Subject: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Sun, 26 Mar 2017 22:34:01 +0000

The US Government has been working within the IETF SACM work group to standardize the collection of endpoint configuration and other posture information from enterprise endpoints. Collecting this information is critical to support automation of common network security tasks, including asset, software, vulnerability, and configuration management. Thus far, our efforts have focused primarily on standards to collect information in support of asset, software and vulnerability management use cases, and has worked with other IETF members to determine what data would need to be to be collected, and how that data would be securely communicated across the network. Through such exchanges an organization can know what client endpoints are connected to their network, and if they are vulnerable to attack.

Given the proliferation of attacks against network infrastructure devices, it is clear that the next step in our enterprise security automation effort must be to enable standardized reporting of similar information from network infrastructure devices. With the growing number of Yang models and increased adoption of NETCONF, RESTCONF, and related protocol work, the time is right to work out how these standards can be used to measure the health of network devices. This information will, as in our efforts in SACM for client devices, support asset, software, vulnerability, and configuration management use cases. Standards-based reporting of this information from network infrastructure devices will help network defenders protect against known attacks, and provide the necessary knowledge to detect and mitigate future attacks. 

We would like to start a discussion about how to leverage the existing IETF network management protocols to best address security automation for network infrastructure devices. We would like your ideas on how to best pursue this work, and your insights into network infrastructure security problems that will impact our networks in the future. We are holding a side meeting at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion about how to move forward. We will be meeting in Vevey 4 at the IETF meeting venue.

Here is a summary of the meeting details:

PANIC (Posture Assessment through Network Information Collection) Bar BoF
Wednesday, March 29th, 2017 @ 6:30pm CDT
Swissotel Conference Center - Vevey 4

We look forward to working with you, and hope to see you in Chicago at the PANIC Bar BoF.

Regards,
Dave

David Waltermire
Information Technology Laboratory | Computer Security Division
National Institute of Standards and Technology

---

From: Mahesh Jethanandani <[email-masked]>
Date: Thu, 30 Mar 2017 16:09:28 -0500

David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <[email-masked]> wrote:
> 
> 

Maybe this was discussed in the BoF …

The best way to have a discussion would be to present the proposal in the form of a draft in the NETCONF WG.

> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
[email-masked]

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Thu, 30 Mar 2017 21:38:12 +0000

We plan to write up a description adddessing the problem and

________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <[email-masked]> wrote:
David,

Mahesh Jethanandani
[email-masked]

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Thu, 30 Mar 2017 21:43:38 +0000

Sorry. Clicked send on my phone accidentally.

We plan to write a draft describing the problem and scope of what we want to address. We will share this on the PANIC list and continue the conversation from there. We may want to present ideas in WGs like NETCONF at some time in the future. We will know more once further discussion is had.

Thanks,
Dave

________________________________
On: 30 March 2017 16:38, "Waltermire, David A. (Fed)" <[email-masked]> wrote:
We plan to write up a description adddessing the problem and

Mahesh Jethanandani
[email-masked]

---

From: "Eric Voit (evoit)" <[email-masked]>
Date: Thu, 30 Mar 2017 22:26:36 +0000

Hi David,

I know it is early, but for the secure communication part, have you considered using the YANG Push<https://datatracker.ietf.org/doc/draft-ietf-netconf-yang-push/?include_text=1> work being developed in the NETCONF WG?

With this approach, you can subscribe to state changes within a device's YANG models.  These could be PANIC developed YANG models,  existing YANG models such as IETF-System, IETF-keychain, or some combination.   Then if a hacker inserts new hardware, changes software versions, adds keys, adds users, etc. that state change can be securely pushed to a subscribing where it can be determined whether the change was expected/desired.

Eric
________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <[email-masked]<mailto:[email-masked]>> wrote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <[email-masked]<mailto:[email-masked]>> wrote:
>
>

Maybe this was discussed in the BoF ...

> [email-masked]<mailto:[email-masked]>

Mahesh Jethanandani
[email-masked]<mailto:[email-masked]>

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Fri, 31 Mar 2017 17:55:03 +0000

Is there a  list for PANIC already?
I couldn't find it.

