[saag] SMART summary

[Kathleen Moriarty <[e-mail]>]

Stopping Malware And Researching Threats (SMART) met Monday afternoon as an
IAB Session, which aims to be an IRTF research group.

SMART met on Monday to discuss the problem statement and some areas for
research possible for the effort. A brief review of the Coordinating Attack
Response at Internet Scale (CARIS) 2 workshop was provided.  A full meeting
report will be forthcoming.

Several researchers and industry representatives presented.  Talks included:
Malicious Uses of Evasive Communications and Threats to Privacy (David
McGrew)
   Highlighted questions and areas of research for SMART.  Showed multiple
views
   into work focused on privacy. Many protocols in the IETF are designed
for
   benign uses but can be used in a malicious way. Attacks lead to data
breaches
   and a negative impact on privacy.
Threat Landscape Report (Arnaud Taddei)
   Reviewed statistics from the incident responder viewpoint.  Some metrics
   will be further clarified on the list.  Understanding the threat
landscape helps to
   prioritize efforts based on trends.
Testing for the good of the internet (Simon Edwards)
   Discussed testing of vendor products and taking the full attack chain
into
   consideration for detection.  Talked about the difficulties with testing
   samples due to bias with available samples but described the methodology
of
   testing security against a full attack chain.
BGP hijacking (Töma Gavrichenkov)
   Multiple drafts exist and are in review for BGP hijacking solutions
   (other BGP problems exist and there is a possible area of research to
explore
   and provide guidance).  Should SMART play a role in providing guidance to
   IETF draft proposals from an attack defence perspective?
CLESS draft on endpoint security (Arnaud Taddei)
   The CLESS draft surveys the end point capabilities and limitations for
one set of
   end points, others expected to be added.  This draft is focused on what
can be
   done at the end point, for a full understanding of what can be done on
the end
   point, and therefore what must be done in the protocol. This is needed
as security
   capabilities are expected to shift to the end point with more end-to-end
   encryption.  Contributions were requested on this early draft.
One Snake (Ian Levy, NCSC)
   Highlighted numerous problems for the information security professional,
   the opportunities for research, measurement, and advancement in this
space and
   why a group like SMART is needed.

Room was surveyed to determine interest in contributing or reviewing work.
About half the room raised hands.  Scope needs to be determined and hand
offs to the IETF Security Area are likely depending on the work that comes
in.
Contributions are welcome.
There were about 150 people that signed the blue sheets, room seemed packed
a bit more.


-- 

Best regards,
Kathleen & Kirsty