Subject: Re: [Smart] Future of SMART

From: "Diego R. Lopez" <[email-masked]>
Date: Fri, 7 Jun 2019 17:52:15 +0000

Hi Kirsty,

Sorry to hear that SMART was not able to break the cybersecurity “glass ceiling” that has been part of the IETF idiosyncrasy for so long time. Looking at the attendance in Prague and the opinions I heard from many people there I had some hope this time would be… Count on me for any further steps.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
https://www.linkedin.com/in/dr2lopez/

e-mail: [email-masked]<mailto:[email-masked]>
Tel:         +34 913 129 041
Mobile:  +34 682 051 091
----------------------------------

On 06/06/2019, 08:24, "Smart on behalf of Kirsty P" <[email-masked]<mailto:[email-masked]> on behalf of Kirsty.p=[email-masked]<mailto:Kirsty.p=[email-masked]>> wrote:

I'm sorry to say that SMART is not holding a formal meeting at IETF 105 in Montreal; the charter we
proposed was not viewed as defining a programme of research activity suitable for the IRTF. Despite
the attendance and interest at SMART's previous meeting at IETF 104 in Prague*, acknowledgement that
the IETF’s current security threat model is outdated and under-researched, and contributions of
new academic research on SMART topics, it has not been possible to secure a formal meeting at IETF
105 as a proposed IRTF RG.

We plan to arrange a side-meeting in Montreal to review the drafts currently in development and
discuss the way forward.  Work on the CLESS draft and research projects from CARIS2 will continue
and the shape they take may guide the decision for a way forward.

We will continue to welcome the knowledge and experience of cyber security experts on this list and
encourage these experts to attend IETF and IRTF meetings because their expertise is not commonplace
there.  This means both assisting with developing drafts towards the goals of SMART and outcomes
from CARIS2, but also integrating into working and research groups to assist with security
improvements in developing work. For those who are already regular participants in the IRTF, we hope
that you will welcome newcomers who are experts in their own field and learn from what they
contribute. We encourage experts to post individual drafts on the topic of detecting and mitigating
cyber attack threats, and where these drafts have no natural home in the IETF (and struggle to find
one), to cross-post to SMART. SMART and its base will still aim to bring the cyber defence viewpoint
and expertise into IETF groups more consistently.

Finally, a minor success. When I (Kirsty) first attended an IETF meeting, one concerning security
aspect that stood out for me was the IETF view of the Internet threat model, which bizarrely doesn't
major on the vast scale and variety of cyber attacks we see today. Now there are two drafts
discussing this threat model and its need to be updated: draft-arkko-arch-internet-threat-model and
draft-farrell-etm. Both drafts start a needed analysis of Internet security, which will need to be
supported by robust research. Although the IRTF will not presently support the creation of a RG to
stimulate research in this area, the SMART non-working group mailing list can still be a place to
bring and share evidence on protocol-enabled attacks.

Thank you to everyone who continues to support improving cyber defence on the Internet. We hope that
SMART has started enough conversations that, in future, every person who designs a part of the
Internet will have a solid knowledge of attack defence. Ultimately, however SMART work happens and
whoever leads the effort, the need to improve security and reduce all types of attacks (and not
create new ones!) should be the most important priority for the people who design the Internet.

Kirsty & Kathleen

*We were the 10th most attended session of the week, with 150 people at the meeting and roughly half
of the room willing to work on these topics.
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: "Arnaud.Taddei.IETF" <[email-masked]>
Date: Sat, 08 Jun 2019 07:31:21 +0000

Dear Kirsty and Kathleen, no need to say how shocked I was when I realised the news. This is just not only un-understandable, but simply say, this is outrageous. I would like here to recognise your extreme persistency, professionalism, guidance, neutrality, consensus oriented people and field knowledgeable people with now 2 IRTF leaders who obviously did and are doing all what they can to make us fail.

I would like to know exactly WHO took this decision, which people behind, an exact rationale and clarity on WHY this is a diktat from a group of people and WHY the community has no say and what are the procedures here as unfortunately I don't know the process.

Looking at another forming group in parallel to ours in IETF which is about Security which is suffering the same problem, I strongly backup Diego here and would go much more clear text as it is very clear that the templars of the encryption at IETF are being challenged by the security community on their land and do NOT accept that encryption != security. In other words if they do NOT write themselves the 10 commandments of IETF by themselves, we are just 'tourists' as I can hear from abject plenaries in Bangkok and elsewhere. I can understand too that there is a significant level of obscure dark matter at play behind the scenes.

