Re: [Nsaas] Existing work, other things

Hi,

I think the radical difference when considering NSaaS does not lie on the particular protocols to be used for controlling the security appliances, but with how these security virtual appliances are instantiated. We are talking about security services running in a virtualized platform not necessarily running on the user premises, so stronger a newer mechanisms to establish trust are needed.

NSaaS will need to consider at least:

1) Mechanisms for assessing the trustworthiness of the platform the virtualized security functions are going to run, including the links with them

2) Methods for querying and verifying the applicable functions to be deployed on the platform

3) Control protocols for those functions once deployed

The two first steps are essential to a virtualized environment and related to platform and function attestation. The third one is common to virtualized and not virtualized functions, though I think some aspects (scaling events, for example) could need to be considered as well in a virtualized environment.

Be goode,
On 12 Aug 2014, at 19:57 , Linda Dunbar <linda.dunbar@huawei.com> wrote:

> Melinda,
>
> Answers are inserted below:
>
> -----Original Message-----
> From: Melinda Shore [mailto:melinda.shore@gmail.com]
> Sent: Tuesday, August 12, 2014 12:23 PM
> To: Linda Dunbar; nsaas@ietf.org
> Subject: Re: [Nsaas] 答复: Existing work, other things
>
> On 8/12/14 9:08 AM, Linda Dunbar wrote:
>> Thank you for the listing. There is also SACM.
>> I will include those IETF initiatives in the existing work of IETF. Gap analysis will be needed.
>
> I think a gap analysis is premature, given the lack of a sense of overall direction.  And my question really is *not* about why these protocols may not be applicable.  My question is why you feel that new work would be successful given the lack of implementation and deployment of previous efforts (and also given that OpenStack has an implementation of their own design).
>
> [Linda] There is already wide acceptance of security functions that are not running on customer/enterprise premises. Numerous security vendors are now leveraging cloud based models to deliver security solutions. According to [Gartner-2013], the demand for cloud-based security services is growing. Small and medium-sized businesses (SMBs) are increasingly adopting cloud-based security services to replace on-premises security tools, while larger enterprises are deploying a mix of traditional and cloud-based security services.
>
> In addition, NSaaS is very different from all those listed initiatives.
>
> There are three aspects to NSaaS:
> - Define the mechanism for creating virtual security functions on physical appliances,
> - Specify concrete rules (or attributes) for instantiating VMs for virtual security functions (NFV initiative), and
> - Define the mechanisms for clients (applications) to request/negotiate/validate security functions that are not physically located on the local premises.
>
> All those aspects share a common need: Attributes for the needed virtual security functions, the request/negotiate mechanism for virtual functions (on physical appliances, from remote domains, or others).
>
> Linda
>
>
> _______________________________________________
> Nsaas mailing list
> Nsaas@ietf.org
> https://www.ietf.org/mailman/listinfo/nsaas

--
PLEASE NOTE MY NEW EMAIL ADDRESS
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: diego.r.lopez@telefonica.com
Tel:    +34 913 129 041
Mobile: +34 682 051 091
----------------------------------

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição