Re: [I2nsf] Security event reporting management

I2NSF people: 

The I2NSF gap analysis and I2RS work on management flows during DDoS or
network attacks (I'm a co-chair) cause me to realize there was something
different during periods of outage/network attack.  The growth of this is
expanding beyond the management interfaces to BGP.   BGP's Flow
Specification is being expanded to spread flow filters (RFC5575++++)
(another WG I co-chair) that help stop DDoS attacks in carriers.   After
being hit with the perfect storm of needs in 3 WGs, Bob and I looked at the
problem (draft-hares-i2nsf-mgtflow) and solutions. 

I suspect the first thing to look at is the problem and provide us feedback.
If you want to discuss the solutions, we are glad to chat about it as well. 

Sue 

-----Original Message-----
From: I2nsf [mailto:i2nsf-bounces@ietf.org] On Behalf Of Robert Moskowitz
Sent: Tuesday, March 22, 2016 12:09 PM
To: i2nsf@ietf.org
Subject: [I2nsf] Security event reporting management - the firstMILE

One of the functions described within the I2NSF environment is monitoring
security events.  I have not found any IETF work covering general security
alerts from security defense devices aside from the specific DDoS reporting
in DOTS.  So I have developed firstMILE:

https://www.ietf.org/internet-drafts/draft-moskowitz-firstmile-00.txt

Which proposes a sub/pub model including initial registration for security
alerts reporting.

At this point the draft is more a skeleton for hanging how the three
components work:

Registration of security device to monitor(s).
Subscription of monitors for specific reporting.
Publication of security reports to subscribed monitors.

I have covered some of the requirements for these components.  I bring this
to the I2NSF workgroup for:

Is this something the I2NSF wg should talk on?
And am I correct that currently security alert reporting is not covered
within the IETF.

For the pub portion, I hold that the requirements align with the DOTS
requirements, other than the bi-directional communications needs.  Do others
agree?  If so, I have a DOTS draft:

https://www.ietf.org/internet-drafts/draft-moskowitz-dots-ssls-02.txt

DOTS Secure Session Layer Services

This introduces a real session layer, something really not present in the
IETF stack, that provides a set of services.  SSLS and its services are laid
out in:

https://www.ietf.org/internet-drafts/draft-hares-i2nsf-ssls-00.txt

Sue and I developed the design for SSLS, as it is broadly applicable in a
number of areas under i2nsf.

Two other drafts that fit into this architecture are:

https://www.ietf.org/internet-drafts/draft-moskowitz-sse-03.txt
and
https://www.ietf.org/internet-drafts/draft-moskowitz-gpcomp-00.txt

SO.....

I open the floor to discussion.

I would be interested in how others see this part of the security defense
environment.

I am interested in how others see SLS and particularly SSLS and its use for
firstMILE pub.  I have requested a slot in the meeting to cover my work.

_______________________________________________
I2nsf mailing list
I2nsf@ietf.org
https://www.ietf.org/mailman/listinfo/i2nsf

Re: [I2nsf] Security event reporting management - the firstMILE