25 years ago my boss's boss was Brian Carpenter, my office room neighbour was Tim Berners Lee at CERN, I had the chance to work on IMAP, POP3, SMTP, etc. with Bill Yeager, Mark Crispin, John Myers, Chris Newman, Pete Resnick, Ned Freed and many other fine people doing great engineering work for the community and by community I do not mean 'JUST' the cizitens! All the constituencies of the community including enterprises, governments and others. (BTW if anyone listens, I am very frustrated to not have the time to work on JMAP!)

It is very clear now that if at this level a group of individuals who seem to have an absolute diktat and unbalanced power in the IETF leadership is incapable to accept the debate, then this organization will spiral down as I could hear it is already the case from 2 sessions at the HOT RFC session at Prague. I will reserve myself the possibility to make a specific intervention at the next plenary in Montreal.

This is certainly another serious episode at the worse possible moment for the Internet with geopolitics at play that will lead to a balkanisation on the internet where actually a key nerve in this gordian knot being security.

This is a massive regression for the IETF I am afraid and I will monitor this situation carefully.

Sent with [ProtonMail](https://protonmail.com) Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Friday 7 June 2019 19:52, Diego R. Lopez <[email-masked]> wrote:

> e-mail: [email-masked]
>
> Tel:         +34 913 129 041
>
> Mobile:  +34 682 051 091
>
> On 06/06/2019, 08:24, "Smart on behalf of Kirsty P" <[email-masked] on behalf of Kirsty.p=[email-masked]> wrote:
>
> ---------------------------------------------------------------
>

---

From: "Arnaud.Taddei.IETF" <[email-masked]>
Date: Sat, 08 Jun 2019 07:45:13 +0000

This email is now to reflect on CLESS. I will formalise minutes but need to take a few days off so bare with me.

As announced I proposed to have an open call to discuss the future of CLESS I-D and I prepared slides to support and facilitate this call, see attached (I will look to where to place them in repositories)

The highlights are as below
- 16 people registered and joined and another 9 couldn't make the call but expressed their interest.
- All the proposals were agreed in particular to detach section 5 - Endpoint Model in order to deliver a uniform Attack Surface definition across all endpoints and section 6 - Threat Landscape in order to come over the limits of the MITRE ATT&CK model as 2 separate I-Ds to support CLESS
- We found already one author for the first one as Mark MacFadden and one author for the second one as Simon Edwards and then offline some people asked to join one or the other work
- We discussed several actions (new sections, communication, new production data work, how to incorporate David McGrew's great set of examples on Human Rights attacks, or start an economic section, etc.)
- We believe it will give probably a significant framework for more researchers to join with their specific knowledge on specific 'cells' in the matrix (specific threat landscape
- We heard the shocking news on SMART and discussed for some time that we will seek guidance for how to continue this work in IETF or possibly outside and a few alternatives were expressed
- We (and I) have a number of followup actions as I need to continue specific consultations that are scheduled

So bottom line
- We had a good first call in a good atmosphere with a good group of people
- We are committed to continue
- We have a detailed plan
- We will have at minimum a side meeting in Montreal
- We will discuss our long term future at Montreal and look at ALL alternatives

Again THANK YOU ALL for your support, work and commitment

Hope this helps

Best Regards

---

From: Melinda Shore <[email-masked]>
Date: Sat, 8 Jun 2019 11:42:40 -0800

On 6/7/19 11:45 PM, Arnaud.Taddei.IETF wrote:
> - We heard the shocking news on SMART and discussed for some time that
> we will seek guidance for how to continue this work in IETF or possibly
> outside and a few alternatives were expressed

Hello, Arnaud:

<semi-hatted>
This may seem like splitting hairs but it really is not:
SMART was being proposed in the IRTF, not the IETF.  The
IETF and IRTF are different bodies, have different working
methods and different publication processes.  The IRTF
does not publish standards and what documents may be published
are not IETF consensus document, charters are wider and
more relaxed and tend not to include specific deliverables
(and the flip side of that - they may rattle on for years
looking at general problems in an area of inquiry, rather
than being terminated when their deliverables are done),
are specifically research-oriented rather than engineering-
oriented, and so on.  I've been concerned that there's been
growing confusion about that as RGs are now meeting
pretty regularly at IETF meetings.

At any rate, this is an important distinction and one to keep
in mind as interested parties try to decide on what comes next
with respect to SMART.

Melinda

-- 
Melinda Shore
[email-masked]

Software longa, hardware brevis

---

From: Colin Perkins <[email-masked]>
Date: Sat, 8 Jun 2019 23:16:53 +0100

> On 8 Jun 2019, at 20:42, Melinda Shore <[email-masked]> wrote:
> 

Thanks, Melinda. This is an important point. 

