Re: [Smart] [Secdispatch] New Version Notification for draft-lazanski-smart-users-internet-00.txt

[Bret Jordan <[e-mail]>]

Eliot,

However, many here assume that the endpoint can run security software, that security software is available for all endpoints, or that security software can be updated all at once across an organization/enterprise. Other also assume that if you just patched your software, you would be safe.  These assumptions are horribly wrong and goes to show the fundamental lack of understanding.

The reason I called them out the way I did was I was trying to be explicitly clear on where the attack was coming from and what role the endpoint had in that attack. I did not want to assume that everyone understood the attack surface and threat model. 

So a client may initiate the connection to a compromised site or content. This is a very common case for initial infection.  However, once the threat actor is in the network, they often move laterally through the network and compromise machines where the attack is not initiated from the victim endpoint, but rather initiated from a compromised endpoint. So what you can see and do to protect your network changes. 

All of this is pretty basic network/cyber security 101 stuff.  What the IETF needs to know is how SoC analysts need and require sensors on the network, network log data, and DNS data to help identify these attacks and find them. We always had a saying when I was on the other side of the fence, “operating systems and software can always be made to lie, but the network never does..” Network analysis and network forensics is a critical part of the day-to-day analysis in a SoC.  This is often how intrusion sets are detected and threat actors behavior in the network is tracked.  This is not about selling product as some believe. This is about organizations and enterprises protecting their systems, networks, and data.  

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Jul 15, 2019, at 2:01 AM, Eliot Lear <[e-mail]> wrote:
> 
> Hi Bret,
> 
>> 
>> 1) Is the content or content provider that the user is going to compromised and trying to attack the endpoint?
>> 2) Is the content provider that the user is going to a stage 2 delivery site?
>> 3) Is the content provider that the user is going to the location for outbound malicious content (data exfiltration, CnC traffic)
>> 4) Is the content provider that the user is going to adversely tracking and monitoring everything the end client does, aka active surveillance versus passive surveillance?
>> 5) Is the remote site that the user did not go to attack the end point.
> 
> While we tend to think of endpoints as being equivalent in class, in which case your use of the term "content provider” would be somewhat redundant, from a scaling perspective I am far more concerned about unwatched unmanaged endpoints than I am about content services.  And again, to me it is a matter of what problems I think might be tractable.
> 
> Eliot