Re: [Smart] Draft Charter For SMART Proposed RG

[Bret Jordan <[e-mail]>]

Kristy,

I hope the work products from this research group can impact and influence many working groups, technical committees, and study groups across various SDOs. As we move forward I think we need to ensure the digestibility of the content we produce and ensure that we can have maximum impact across the entire eco-system. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Sep 28, 2018, at 11:45 AM, Kirsty P <[e-mail]> wrote:
> 
> Bret,
> 
> Yes - we are! Kathleen and I are planning a initial meeting in Bangkok at IETF103 to discuss the draft charter and discuss initial problems that the group might research. This meeting won't be one of our three meetings that we are allocated as a Proposed RG - it's just for planning purposes. When we have a date and time for this meeting, I'll post on the list.
> 
> I thought it's just worth pointing out here that, though CACAO and SMART have very similar end goals (of protecting users and improving defence against attacks), I really hope that the output from this RG will benefit many other IETF working groups too - such as MILE, DOTS and SACM. In future, these WGs and CACAO might receive output from the research work in a similar way to how the CFRG assists other IETF groups - different work items, but with coordination between our efforts to do much more than we could do alone. We could discuss in Bangkok how best to do such a co-ordination.
> 
> Kirsty
> 
> 
> From: Bret Jordan <[e-mail] <mailto:[e-mail]>>
> Sent: 28 September 2018 16:16
> To: Kirsty P
> Cc: [e-mail] <mailto:[e-mail]>
> Subject: Re: [Smart] Draft Charter For SMART Proposed RG
>  
> Kristy, et al.,
> 
> Are we planning on a meet up in Bangkok?  This work along with the work in the CACAO project could really help protect end users and keep them safe. 
> 
> Bret 
> 
> Sent from my Commodore 128D
> 
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
> 
> On Sep 28, 2018, at 7:24 AM, Kirsty P <[e-mail] <mailto:[e-mail]>> wrote:
> 
>> Bret,
>> 
>> Thanks for your encouraging words! If you have ideas for more topics that should be covered in the short-term, please feel free to share with the list.
>> 
>> Kirsty
>> 
>> From: Bret Jordan <[e-mail] <mailto:[e-mail]>>
>> Sent: 27 September 2018 22:59:04
>> To: Kirsty P
>> Cc: [e-mail] <mailto:[e-mail]>
>> Subject: Re: [Smart] Draft Charter For SMART Proposed RG
>>  
>> Kristy and RG ET al.,
>> 
>> I think this charter sounds great and covers most of the areas we need to address in the short-term.  Great work. The deliverables outlined so far will greatly assist the community for years to come.
>> 
>> Bret 
>> 
>> Sent from my Commodore 128D
>> 
>> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
>> 
>> On Sep 26, 2018, at 9:36 AM, Kirsty P <Kirsty.p=[e-mail] <mailto:Kirsty.p=[e-mail]>> wrote:
>> 
>>> This is the draft charter for the Proposed Research Group: Stopping Malware and Researching Threats (SMART).
>>> Your thoughts and suggestions are very welcome - please post to the list with your comments! - and keep an eye out for a list of proposed research problems soon...
>>> 
>>> 
>>> # Stopping Malware and Researching Threats (SMART) Proposed RG - Draft Charter
>>> 
>>> ## BACKGROUND
>>> The Stopping Malware and Researching Threats Research Group (or SMART RG) will investigate how cyber attack defence requirements can be met in a world of encrypted data. It will research the effects, both positive and negative, of existing, proposed and newly published protocols and Internet standards on attack defence. It will gather evidence from information security practitioners on methods used to defend against attacks and make this available to protocol designers. As a result, designers, implementers and users of new protocols will be better informed about the possible impact on attack prevention and mitigation.
>>> 
>>> The IRTF is in a unique position to provide this research and evidence to the IETF. This research group aims to describe the effect of protocol changes where relevant and stimulate methodical research into attack defence methods for new protocols. Protocols are already rigorously assessed for their security properties, but ensuring attack defence methods are also rigorously assessed alongside protocol design changes would provide a fuller understanding of the value for such change, enabling a better engineered Internet. 
>>> 
>>> 
>>> ## AIMS
>>> This research group has these major aims:
>>> To bring evidence on attacks and the methods that are or could be used to defend against them to the attention of the IETF.
>>> To highlight the attack mitigation impact, both positive and negative, of new protocols and updates to existing protocols. 
>>> To stimulate and generate research into attack defence methods for new protocols, and to increase awareness in the technical community of new and existing methodology for detecting and mitigating attacks. 
>>> To provide systematic guidance to designers of new protocols as to what attack defence considerations to review, and to inform implementers by default about the effects of new protocols on attack defence.
>>> To produce problem statements that describe key issues in cyber security for the group to research (initial research project ideas are listed below).
>>>  
>>> ## OUTPUTS
>>> The research group plans to create documents that may include, but are not limited to, the following:
>>> Internet drafts, some of which may be published through the IRTF RFC stream. These will include outline problem statements, use cases, case studies and convey research results. They will be written for use by other groups to inform protocol design. 
>>> Policy papers, for in-depth analysis and discussion of the relationship between attack defence and the Internet architecture and protocols.
>>> Research papers, containing quantitative evidence of actual attacks and the success of defence methods against them, as well as theoretical and formal analyses of the implications of proposed protocols on attack defence. Defence methods will be analyzed to determine if there are ways to optimize in order to better scale attack detection and mitigation.
>>> Survey of current and historic IETF material to discover existing deliberations on attack defence.
>>> Best practice papers, describing methodologies that will enable researchers to conduct experiments and report results that are useful to designers of protocols. These methodologies will give descriptions of the effects of protocols on attack defence backed by evidence from real-world attacks, laboratory-based testing and theoretical analysis of protocols, through the analysis lens of attacks, detection methods and systematic assessment methodologies.
>>> Within the first year, the research group aims to:
>>> Survey existing attack detection methods and determine the relative effectiveness of these methods against different attack defence threats (e.g. phishing, DDoS, spambots, C&C, endpoint malware)
>>> Publish case studies of historical attacks and make recommendations where attacks could have been stopped more quickly, or even prevented
>>> Publish an Informational RFC, titled: "Important Attack Defence Considerations for Protocol Design and Deployment".
>>> 
>>> ## MEMBERSHIP
>>> Membership is open to any interested parties who intend to remain current with the published documents and mailing list issues. Wide participation from industry, academia, government and non-profits is encouraged.
>>> 
>>> 
>>> 
>>> 
>>> This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries [e-mail] <mailto:[e-mail]>-- 
>>> Smart mailing list
>>> [e-mail] <mailto:[e-mail]>
>>> https://www.irtf.org/mailman/listinfo/smart <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fsmart&data=02%7C01%7CKirsty.p%40ncsc.gov.uk%7C8f19ccb106cc4dcd7f8608d625557372%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636737446273966857&sdata=%2B8RA4ZvcMz0nnNKCPR2ez%2BSQ02fc8ocWHMXkOSt0x58%3D&reserved=0>
>> This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries [e-mail] <mailto:[e-mail]>This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail] <mailto:[e-mail]>