Colin

-- 
Colin Perkins
https://csperkins.org/

---

From: "Arnaud.Taddei.IETF" <[email-masked]>
Date: Sun, 09 Jun 2019 16:51:08 +0000

Hi Melinda I appreciate and I DO make the difference but at the end of the day the core of the problem of the arbitrary non acceptation of the contributions from security pure players lies in the hands of the same group of religious Templar’s who are sending us in the wrong direction at any cost!

Sent from ProtonMail Mobile

Le sam., juin 8, 2019 à 21:42, Melinda Shore <[email-masked]> a écrit :

> Smart mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/smart

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 9 Jun 2019 21:02:15 -0400

Hello,

I think the best path forward is to continue to build the work as planned.  There’s a set of research ideas that came out of CARIS and the CLESS draft.  There’s other work from a university proposal too.  Let’s see how it looks when further along to see if it’s more aligned with research in the IRTF or a better fit for the IETF.

Stepping back may help, then coming back forward with drafts.

There’s some perception I’ve heard that SMART was interested to weaken TLS, which I would not have supported and feel like it was an unjustified excuse to kill the effort... Therefore, coming back with a solid set of drafts toward the intent may help.  The community that detects and responds to incidents has to completely change how things are being done, hence the need for research and it won’t take long to show that more clearly.

Regards,
Kathleen 

Sent from my mobile device

> On Jun 9, 2019, at 12:51 PM, Arnaud.Taddei.IETF <Arnaud.Taddei.IETF=[email-masked]> wrote:
>

---

From: Lars Eggert <[email-masked]>
Date: Mon, 10 Jun 2019 09:08:07 +0300

Hi,

> Hi Melinda I appreciate and I DO make the difference but at the end of the day the core of the problem of the arbitrary non acceptation of the contributions from security pure players lies in the h…

I'm sorry, but this subjective summary illustrates that you in fact *don't* make the difference.

When SMART was targeted to be an IETF effort, it was reviewed and engaged with on that basis, and the Area Directors of the targeted area together with the rest of the IESG decided to not take it further. Usually, they base these decisions on reviewing the discussion of the proposal among the broader interested community.

Afterwards, SMART changed tracks and intended to become an IRTF research group. That is a *very* different kind of undertaking, with consequently different review and decision processes. I was not part of the decision process here, but my review comments probably would have summarized as something like "failed IETF proposal hastily trying to recast itself as research". Note that this is not saying that there isn't worthwhile research to be done in this space, or that the IRTF shouldn't (eventually) do something in this space - but this *particular* proposal for the IRTF was clearly not anywhere near the bar.

Lars

PS: I understand you must be frustrated, but broad overstatements and name-calling are unlikely to be helpful to your effort.

---

From: Melinda Shore <[email-masked]>
Date: Sun, 9 Jun 2019 22:23:00 -0800

On 6/9/19 10:08 PM, Lars Eggert wrote:
> When SMART was targeted to be an IETF effort, it was reviewed and
> engaged with on that basis, and the Area Directors of the targeted
> area together with the rest of the IESG decided to not take it
> further.

I did not realize that - it helps explain some of the
text in the charter, as well as some of the drafts.
(the strong engineering orientation).

The CLESS draft reads like a review paper, which is
fine and definitely has value, but it probably would need
to be put into the context of a broader research program
to really fly as an IRTF contribution (my opinion, not speaking
for anybody).  Have you (Arnaud) tried bringing it to the opsec
working group?

Melinda

---

From: Kirsty P <[email-masked]>
Date: Mon, 10 Jun 2019 07:42:50 +0000

Hi,

Just a factual correction - SMART was never proposed as a WG or IETF effort; we have always asked for, and intended to be, a proposed RG from the start.

Kirsty

Sent from my phone; replies may be brief
________________________________
From: Smart <[email-masked]> on behalf of Lars Eggert <[email-masked]>
Sent: Monday, June 10, 2019 7:08 am
To: Arnaud.Taddei.IETF
Cc: [email-masked]; Melinda Shore
Subject: Re: [Smart] Future of SMART

Hi,

Lars

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 10 Jun 2019 06:45:39 -0400

On Mon, Jun 10, 2019 at 3:43 AM Kirsty P <Kirsty.p=
[email-masked]> wrote:

