Re: [Smart] Draft Charter For SMART Proposed RG

Bret Jordan <jordan.ietf@gmail.com> Thu, 27 September 2018 21:59 UTC

Return-Path: <jordan.ietf@gmail.com>
X-Original-To: smart@ietfa.amsl.com
Delivered-To: smart@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6BD5130F36 for <smart@ietfa.amsl.com>; Thu, 27 Sep 2018 14:59:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.997
X-Spam-Level:
X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HOtQQUw2konV for <smart@ietfa.amsl.com>; Thu, 27 Sep 2018 14:59:08 -0700 (PDT)
Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 128BB130E1F for <smart@irtf.org>; Thu, 27 Sep 2018 14:59:08 -0700 (PDT)
Received: by mail-qt1-x82a.google.com with SMTP id z14-v6so4578925qtn.2 for <smart@irtf.org>; Thu, 27 Sep 2018 14:59:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=OGAnBxBno4LXd8ufZ7Hswp7/JUcV5x3keU7fRtSJpeo=; b=bAbIlQ//totoxJHuyEDftdRjKuPM5hBR2FrE8eS8vYM1YpZxUlnvGFizxPazZLfvMe LV0wLiFiqfozMUv/1KFuTw5MQ/9WwBnqX1561FOB8O5XXAFUgN+xjMypAK7fao1acbI4 LjNUtD7avDpB/2zLnUOguCzUmO1NWCYME/vMWCv1E8NBup6kZ/LbMwQs/6BF8qh0SXei 25W+bpGeNNWsAismNqKW3AioYVA1gQGykmAZ9fdVxmOtKLlG7R2FmKkY/TvfM0L1qD3z 8z7f2VmczPRq2nmUd2ar38iH/DpdI2y7bwmRTesWml4mVXYPASwZdWAvwNAzVeFmUAzb VPgg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=OGAnBxBno4LXd8ufZ7Hswp7/JUcV5x3keU7fRtSJpeo=; b=NSkxBMU7nqVj236VxwIEW2nDospXVYQQ7Rb1JChFjfUnkSgT12cmkT2AIZ21AU3hf7 VK0n+PJr1MYXLxkHCqJUUYTc0aWsVtsp/FK/SLw5ilzh66ifmPY1suFmC2vacjl2Fuvr f8mU/vTPEY1Z9fT+yS1ecPmn9ZZUwmqIPmNCjcEPTXthfRWvlXw0VWzsskmRg965XMoG fMC+A54aUTzueC8VtHVomg7x5f+JxA6ykBJRqR1VS15AXlwQFsE+n/yDVZO7m1jVSXdV Hcef68ChD9TR7uPg3q1xSy1+hWPLvL0CWncOiFAFteW/Sd4a9Wg0i8w3oKLT3I6O5qqw zWQA==
X-Gm-Message-State: ABuFfogsAZUqrFyz9JpWzvhABTG6XX9Wiemsapvqsu27zxG68k8imuJ6 ozlFUmVi5Mv+2ThPXkW7nyEzcvoN
X-Google-Smtp-Source: ACcGV63gcUMikUu9ycJr457vR1KW1wLrJF8SMA9H1nCkrimEvH4FKcJ0sp0MFJxqbYnIRSLvb0bPQg==
X-Received: by 2002:ac8:f06:: with SMTP id e6-v6mr9758242qtk.262.1538085546861; Thu, 27 Sep 2018 14:59:06 -0700 (PDT)
Received: from ?IPv6:2600:1017:b80a:35ab:b005:d76c:686c:8bb8? ([2600:1017:b80a:35ab:b005:d76c:686c:8bb8]) by smtp.gmail.com with ESMTPSA id t28-v6sm1935564qtc.67.2018.09.27.14.59.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 27 Sep 2018 14:59:05 -0700 (PDT)
Content-Type: multipart/alternative; boundary="Apple-Mail-52268FC4-2847-4541-B7F3-0B99FFC88F0A"
Mime-Version: 1.0 (1.0)
From: Bret Jordan <jordan.ietf@gmail.com>
X-Mailer: iPhone Mail (15G77)
In-Reply-To: <MMXP123MB0847E55749751AA12D26DBFAD7150@MMXP123MB0847.GBRP123.PROD.OUTLOOK.COM>
Date: Thu, 27 Sep 2018 17:59:04 -0400
Cc: "smart@irtf.org" <smart@irtf.org>
Content-Transfer-Encoding: 7bit
Message-Id: <B681C76A-CE1F-4C4B-8389-658A01D0E77E@gmail.com>
References: <MMXP123MB0847E55749751AA12D26DBFAD7150@MMXP123MB0847.GBRP123.PROD.OUTLOOK.COM>
To: Kirsty P <Kirsty.p=40ncsc.gov.uk@dmarc.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/smart/FfE00xPtTFfSfBZEduio2CPsnF8>
Subject: Re: [Smart] Draft Charter For SMART Proposed RG
X-BeenThere: smart@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Stopping Malware And Researching Threats <smart.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/smart>, <mailto:smart-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/smart/>
List-Post: <mailto:smart@irtf.org>
List-Help: <mailto:smart-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/smart>, <mailto:smart-request@irtf.org?subject=subscribe>
X-List-Received-Date: Thu, 27 Sep 2018 21:59:12 -0000

