Subject: [saag] SMART summary

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 26 Mar 2019 07:10:55 -0400

Stopping Malware And Researching Threats (SMART) met Monday afternoon as an
IAB Session, which aims to be an IRTF research group.

SMART met on Monday to discuss the problem statement and some areas for
research possible for the effort. A brief review of the Coordinating Attack
Response at Internet Scale (CARIS) 2 workshop was provided.  A full meeting
report will be forthcoming.

Several researchers and industry representatives presented.  Talks included:
Malicious Uses of Evasive Communications and Threats to Privacy (David
McGrew)
   Highlighted questions and areas of research for SMART.  Showed multiple
views
   into work focused on privacy. Many protocols in the IETF are designed
for
   benign uses but can be used in a malicious way. Attacks lead to data
breaches
   and a negative impact on privacy.
Threat Landscape Report (Arnaud Taddei)
   Reviewed statistics from the incident responder viewpoint.  Some metrics
   will be further clarified on the list.  Understanding the threat
landscape helps to
   prioritize efforts based on trends.
Testing for the good of the internet (Simon Edwards)
   Discussed testing of vendor products and taking the full attack chain
into
   consideration for detection.  Talked about the difficulties with testing
   samples due to bias with available samples but described the methodology
of
   testing security against a full attack chain.
BGP hijacking (Töma Gavrichenkov)
   Multiple drafts exist and are in review for BGP hijacking solutions
   (other BGP problems exist and there is a possible area of research to
explore
   and provide guidance).  Should SMART play a role in providing guidance to
   IETF draft proposals from an attack defence perspective?
CLESS draft on endpoint security (Arnaud Taddei)
   The CLESS draft surveys the end point capabilities and limitations for
one set of
   end points, others expected to be added.  This draft is focused on what
can be
   done at the end point, for a full understanding of what can be done on
the end
   point, and therefore what must be done in the protocol. This is needed
as security
   capabilities are expected to shift to the end point with more end-to-end
   encryption.  Contributions were requested on this early draft.
One Snake (Ian Levy, NCSC)
   Highlighted numerous problems for the information security professional,
   the opportunities for research, measurement, and advancement in this
space and
   why a group like SMART is needed.

Room was surveyed to determine interest in contributing or reviewing work.
About half the room raised hands.  Scope needs to be determined and hand
offs to the IETF Security Area are likely depending on the work that comes
in.
Contributions are welcome.
There were about 150 people that signed the blue sheets, room seemed packed
a bit more.

-- 

Best regards,
Kathleen & Kirsty

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 26 Mar 2019 12:04:58 +0000

Hiya,

> offs to the IETF Security Area are likely depending on the work that comes

I think it was a bit of a pity that the room weren't asked about
concerns with this work going forward. (If you asked that and I
missed it, apologies;-) Given it wasn't an IETF BoF  that's ok,
but were this proposed as IETF work, I would have concerns. As
a potential RG, I also have (a non-identical set of) concerns.

I guess that discussion as to how to take this forward will give
a chance for such concerns to be raised and discussed, so not asking
that we try do that here/now.

S.

---

From: Kirsty P <[email-masked]>
Date: Wed, 27 Mar 2019 16:27:43 +0000

Hi Stephen,

Thanks for your message. Sorry we ran very tight on time and tried to make it clear that we'd stay until they kicked us out to clear the line, and be in the bar afterwards for more questions. The session wasn't quite a proposed RG, so there's of course plenty of time for this discussion. In the interest of transparency, feel free to start the discussion on SMART's mailing list with your questions or concerns about the group. The concern you raised at the meeting (about some of the work taking a long time) was noted and will be discussed as we move forward. If you have more concerns that you would prefer to chat in person on, let's meet up and discuss them sometime this week.

Kirsty

________________________________
From: saag <[email-masked]> on behalf of Stephen Farrell <[email-masked]>
Sent: 26 March 2019 12:04
To: Kathleen Moriarty; [email-masked]
Subject: Re: [saag] SMART summary

Hiya,

S.
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 27 Mar 2019 22:55:03 +0000

Hiya,

On 27/03/2019 16:27, Kirsty P wrote:
> Hi Stephen,
> 
> Thanks for your message. Sorry we ran very tight on time and tried to
> make it clear that we'd stay until they kicked us out to clear the
> line, and be in the bar afterwards for more questions. The session
> wasn't quite a proposed RG, so there's of course plenty of time for
> this discussion. 

Agreed. Nonetheless, it's not a bad plan to take advantage of the
folks being in a room to see who has concerns - trying to take the
temperature of a room is otherwise fraught as we often end up only
roughly measuring one side of a question.

> In the interest of transparency, feel free to start
> the discussion on SMART's mailing list with your questions or
> concerns about the group. The concern you raised at the meeting
> (about some of the work taking a long time) was noted and will be
> discussed as we move forward. If you have more concerns that you
> would prefer to chat in person on, let's meet up and discuss them
> sometime this week.

I do have more substantive concerns yes, and am happy to chat
about those on the smart list. I'll try send a mail on that soon
but at the highest level I'm not convinced that the proposed RG
will actually get the input required for it to be effective,
given the tensions between keeping attack details confidential
and our need to design protocols based on openly available
information.

Cheers,
Stephen F(arrell).

> 
> Kirsty
> 
> ________________________________ From: saag <[email-masked]>
> on behalf of Stephen Farrell <[email-masked]> Sent: 26
> March 2019 12:04 To: Kathleen Moriarty; [email-masked] Subject: Re:
> [saag] SMART summary
> 
> 
> Hiya,
> 
>> Room was surveyed to determine interest in contributing or
>> reviewing work. About half the room raised hands.  Scope needs to
>> be determined and hand offs to the IETF Security Area are likely
>> depending on the work that comes in.
> 
> missed it, apologies;-) Given it wasn't an IETF BoF  that's ok, but
> were this proposed as IETF work, I would have concerns. As a
> potential RG, I also have (a non-identical set of) concerns.
> 
> I guess that discussion as to how to take this forward will give a
> chance for such concerns to be raised and discussed, so not asking 
> S. This information is exempt under the Freedom of Information Act
> 2000 (FOIA) and may be exempt under other UK information legislation.
> Refer any FOIA queries to [email-masked]
>