Re: [Model-t] draft-arkko-farrell-arch-model-t-00

[Christian Huitema <[e-mail]>]

Doing my prep work for the meeting in Singapore, I have been reviewing
draft-arkko-farrell-arch-model-t-00. I think this is a very good
framework for the discussion, which does reflect the discussions in the
IAB prior to launching the "model T" effort. I have a couple of nits
that I would like to see fixed, and I will list them later. But first, I
would like to point the differences with
draft-lazanski-smart-users-internet-00.

Draft-arkko-farrell-arch-model-t-00 addresses much of the threats
discussed in draft-lazanski-smart-users-internet-00, including efforts
to delineate what we should really mean by end-to-end. There are
differences in tone, as Lazanski's draft reads more like an advocacy for
different classes of defense, but beyond the difference in tone there is
an important difference in focus on threats against businesses, botnets,
and persistent actors.

I think the threat model should try integrate some of these threat
descriptions. Botnets are so common that they probably deserve their own
section in the next version of draft-arkko-farrell-arch-model-t, looking
at how these things are built, what they are use for, and how better
security could if not prevent their formation at least make them easier
to detect and demolish. Similarly, attacks against enterprise networks
probably deserve their own section, including how they are used for
ransomware, DDOS or spying, how they progress over time, and how the
enterprise can detect and mitigate attacks in progress -- probably with
a mention of the "kill chain".

Some of the enterprise attacks are facilitated by poor security postures
inherited from the early Internet development. The worse offender is
probably the classic domain-based defense, "soft on the inside, crunchy
on the outside". Draft-arkko-farrell-arch-model-t addresses some of
that, but could be more forceful.

I understand that there is a tension between describing the attacks and
securing the Internet. Combating botnets or persistent threat requires
monitoring system behavior and flagging anomalies. Some of the current
tools do that by monitoring clear text parts of the traffic. These tools
are threatened by advances in end-to-end security that also contribute
to hide the bad actors. There is a natural tendency by some
practitioners to block the end-to-end security advances in order to
preserve their existing tools. We don't want to reinforce that line of
argument, but we need to discuss it and delineate the alternatives.

As for the nits in draft-arkko-farrell-arch-model-t-00, I noted that in
the basic guidelines section (4.1), the draft says:

 3.  Perform end-to-end protection via other parties:...

The paragraph actually explains the dangers of involving third parties
when performing end-to-end protection. I think it would be clearer to
state that in the headline, as in "Minimize reliance on third parties
for end to end protection".

The additional guidelines section has a paragraph about greasing. I
wonder whether greasing really is a security function, or something
else. I don' see the case for greasing made in the observations section
(2). You should either make it, or not mention greasing.

-- Christian Huitema