Re: [GNAP] Defense protection

Hi Kathleen,

I am not aware of the attacks on SAML and OAuth and would appreciate a link
or two.

I hope we can provide guidance on how GNAP can facilitate Zero Trust
Architecture and believe that includes guidance on how to audit various
things as systems use GNAP protocols to separate concerns among independent
actors.

Count me in for a brainstorming sessio,

- Adrian

On Fri, May 28, 2021 at 3:29 PM Kathleen Moriarty <
kathleen.moriarty.ietf@gmail.com> wrote:

> Hello!
>
> In light of recent attacks against SAML and OAuth, I'd like to see what
> defense mechanisms and detection could be built into the spec.  One example
> would be from the recent SAML attack.  If there was a detection of
> instances of authorization without authentication, the SAML attack used in
> SolarWinds might have been detected sooner.
>
> If you think along the lines of fraud detection, where you detect unusual
> events, there may be some specific to GNAP that could enable early
> detection of abuse, misuse, or exploits.
>
> Are there some planned?  Would people like to brainstorm on this?
> Thanks!
>
>
> --
>
> Best regards,
> Kathleen
> --
> TXAuth mailing list
> TXAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth
>