Re: [Smart] Draft Charter For SMART Proposed RG

Suresh Ramasubramanian <ops.lists@gmail.com> Fri, 28 September 2018 23:55 UTC

Return-Path: <ops.lists@gmail.com>
X-Original-To: smart@ietfa.amsl.com
Delivered-To: smart@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62970130DFC for <smart@ietfa.amsl.com>; Fri, 28 Sep 2018 16:55:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S0pHGb1JYOMm for <smart@ietfa.amsl.com>; Fri, 28 Sep 2018 16:55:46 -0700 (PDT)
Received: from mail-pg1-x530.google.com (mail-pg1-x530.google.com [IPv6:2607:f8b0:4864:20::530]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEDCB130DBE for <smart@irtf.org>; Fri, 28 Sep 2018 16:55:45 -0700 (PDT)
Received: by mail-pg1-x530.google.com with SMTP id b129-v6so5482033pga.13 for <smart@irtf.org>; Fri, 28 Sep 2018 16:55:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=j7OrSOx8jkIjK3p6VkJeZDpC3VqEdWKu4P9bMe1SY2w=; b=stlqzFN5oz4xAz6lUtxkqUrbVy55ngGN9OYx9NHfhEPbcNOKEA2/3HfY0QSJkW+vMR FlUX14EmEOE0t2RxA7xRfq/S+UYc0ZUl7QI8kOtgDw1XDTWuMao8SKIGXFTvuB4f6lSr X7AwNqBkXbZrjKia8PD8vv+VT4mSQ1sq0sa2eoqWCaencmPI8OLxBnQxbSnue8Si9cf/ WX3TU8iMXFEtzAZK85osgHYJADp18ZDFgLRJ3508qLOrnHQT8BojZyOj73CC0Q8/8Uo+ tybnzoMRG/GiWuqcrW61wScudDwaKtjl3H66XW7yEihk7PKqkkoM7QV2MQB0gLZHyNjr JsKg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=j7OrSOx8jkIjK3p6VkJeZDpC3VqEdWKu4P9bMe1SY2w=; b=qlOEJu1ZTH34I8wfnPzfrfUbzggW0+1oNiE8yQKBzDPxAYHeyipSSHsnC+b4VM7JFx e14BHQe6VX1MSY8Gxd8beUcsd62tk6cjwcGXfYrdfjSVuodSIlZEUHWt2ZDpHTq2ktQj O8WiG+wa0Ldb8tZLV1XmUnQamXJksdvoDf60ssribDzVwmSavFDV3di/0Brlw27smPQj MNiuNrMSs3zPpj8QPCcfY+2xFV3zAwRjczspsc6UBMFHM71FC7Q+VLxxBA7dPYCkTSNN R32eJ428efW8eXRGs7oPOQHOj5N+Wv2bEXx0gHbRryat0xdd97sd6aU56+z8QauQe2xW 61Zw==
X-Gm-Message-State: ABuFfohpoYYkapjm6aDW/sQiD0+GXAN6buS745SfLEg11YeIYgYxTsP+ y6vf/Q1IOAYTYmVdGCTMZmbwoKAL
X-Google-Smtp-Source: ACcGV63ytNBh/IUbXJ+Ge0KCxDYp54aGwk07YZR666cpDeoUp7iRmhmUmdqfOJkCzcYBaaqnXl/AFQ==
X-Received: by 2002:a17:902:a618:: with SMTP id u24-v6mr818401plq.77.1538178944675; Fri, 28 Sep 2018 16:55:44 -0700 (PDT)
Received: from [100.112.97.115] ([27.62.6.155]) by smtp.gmail.com with ESMTPSA id y85-v6sm11170801pfa.170.2018.09.28.16.55.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 28 Sep 2018 16:55:42 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (1.0)
From: Suresh Ramasubramanian <ops.lists@gmail.com>
X-Mailer: iPhone Mail (16B5059d)
In-Reply-To: <DE9FC53A-BA02-4F07-B273-EE2271641AA4@gmail.com>
Date: Sat, 29 Sep 2018 05:25:40 +0530
Cc: Stephen Farrell <stephen.farrell@cs.tcd.ie>, "smart@irtf.org" <smart@irtf.org>, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>, "David McGrew (mcgrew)" <mcgrew@cisco.com>, "Kirsty.p=40ncsc.gov.uk@dmarc.ietf.org" <Kirsty.p=40ncsc.gov.uk@dmarc.ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <DE711D52-17F4-4039-B5E7-871515CBACD8@gmail.com>
References: <MMXP123MB0847E55749751AA12D26DBFAD7150@MMXP123MB0847.GBRP123.PROD.OUTLOOK.COM> <B681C76A-CE1F-4C4B-8389-658A01D0E77E@gmail.com> <064F1F53-248C-4BBD-8C2D-59A4F71874DB@cisco.com> <CAHbuEH5hgU0dGn=bcz8zA9Vr3S01W1UpsBH_EiBcD6pzDHLthw@mail.gmail.com> <AFBF879B-7638-4B83-B986-FC12C44753E3@cisco.com> <1C0FF090-9AE0-4D99-8E4D-57893643785C@gmail.com> <b1d39c5d-4d49-303d-559d-f365d42dd8bc@cs.tcd.ie> <DE9FC53A-BA02-4F07-B273-EE2271641AA4@gmail.com>
To: Bret Jordan <jordan.ietf@gmail.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/smart/w0WBo3CtuTA96W9Ov15pxGkII3Q>
Subject: Re: [Smart] Draft Charter For SMART Proposed RG
X-BeenThere: smart@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Stopping Malware And Researching Threats <smart.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/smart>, <mailto:smart-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/smart/>
List-Post: <mailto:smart@irtf.org>
List-Help: <mailto:smart-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/smart>, <mailto:smart-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 Sep 2018 23:55:48 -0000

May I suggest that this nomenclature discussion be tabled and we go on to examine previous work in this area first so that no wheels are reinvented?  

Or first start with a useful summary of such work and existing approaches?

We already have products in the market from cisco and others that deal with this at a network level examining alternatives to DPI - either look at traffic metadata to fingerprint badness or decrypt and re encrypt data on the fly are two common approaches.

Malware and any other kind of online crime investigation and forensics gets that much harder with bad guys having just as much as or better access to strong encryption and the data anonymization that GDPR provides.

What else?

--srs

> On 29-Sep-2018, at 4:29 AM, Bret Jordan <jordan.ietf@gmail.com> wrote:
> 
> I respectfully disagree that cyber security is a widely-abused marketing term.  I do agree with you that the “Cloud”, “Hybrid-Cloud” etc are just fancy marketing terms..  If we need to sharpen our pencils to provide some definitions, then lets not argue about it, lets just do it. From my stance, Data Security, Information Security and Cyber Security are very different