> Hi,
>
> Just a factual correction - SMART was never proposed as a WG or IETF
> effort; we have always asked for, and intended to be, a proposed RG from
> the start.
>
> Kirsty
>
>
> ------------------------------
> *From:* Smart <[email-masked]> on behalf of Lars Eggert <
> [email-masked]>
> *Sent:* Monday, June 10, 2019 7:08 am
> *To:* Arnaud.Taddei.IETF
> *Cc:* [email-masked]; Melinda Shore
> *Subject:* Re: [Smart] Future of SMART
>
> Hi,
>
> > Hi Melinda I appreciate and I DO make the difference but at the end of
> the day the core of the problem of the arbitrary non acceptation of the
> contributions from security pure players lies in the hands of the same
> group of religious Templar’s who are sending us in the wrong direction at
> any cost!
>
> When SMART was targeted to be an IETF effort, it was reviewed and engaged
> with on that basis, and the Area Directors of the targeted area together
> with the rest of the IESG decided to not take it further. Usually, they
> base these decisions on reviewing the discussion of the proposal among the
> broader interested community.
>
> Afterwards, SMART changed tracks and intended to become an IRTF research
> group. That is a *very* different kind of undertaking, with consequently
> different review and decision processes. I was not part of the decision
> process here, but my review comments probably would have summarized as
> something like "failed IETF proposal hastily trying to recast itself as
> research". Note that this is not saying that there isn't worthwhile
> research to be done in this space, or that the IRTF shouldn't (eventually)
> do something in this space - but this *particular* proposal for the IRTF
> was clearly not anywhere near the bar.
>
> Lars,

I was surprised at the lack of guidance in this effort. The only help
received was from interested parties who also did not understand the
roadblocks that were being hit.  IMO, this needs to be corrected if the
perception of the IETF/IRTF is to change.  Even if an effort fails, at
least then the proponents would have a clearer picture as to why.  This was
an uphill battle the entire time, with the exception of the start when
there was a SAAG proposal and the room felt an IRTF RG would be the best
path forward and was supportive.

The IAB has been trying to assist with BoFs by assigning someone, how about
something similar with the IRTF?

Best regards,
Kathleen

Lars
>
> PS: I understand you must be frustrated, but broad overstatements and
> name-calling are unlikely to be helpful to your effort.
> This information is exempt under the Freedom of Information Act 2000
> (FOIA) and may be exempt under other UK information legislation. Refer any
> FOIA queries to [email-masked]
> --
> Smart mailing list
> [email-masked]

-- 

Best regards,
Kathleen

---

From: Colin Perkins <[email-masked]>
Date: Wed, 12 Jun 2019 19:01:43 +0100

> On 10 Jun 2019, at 11:45, Kathleen Moriarty <[email-masked]> wrote:
> On Mon, Jun 10, 2019 at 3:43 AM Kirsty P <Kirsty.p=[email-masked] <mailto:[email-masked]>> wrote:
> Hi,
> 
> From: Smart <[email-masked] <mailto:[email-masked]>> on behalf of Lars Eggert <[email-masked] <mailto:[email-masked]>>
> Cc: [email-masked] <mailto:[email-masked]>; Melinda Shore
> On 2019-6-9, at 19:51, Arnaud.Taddei.IETF <Arnaud.Taddei.IETF=[email-masked] <mailto:[email-masked]>> wrote:
> I was surprised at the lack of guidance in this effort. The only help received was from interested parties who also did not understand the roadblocks that were being hit.  IMO, this needs to be corrected if the perception of the IETF/IRTF is to change.  Even if an effort fails, at least then the proponents would have a clearer picture as to why.  This was an uphill battle the entire time, with the exception of the start when there was a SAAG proposal and the room felt an IRTF RG would be the best path forward and was supportive.
> 
> The IAB has been trying to assist with BoFs by assigning someone, how about something similar with the IRTF?

I had a long discussion with Kirsty in Prague to review the outcome of the meeting, and to give feedback on how best to proceed. I also gave Kirsty detailed feedback on the charter proposal and on the decision not to charter the research group at this time. The process before that is not something I can comment on, since I was not involved. 

To summarise for the list:

– The decision on whether to charter a new IRTF research group is made by the IRTF Chair in consultation with the Internet Research Steering Group (IRSG), and with approval of the IAB. 

– The IRTF does not develop standards, and cannot charter research groups that conflict with the standards activities in the IETF.

– The proposed charter for SMART included work to review the Internet threat model defined in RFC 3552; to suggest design considerations for prevention, detection and mitigation of attacks where IETF protocols play a role; and to provide guidance for designers of protocols. This may be important work, but my judgement was that it’s outwith the remit of the IRTF since it relates to standards development conducted in the IETF.

– The proposed charter for SMART also suggested that it would "become a centre of expertise on attack defence in the IETF/IRTF”. An IRTF group cannot act in the IETF, so this would need clarification on the goals and research objectives, and why they are appropriate for an IRTF research group.

