927%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C1%7C637407284365808194%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=gOV8v%2B%2BH02Wy43NzZBIVxknPwwDuMw3EMIft2yDeZrU%3D&reserved=0>

--
--
https://LarryMasinter.net<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Flarry.masinter.net%2F&data=04%7C01%7CKirsty.p%40ncsc.gov.uk%7C5596126b52334e024eed08d8868c4927%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C1%7C637407284365808194%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=l2wPoEqKoPXQrS8isIJX90vSe6wZdW0SlDm00Nq7HXM%3D&reserved=0>
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk. All material is UK Crown Copyright ©