Kristy and RG ET al.,

I think this charter sounds great and covers most of the areas we need to address in the short-term.  Great work. The deliverables outlined so far will greatly assist the community for years to come.

Bret 

Sent from my Commodore 128D

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

> On Sep 26, 2018, at 9:36 AM, Kirsty P <Kirsty.p=40ncsc.gov.uk@dmarc.ietf.org> wrote:
> 
> This is the draft charter for the Proposed Research Group: Stopping Malware and Researching Threats (SMART).
> 
> Your thoughts and suggestions are very welcome - please post to the list with your comments! - and keep an eye out for a list of proposed research problems soon...
> 
> 
> 
> 
> 
> # Stopping Malware and Researching Threats (SMART) Proposed RG - Draft Charter
> 
> 
> ## BACKGROUND
> 
> The Stopping Malware and Researching Threats Research Group (or SMART RG) will investigate how cyber attack defence requirements can be met in a world of encrypted data. It will research the effects, both positive and negative, of existing, proposed and newly published protocols and Internet standards on attack defence. It will gather evidence from information security practitioners on methods used to defend against attacks and make this available to protocol designers. As a result, designers, implementers and users of new protocols will be better informed about the possible impact on attack prevention and mitigation.
> 
> 
> 
> The IRTF is in a unique position to provide this research and evidence to the IETF. This research group aims to describe the effect of protocol changes where relevant and stimulate methodical research into attack defence methods for new protocols. Protocols are already rigorously assessed for their security properties, but ensuring attack defence methods are also rigorously assessed alongside protocol design changes would provide a fuller understanding of the value for such change, enabling a better engineered Internet.
> 
> 
> 
> ## AIMS
> 
> This research group has these major aims:
> 
> To bring evidence on attacks and the methods that are or could be used to defend against them to the attention of the IETF.
> To highlight the attack mitigation impact, both positive and negative, of new protocols and updates to existing protocols.
> To stimulate and generate research into attack defence methods for new protocols, and to increase awareness in the technical community of new and existing methodology for detecting and mitigating attacks.
> To provide systematic guidance to designers of new protocols as to what attack defence considerations to review, and to inform implementers by default about the effects of new protocols on attack defence.
> To produce problem statements that describe key issues in cyber security for the group to research (initial research project ideas are listed below).
>  
> 
> ## OUTPUTS
> 
> The research group plans to create documents that may include, but are not limited to, the following:
> 
> Internet drafts, some of which may be published through the IRTF RFC stream. These will include outline problem statements, use cases, case studies and convey research results. They will be written for use by other groups to inform protocol design.
> Policy papers, for in-depth analysis and discussion of the relationship between attack defence and the Internet architecture and protocols.
> Research papers, containing quantitative evidence of actual attacks and the success of defence methods against them, as well as theoretical and formal analyses of the implications of proposed protocols on attack defence. Defence methods will be analyzed to determine if there are ways to optimize in order to better scale attack detection and mitigation.
> Survey of current and historic IETF material to discover existing deliberations on attack defence.
> Best practice papers, describing methodologies that will enable researchers to conduct experiments and report results that are useful to designers of protocols. These methodologies will give descriptions of the effects of protocols on attack defence backed by evidence from real-world attacks, laboratory-based testing and theoretical analysis of protocols, through the analysis lens of attacks, detection methods and systematic assessment methodologies.
> Within the first year, the research group aims to:
> 
> Survey existing attack detection methods and determine the relative effectiveness of these methods against different attack defence threats (e.g. phishing, DDoS, spambots, C&C, endpoint malware)
> Publish case studies of historical attacks and make recommendations where attacks could have been stopped more quickly, or even prevented
> Publish an Informational RFC, titled: "Important Attack Defence Considerations for Protocol Design and Deployment".
> 
> 
> ## MEMBERSHIP
> 
> Membership is open to any interested parties who intend to remain current with the published documents and mailing list issues. Wide participation from industry, academia, government and non-profits is encouraged.
> 
> 
> 
> 
> 
> 
> 
> 
> 
> This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to ncscinfoleg@ncsc.gov.uk
> -- 
> Smart mailing list
> Smart@irtf.org
> https://www.irtf.org/mailman/listinfo/smart