[Smart] Future of SMART

[Kirsty P <[e-mail]>]

I'm sorry to say that SMART is not holding a formal meeting at IETF 105 in Montreal; the charter we
proposed was not viewed as defining a programme of research activity suitable for the IRTF. Despite
the attendance and interest at SMART's previous meeting at IETF 104 in Prague*, acknowledgement that
the IETF’s current security threat model is outdated and under-researched, and contributions of
new academic research on SMART topics, it has not been possible to secure a formal meeting at IETF
105 as a proposed IRTF RG.

We plan to arrange a side-meeting in Montreal to review the drafts currently in development and
discuss the way forward.  Work on the CLESS draft and research projects from CARIS2 will continue
and the shape they take may guide the decision for a way forward.

We will continue to welcome the knowledge and experience of cyber security experts on this list and
encourage these experts to attend IETF and IRTF meetings because their expertise is not commonplace
there.  This means both assisting with developing drafts towards the goals of SMART and outcomes
from CARIS2, but also integrating into working and research groups to assist with security
improvements in developing work. For those who are already regular participants in the IRTF, we hope
that you will welcome newcomers who are experts in their own field and learn from what they
contribute. We encourage experts to post individual drafts on the topic of detecting and mitigating
cyber attack threats, and where these drafts have no natural home in the IETF (and struggle to find
one), to cross-post to SMART. SMART and its base will still aim to bring the cyber defence viewpoint
and expertise into IETF groups more consistently.

Finally, a minor success. When I (Kirsty) first attended an IETF meeting, one concerning security
aspect that stood out for me was the IETF view of the Internet threat model, which bizarrely doesn't
major on the vast scale and variety of cyber attacks we see today. Now there are two drafts
discussing this threat model and its need to be updated: draft-arkko-arch-internet-threat-model and
draft-farrell-etm. Both drafts start a needed analysis of Internet security, which will need to be
supported by robust research. Although the IRTF will not presently support the creation of a RG to
stimulate research in this area, the SMART non-working group mailing list can still be a place to
bring and share evidence on protocol-enabled attacks.

Thank you to everyone who continues to support improving cyber defence on the Internet. We hope that
SMART has started enough conversations that, in future, every person who designs a part of the
Internet will have a solid knowledge of attack defence. Ultimately, however SMART work happens and
whoever leads the effort, the need to improve security and reduce all types of attacks (and not
create new ones!) should be the most important priority for the people who design the Internet.

Kirsty & Kathleen


*We were the 10th most attended session of the week, with 150 people at the meeting and roughly half
of the room willing to work on these topics.
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail]