Re: [mile] PANIC Bar BoF Tonight @ 6:30pm CDT

["Waltermire, David A. (Fed)" <[e-mail]>]

The Posture Assessment Through Network Information Collection (PANIC) group held an informal bar BoF at IETF 98 to discuss available protocols and data models for assessing the posture of network equipment devices. A description of PANIC is below, and a slide deck is attached describing the group's goals and requirements. We had a productive discussion about the group's scope, and agreed to continue the conversation on a non-working group mailing list. 

The PANIC mailing list is now available for subscribers at this link: https://www.ietf.org/mailman/listinfo/panic.

If you are interested in the effort, please join the mailing list. A scoping draft will be posted to the list in the next week. We look forward to your feedback on it.

Regards,
Dave

PANIC Description:

The IETF SACM work group has been working to standardize the collection of endpoint configuration and other posture information from enterprise endpoints. Collecting this information is critical to support automation of common network security tasks, including asset, software, vulnerability, and configuration management. Thus far, our efforts have focused primarily on standards to collect information in support of asset, software and vulnerability management use cases for classical endpoint devices (e.g., servers, laptops, etc), and has worked with other IETF members to determine what data would need to be to be collected, and how that data would be securely communicated across the network. Through such exchanges an organization can know what client endpoints are connected to their network, and if they are vulnerable to attack.

Given the proliferation of attacks against network infrastructure devices, it is clear that the next step in our enterprise security automation effort must be to enable standardized reporting of similar information from network infrastructure devices. With the growing number of Yang models and increased adoption of NETCONF, RESTCONF, and related protocol work, we believe the time is right to work out how these standards can be used to measure the health of network devices. This information will, as in our efforts in SACM for client devices, support asset, software, vulnerability, and configuration management use cases. We hope to use existing management protocols to report this information from network infrastructure devices, supporting multiple use cases using the same set of management protocols. Such a mechanism will help network defenders protect against known attacks, and provide the necessary knowledge to detect and mitigate future attacks.

> -----Original Message-----
> From: Waltermire, David A. (Fed)
> Sent: Wednesday, March 29, 2017 4:42 PM
> To: '[e-mail]' <[e-mail]>; '[e-mail]' <[e-mail]>;
> '[e-mail]' <[e-mail]>; '[e-mail]'
> <[e-mail]>
> Subject: PANIC Bar BoF Tonight @ 6:30pm CDT
> 
> 
> Just a quick reminder... the Posture Assessment through Network
> Information Collection (PANIC) bar BoF is tonight right after the IETF 98
> Technical and Administrative Plenary at 6:30pm CDT in Vevey 4 at the
> Swissotel Conference Center. We are hoping to start a discussion about how
> to leverage the existing IETF network management protocols to best address
> security automation for network infrastructure devices. We would like your
> ideas on how to best pursue this work, and your insights into network
> infrastructure security problems that will impact our networks in the future.
> We are holding a side meeting at IETF 98 on Wednesday, March 29th at
> 6:30pm CDT to start a discussion about how to move forward on this topic.
> 
> Given the late hour, we will have some light snacks. We hope to see you
> there.
> 
> Regards,
> David Waltermire