– Finally, the proposed charter suggested looking at the malware ecosystem and how changes in the deployed protocols changed the attacks and defence mechanisms. It was not clear what were the specific research questions and challenges to be addressed in this area, and it wasn’t clear why the IRTF was the correct home for the work, and whether it would attract the right community. These are likely things that could be addressed in a revised charter proposal, but were unclear in the version presented for review.

Given these issues, it did not seem appropriate to charter SMART as an IRTF research group at this time. 

I’ll discuss with the IRSG whether it would be feasible to appoint advisers to help shepherd proposals for future new research groups.

Colin Perkins
IRTF Chair

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 12 Jun 2019 14:23:38 -0400

> On Jun 12, 2019, at 2:01 PM, Colin Perkins <[email-masked]> wrote:
> 
>>> On Mon, Jun 10, 2019 at 3:43 AM Kirsty P <Kirsty.p=[email-masked]> wrote:
>>> Hi,
>>> 

As a co-chair, not being in those conversations and not receiving your messages, my perception is from my experience.  I think it would have been helpful to have guidance as you provide below shared transparently to the list as it may have helped interested parties as well as both chairs.  Perhaps that model would be helpful going forward.

I firmly believe there is a lot of research to be done, so if this results in a new proposal considering your feedback, that would be productive.  Having the process transparent with guidance, etc. should benefit all, especially those new to the community.

Best regards,
Kathleen

---

From: Colin Perkins <[email-masked]>
Date: Wed, 12 Jun 2019 19:41:31 +0100

> On 12 Jun 2019, at 19:23, Kathleen Moriarty <[email-masked]> wrote:
> On Jun 12, 2019, at 2:01 PM, Colin Perkins <[email-masked] <mailto:[email-masked]>> wrote:
> 
>>> On 10 Jun 2019, at 11:45, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:

You’ll recall that you were invited to the meeting in Prague, but scheduling conflicts made it impossible to find a time that was suitable for all. The draft charter was sent to me privately by Kirsty, so I responded in the same manner – it didn’t seem appropriate to leak a private draft to the list before the chairs were ready to share it. 

Regards,
Colin

---

From: Mark O <[email-masked]>
Date: Wed, 12 Jun 2019 20:00:11 +0000

For the avoidance of confusion, here is the version of the proposed charter that was considered by Colin – revised after initial feedback following the session at IETF 104.

# Stopping Malware and Researching Threats (SMART) Proposed Research Group Charter

The Stopping Malware and Researching Threats Research Group (or SMART RG) will research attacks and defence methods where these relate to newly developed and existing IETF protocols.
Every work item in this group will fall in one of four categories:
[1]          Research on attacks or defences enabled or disabled by IETF protocols, and recommending protocol design fixes or considerations as a result – including privacy considerations
[2]          Papers on principles/key concepts in attack defence, to underpin attack defence research of protocols and evidence a threat landscape
[3]          Creating methodologies for researchers to consistently analyse protocols for attack defence, and use these to perform such analysis
[4]          To scope out specific security research problems outside of the above three points. The sole aim of these scoping exercises is to create an Internet Draft and establish feasibility of creating a separate IRTF security research group on that specific security problem.
Attack defence generally can seem broad, and to a non-expert, these categories may still seem broad. However, protocols form a small but impactful part of attacks, and many areas of attack defence are ruled out of scope (see OUT OF SCOPE for more). Point [4] aims to help good ideas with effort behind them to navigate the process to start an initiative in the IRTF.

## BACKGROUND
The IRTF is in a unique position to do research and establish robust evidence on these topics. This group aims to research the effect of protocol changes on attacks, defences and the threat landscape. Once the existing landscape is established, we aim to stimulate methodical research into attack defence methods and assessments for new protocols. Protocols are already rigorously assessed for certain security properties, yet researching how protocols relate to attacks and defences is a valuable but under-researched field. This group would begin that work.
If new detection techniques are developed, this group will adhere to the guidelines of RFC 2804.

## AIMS
This research group has these major aims:
- To research the rich area where new protocols are designed and deployed, and used by malicious actors. This includes attacks, the new ecosystem created by new protocols, defence mechanisms used or obsoleted by new protocols, and malicious actor methodology where IETF protocols play a role in the attack chain.
- To survey existing methods and suggest design considerations for prevention, detection and mitigation of attacks where IETF protocols play a role in some stage of the attack.
- To create researched and referenceable material for designers of protocols about the ecosystem in which protocols exist (such as what can be reasonably expected by endpoint security solutions and the communication lifecycle of malware), which are external to protocol design but directly relate to protocol design decisions and assertions.
- To become a centre of expertise on attack defence in the IETF/IRTF.
- To provide research that can form part of the basis for future reviews of RFC 3552: Security Considerations.

