Re: [sacm] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

For experimentation, OpenDaylight has YANG Push code for the both subscriber and publisher.  I can work with you offline to help define a viable testbed.

Eric

From: Waltermire, David A,  March 31, 2017 5:17 PM

Eric,

We have considered YANG Push as part of PANIC. I have read the draft and I attended your presentation during NETCONF. I think Yang Push is something we should consider as part of the PANIC solution. Do you have an implementation of YANG Push that can be experimented with?

Regards,
Dave

From: Eric Voit (evoit) [mailto:evoit@cisco.com]
Sent: Thursday, March 30, 2017 6:27 PM
To: Waltermire, David A. (Fed) <david.waltermire@nist.gov<mailto:david.waltermire@nist.gov>>; Mahesh Jethanandani <mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>>
Cc: mile@ietf.org<mailto:mile@ietf.org>; netconf@ietf.org<mailto:netconf@ietf.org>; netmod@ietf.org<mailto:netmod@ietf.org>; sacm@ietf.org<mailto:sacm@ietf.org>
Subject: RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Hi David,

I know it is early, but for the secure communication part, have you considered using the YANG Push<https://datatracker.ietf.org/doc/draft-ietf-netconf-yang-push/?include_text=1> work being developed in the NETCONF WG?

With this approach, you can subscribe to state changes within a device's YANG models.  These could be PANIC developed YANG models,  existing YANG models such as IETF-System, IETF-keychain, or some combination.   Then if a hacker inserts new hardware, changes software versions, adds keys, adds users, etc. that state change can be securely pushed to a subscribing where it can be determined whether the change was expected/desired.

Eric
________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>> wrote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <david.waltermire@nist.gov<mailto:david.waltermire@nist.gov>> wrote:
>
>
> The US Government has been working within the IETF SACM work group to standardize the collection of endpoint configuration and other posture information from enterprise endpoints. Collecting this information is critical to support automation of common network security tasks, including asset, software, vulnerability, and configuration management. Thus far, our efforts have focused primarily on standards to collect information in support of asset, software and vulnerability management use cases, and has worked with other IETF members to determine what data would need to be to be collected, and how that data would be securely communicated across the network. Through such exchanges an organization can know what client endpoints are connected to their network, and if they are vulnerable to attack.
>
> Given the proliferation of attacks against network infrastructure devices, it is clear that the next step in our enterprise security automation effort must be to enable standardized reporting of similar information from network infrastructure devices. With the growing number of Yang models and increased adoption of NETCONF, RESTCONF, and related protocol work, the time is right to work out how these standards can be used to measure the health of network devices. This information will, as in our efforts in SACM for client devices, support asset, software, vulnerability, and configuration management use cases. Standards-based reporting of this information from network infrastructure devices will help network defenders protect against known attacks, and provide the necessary knowledge to detect and mitigate future attacks.
>
> We would like to start a discussion about how to leverage the existing IETF network management protocols to best address security automation for network infrastructure devices. We would like your ideas on how to best pursue this work, and your insights into network infrastructure security problems that will impact our networks in the future. We are holding a side meeting at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion about how to move forward. We will be meeting in Vevey 4 at the IETF meeting venue.

Maybe this was discussed in the BoF ...

The best way to have a discussion would be to present the proposal in the form of a draft in the NETCONF WG.

>
> Here is a summary of the meeting details:
>
> PANIC (Posture Assessment through Network Information Collection) Bar BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>
> We look forward to working with you, and hope to see you in Chicago at the PANIC Bar BoF.
>
> Regards,
> Dave
>
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org<mailto:Netconf@ietf.org>
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>