From: mile [mailto:[email-masked]] On Behalf Of Waltermire, David A. (Fed)
Sent: Thursday, March 30, 2017 5:44 PM
To: Mahesh Jethanandani <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Thanks,
Dave

________________________________
On: 30 March 2017 16:38, "Waltermire, David A. (Fed)" <[email-masked]<mailto:[email-masked]>> wrote:
We plan to write up a description adddessing the problem and
________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <[email-masked]<mailto:[email-masked]>> wrote:
David,

Mahesh Jethanandani

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Fri, 31 Mar 2017 21:16:32 +0000

Eric,

We have considered YANG Push as part of PANIC. I have read the draft and I attended your presentation during NETCONF. I think Yang Push is something we should consider as part of the PANIC solution. Do you have an implementation of YANG Push that can be experimented with?

Regards,
Dave

From: Eric Voit (evoit) [mailto:[email-masked]]
Sent: Thursday, March 30, 2017 6:27 PM
To: Waltermire, David A. (Fed) <[email-masked]>; Mahesh Jethanandani <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Hi David,

Eric

Mahesh Jethanandani

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Fri, 31 Mar 2017 21:17:55 +0000

Panos,

We have requested a list to be setup. We will post again with signup info once the list is created.

Thanks,
Dave

From: Panos Kampanakis (pkampana) [mailto:[email-masked]]
Sent: Friday, March 31, 2017 1:55 PM
To: Waltermire, David A. (Fed) <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

From: mile [mailto:[email-masked]] On Behalf Of Waltermire, David A. (Fed)
Sent: Thursday, March 30, 2017 5:44 PM
To: Mahesh Jethanandani <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Thanks,
Dave

Mahesh Jethanandani

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Fri, 31 Mar 2017 21:22:57 +0000

Mahesh,

Submitting a draft to the NETCONF WG might be a path forward. Based on the feedback we received, we are working on a scope draft to focus the discussion around how we can leverage existing work. I have a personal individual stream draft ready and will post it as soon as I can work out an issue with the submission tool.

Regards,
Dave 

> -----Original Message-----
> From: Mahesh Jethanandani [mailto:[email-masked]]
> Sent: Thursday, March 30, 2017 5:09 PM
> Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
> 
> David,
> 
> > The US Government has been working within the IETF SACM work group to
> standardize the collection of endpoint configuration and other posture
> information from enterprise endpoints. Collecting this information is critical
> to support automation of common network security tasks, including asset,
> software, vulnerability, and configuration management. Thus far, our efforts
> have focused primarily on standards to collect information in support of
> asset, software and vulnerability management use cases, and has worked
> with other IETF members to determine what data would need to be to be
> collected, and how that data would be securely communicated across the
> network. Through such exchanges an organization can know what client
> endpoints are connected to their network, and if they are vulnerable to
> attack.
> >
> > Given the proliferation of attacks against network infrastructure devices, it
> is clear that the next step in our enterprise security automation effort must
> be to enable standardized reporting of similar information from network
> infrastructure devices. With the growing number of Yang models and
> increased adoption of NETCONF, RESTCONF, and related protocol work, the
> time is right to work out how these standards can be used to measure the
> health of network devices. This information will, as in our efforts in SACM for
> client devices, support asset, software, vulnerability, and configuration
> management use cases. Standards-based reporting of this information from
> network infrastructure devices will help network defenders protect against
> known attacks, and provide the necessary knowledge to detect and mitigate
> future attacks.
> >
> > We would like to start a discussion about how to leverage the existing IETF
> network management protocols to best address security automation for
> network infrastructure devices. We would like your ideas on how to best
> pursue this work, and your insights into network infrastructure security
> problems that will impact our networks in the future. We are holding a side
> meeting at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a
> discussion about how to move forward. We will be meeting in Vevey 4 at the
> IETF meeting venue.
> 
> > PANIC (Posture Assessment through Network Information Collection) Bar
> > BoF Wednesday, March 29th, 2017 @ 6:30pm CDT Swissotel Conference
> > Center - Vevey 4
> >

---

From: "Eric Voit (evoit)" <[email-masked]>
Date: Fri, 31 Mar 2017 22:30:17 +0000

For experimentation, OpenDaylight has YANG Push code for the both subscriber and publisher.  I can work with you offline to help define a viable testbed.

Eric

From: Waltermire, David A,  March 31, 2017 5:17 PM

Eric,

Regards,
Dave

To: Waltermire, David A. (Fed) <[email-masked]<mailto:[email-masked]>>; Mahesh Jethanandani <[email-masked]<mailto:[email-masked]>>

Hi David,

Eric

Mahesh Jethanandani