## OUTPUTS
The research group plans to create documents that may include, but are not limited to, the following:
- Internet drafts,?some of which may be published through the IRTF RFC stream. These will include outline problem statements, use cases, case studies and convey research results. They will be written for use by other groups to inform protocol designers, implementers and users.
-- Threat Landscape – to create a methodology of analysing the threat landscape
-- Methodologies – to enable researchers to perform consistent review and research within SMART and provide confidence in findings
-- Endpoint Capabilities and Limitations – to provide protocol designers with understanding of what is possible on the endpoint security-wise.
-- Malware attack life cycle – a foundation to show where the interaction of IETF protocols is (and is not) in a full attack chain, allowing further analysis
- Research papers, containing quantitative evidence of attacks and the success of defence methods against them, as well as theoretical and formal analyses of the implications of proposed protocols on attack defence.
- A survey using a SMART-defined methodology of current and historic IETF material to discover existing deliberations on attack defence.

SMART meetings may contain informational content for protocol designers to broaden their understanding of the threat landscape[A1], which is not intended to be published into the form of Internet Drafts. This informational content will be on topics that include, but are not limited to, the following:
- Case studies of attacks on networks and endpoints
- Summarised statistics on volume of attacks and threats, categorised by type of attack
- Summarised statistics on attack detection techniques and their success, including their effectiveness on different versions of protocols
- Attack mitigation techniques

Within the first year, the research group aims to:
- Publish an informational draft, describing the capabilities and limitations of endpoint security
- Improve knowledge within the IETF/IRTF of attack defence
- Publish an informational draft on: "Attack Defence Considerations for Protocol Design and Deployment"
- Host a "Capture The Flag" experiment to simulate an attack, including "Layer 8/9" factors, putting IETF hackathon attendees in the position of defending/attacking with different versions of protocols

## MEMBERSHIP
Membership is open to any interested parties who intend to remain current with the published documents and mailing list issues. Wide participation from industry, academia, government and non-profits is encouraged.

## SCOPE
All research in SMART will have a tie-in to IETF protocols or evidence the threat landscape in which IETF protocols exist (e.g. endpoint considerations); in the world of IETF this may seem very broad because that covers all of IETF work, but in the world of attack defence, that is a small part of the whole problem space, yet an important one.
Attack defence covers a lot; the following (at least) are out of scope for SMART:
- Malware reverse engineering
- Attribution of attacks beyond TTPs
- Identification of victims
- Endpoint patching mechanisms
- Forensic analysis of infected endpoints
- Post-infection clean-up
- SOC structures
- Creation of taxonomies/ontologies for attacks
- Efficient threat sharing models (unless directly related to protocols)
- Threat information exchange
- How to manage a SOC or an incident effectively
- Memory dump analysis
- Automating of playbook responses
- UI and UX design (except a single draft to scope out the viability of the problem space for another RG)
- Best practice for enterprise deployments
- IoT updating mechanisms
- Critical National Infrastructure -specific problems
- Architecture of data centres
- Hardware vulnerabilities

## RESEARCH WE WOULD LIKE TO SEE
This group focuses on the effects of IETF protocols on the threat landscape.
SMART meetings will be co-located with IETF meetings, and an opportunity to share research with the IETF/IRTF community. We therefore welcome drafts and presentations from industry, academia and government at SMART meetings, on the following topics:
- DDoS over UDP; attacks and new defences (including CoAP and QUIC) [1]
- "Evasive technologies: can they prevent malware without reducing privacy for other users?" [1]
- Endpoint framework model, to create a framework that allows endpoint security analysis to be done consistently (draft in progress) [2]
- Endpoint security, its capabilities and its limitations (draft in progress) [2]
- A threat landscape for endpoints, based on the above two drafts (draft beginning) [2]
- Malware Attack Model, characterising the stages of malware and where malware communicates, i.e. could use an IETF protocol (academic paper complete, draft to begin) [2]
- "Characterising Malware's Use of Evasive Technologies" [2]
- Methodology for analysing RFCs (draft in progress) [3]
- Security Considerations Research, using established methodology [3]
- CARIS2, future CARIS workshop reports, and research ideas from these (draft submitted) [4]
- UI/UX design and what features protocols could provide to help ("Protocol Designers: Help us to help users make good choices") (academics engaged) [4]
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 12 Jun 2019 16:58:42 -0400

On Wed, Jun 12, 2019 at 2:41 PM Colin Perkins <[email-masked]> wrote:

> I had a long discussion with Kirsty in Prague to review the outcome of the
> meeting, and to give feedback on how best to proceed. I also gave Kirsty
> detailed feedback on the charter proposal and on the decision not to
> charter the research group at this time. The process before that is not
> something I can comment on, since I was not involved.
>
>
> As a co-chair, not being in those conversations and not receiving your
> messages, my perception is from my experience.  I think it would have been
> helpful to have guidance as you provide below shared transparently to the
> list as it may have helped interested parties as well as both chairs.
> Perhaps that model would be helpful going forward.
>
>
> You’ll recall that you were invited to the meeting in Prague, but
> scheduling conflicts made it impossible to find a time that was suitable
> for all. The draft charter was sent to me privately by Kirsty, so I
> responded in the same manner – it didn’t seem appropriate to leak a private
> draft to the list before the chairs were ready to share it.
>

Hi Colin,

Yes, perhaps your message to Kirsty that SMART would not go forward was in
response to the charter then?  I was not aware it was part of a private
thread and learned about it through Kirsty.  In any case, it is very
helpful to have your feedback on list to see if anything can be done going
forward.

Best regards,
Kathleen

-- 

Best regards,
Kathleen

---

From: Colin Perkins <[email-masked]>
Date: Wed, 12 Jun 2019 22:19:52 +0100

> On 12 Jun 2019, at 21:00, Mark O <Mark.O=[email-masked]> wrote:
> 

This is very similar text to the version I reviewed, but is not quite identical. The attached is the version I was sent.

Colin

-- 
Colin Perkins
https://csperkins.org/

---

From: Colin Perkins <[email-masked]>
Date: Wed, 12 Jun 2019 22:25:26 +0100

> On 12 Jun 2019, at 21:58, Kathleen Moriarty <[email-masked]> wrote:
> On Wed, Jun 12, 2019 at 2:41 PM Colin Perkins <[email-masked] <mailto:[email-masked]>> wrote:
>> On 12 Jun 2019, at 19:23, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
> Yes, perhaps your message to Kirsty that SMART would not go forward was in response to the charter then?  I was not aware it was part of a private thread and learned about it through Kirsty.  In any case, it is very helpful to have your feedback on list to see if anything can be done going forward.

I gave feedback to Kirsty that the charter as written was not suitable, yes. Apologies that you didn’t see it – I had assumed the two co-chairs were discussing the charter drafts and feedback with each other, but perhaps that wasn’t the case.

Colin

-- 
Colin Perkins
https://csperkins.org/

---

From: Bret Jordan <[email-masked]>
Date: Wed, 12 Jun 2019 17:11:07 -0600

All in all I am a huge fan of simple transparency with measurable goals and objectives that are also easy to understand.  I would love to see a process change in the IETF and IRTF that took the guess work and personal opinions out of WG / RG formation. I would also love to see more measurable metrics and globally acceptable practices.  

Doing this would allow chairs and ADs to focus on measuring if people have followed the process versus if they have met their personal views. Designing a system that is based on personal views and opinions and not on process is ripe for radical changes with a change of the ruling party. 

I would even support a new type of working group or technical committee in the IETF that has a much lower bar of entry.  Maybe where it is approved provisionally for say 12 months or where it functions kind of like the ISE.  There could be simple metrics that it has to meet over that 12 months to prove that it has enough interested and has done enough work to warrant approval for a longer term. 

You say IRTF can not do things with the IETF.  I think that artificial wall might need to be busted up a bit. 

I fully support Kathleen’s and Kirsty’s work here.  I fully support the need for this research group. I think the overall quality of IETF work will greatly improve based on the work of this proposed research group.  I would love to see the IRTF chair tweak the charter so that it does work for him.  Then this group can see if that works for us. 

We have to get out of this rat race of “I do not like this” or “this is wrong” so we are not going to approve it.  We need to change to “Please make this change here so we can get this to work”. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Jun 12, 2019, at 2:58 PM, Kathleen Moriarty <[email-masked]> wrote:
> 
> 
>

---

From: Colin Perkins <[email-masked]>
Date: Thu, 13 Jun 2019 01:21:39 +0100

Bret,

> On 13 Jun 2019, at 00:11, Bret Jordan <[email-masked]> wrote:
> 

Perhaps you should raise the idea with the IETF, if you think it important?

> You say IRTF can not do things with the IETF.  I think that artificial wall might need to be busted up a bit. 

The role of the IRTF is to do research, not to develop standards. That will not change.

> I fully support Kathleen’s and Kirsty’s work here.  I fully support the need for this research group. I think the overall quality of IETF work will greatly improve based on the work of this propose…

The proponents of the SMART work need to decide how they wish to proceed. They can focus on the standards related aspects, and take a proposal to the IETF, or they could focus on the research questions–and address the issues raised–and bring a revised charter proposal back to the IRTF. I cannot make that decision for them.

Colin

>> On Jun 12, 2019, at 2:58 PM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> 
>> 
>> [email-masked] <mailto:[email-masked]>

-- 
Colin Perkins
https://csperkins.org/

---

From: Bret Jordan <[email-masked]>
Date: Wed, 12 Jun 2019 18:42:08 -0600

So Colin, based on your statements below, it seems like this group could make a few minor tweaks to the charter and then it could be approved?  Am I reading your statements correctly?  If so, do Kathleen and Kirsty understand specifically what needs to change to get this approved?

Thanks,
Bret

> On Jun 12, 2019, at 6:21 PM, Colin Perkins <[email-masked]> wrote:
> 
> Bret,
> 
>> On 13 Jun 2019, at 00:11, Bret Jordan <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>>> https://www.irtf.org/mailman/listinfo/smart <https://www.irtf.org/mailman/listinfo/smart>
>> 
> 
> 
> 
> -- 
> Colin Perkins
> https://csperkins.org/ <https://csperkins.org/>
> 
> 
> 
>

---

From: Colin Perkins <[email-masked]>
Date: Thu, 13 Jun 2019 02:00:34 +0100

Bret,

No – the charter needs fundamental restructuring, as I note below. I gave Kirsty detailed feedback some weeks ago, and summarised that feedback to the list in response to Kathleen yesterday. 

See also Melinda’s message from 8 June.

Colin

> On 13 Jun 2019, at 01:42, Bret Jordan <[email-masked]> wrote:
> 
>> On Jun 12, 2019, at 6:21 PM, Colin Perkins <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Bret,
>>

---

From: "Arnaud.Taddei.IETF" <[email-masked]>
Date: Sun, 16 Jun 2019 12:41:40 +0000

Lars, I appreciate you don't like what I represent but there is no need to put me on denial, yet no surprise here.

Again, I am too a chair in another venue where I do have constantly to make judgements what is research what is not and so do not try to paint me as not making the difference between IETF and IRTF

Fact is that the SMART chairs made it clear it had never been meant for IETF and nor would have I supported it either after the difficulties we faced back in 2018.

What I eluded to in my initial email is that both SMART and CACAO are pushed back. Two security potential groups, SMART for research at IRTF and CACAO for standardisation at IETF is not yet decided.

This is frankly un-understandable to see that there is a very big difficulty to let new security ideas mature and incubate here. Again why is it that the community is not represented in these non neutral decisions?

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Monday 10 June 2019 08:08, Lars Eggert <[email-masked]> wrote:

> Hi,
>
> On 2019-6-9, at 19:51, Arnaud.Taddei.IETF Arnaud.Taddei.IETF=[email-masked] wrote:
>
> I'm sorry, but this subjective summary illustrates that you in factdon't make the difference.
>
> Afterwards, SMART changed tracks and intended to become an IRTF research group. That is a very different kind of undertaking, with consequently different review and decision processes. I was not part of the decision process here, but my review comments probably would have summarized as something like "failed IETF proposal hastily trying to recast itself as research". Note that this is not saying that there isn't worthwhile research to be done in this space, or that the IRTF shouldn't (eventually) do something in this space - but this particular proposal for the IRTF was clearly not anywhere near the bar.
>
> Lars
>
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Smart mailing list
> [email-masked]

---

From: Melinda Shore <[email-masked]>
Date: Sun, 16 Jun 2019 11:36:09 -0800

On 6/16/19 4:41 AM, Arnaud.Taddei.IETF wrote:
> This is frankly un-understandable to see that there is a very big
> difficulty to let new security ideas mature and incubate here. Again
> why is it that the community is not represented in these non neutral
> decisions?

At the risk of further inflaming the situation, the issue
here isn't the topic but about execution.  Note that CACAO
is being proposed in the IETF and not the IRTF.  Either way
the charter needs to be clear and correct and likely to meet
with success given the people committed to participation and,
in the case of the IETF, the documents produced so far.  The
current proposed charter for SMART does, in fact, imply
very strongly that the intent is for a proposed SMART RG would,
in fact, seek to do some engineering work on IETF standards.
I hope it's being revised to remove that material and that
the group will further reorient itself, but as long as you're
going to insist that the current scope is correct and what
you intend to do, you will continue to run into problems getting
a proposed RG chartered.

Note, as well, that there are currently 20 working groups in
the security area, plus security-focused groups in other areas
(opsec, dprive, doh, etc.), mandatory security considerations
sections in all IETF documents, and secdir review of all
drafts being moved towards publication.  There are also security-
focused research groups in the IRTF.  So, if the goal here is to
get new work chartered, it may be helpful to take a look at why
those proposals were successful, and what needs to be changed
in current efforts for them to succeed as well.

Melinda