Subject: Re: [Syslog] [snia-security] Audit Logging SIG/TWG

From: "David Harrington" <[email-masked]>
Date: Thu, 23 Jul 2009 09:04:09 -0400

Hi,
 
The IETF Syslog WG has been chartered to address security issues. The
WG has almost completed its current work plan. Some of the features
that have been included in the IETF syslog standards will probably be
useful for audit logging purposes, such as increased message sizes,
secure transport, structured data elements, and digitally signed
messages,  http://www.ietf.org/dyn/wg/charter/syslog-charter.html
 
The WG is considering re-chartering to do additional work. Much of the
proposed work relates to standardizing how syslog is used, and for
standardizing some types of logging content. 
 
The Syslog WG will be meeting at the upcoming IETF meeting
(http://www.ietf.org/meeting/75/). Attached is a Powerpoint
presentation that shows what topics are expected to be discussed.
Proposals for additional work are welcome.
 
In the IETF, official work is done using mailing lists rather than
face-to-face meetings. If anybody wishes to monitor or contribute to
the discussion, here is where the official discussions occur:
General Discussion: [email-masked]
To Subscribe: [email-masked]
In Body: subscribe
Archive: http://www.ietf.org/mail-archive/web/syslog
 
Your input is welcome.
 
David Harrington 
co-chair, Syslog WG

Standards Manager, HuaweiSymantec Technologies
[email-masked]
[email-masked]
 <mailto:[email-masked]> [email-masked]

  _____  

From: Eric Hibbard [mailto:[email-masked]] 
Sent: Friday, July 17, 2009 12:24 PM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: [snia-security] Audit Logging SIG/TWG

Michael,

I understand that you have expressed some interest in the area of
audit logging and have floated the idea of forming a SIG or TWG for
such an activity. I have a mixed reaction to this.on the one hand, the
Security TWG has been advocating that storage ecosystems must
participate in audit logging (as opposed to just health and fault
logging).on the flip side, we don't see SNIA being a serious leader in
this space (we're about 3 years too late for that).more like a
consumer. However, the Security TWG considers this an important area
and we're more than happy to participate and/or support whatever
surfaces. 

In the spirit of sharing, you might want to take a look at the
following resources:

.         SNIA docs - Storage Security best practices
(http://www.snia.org/forums/ssif/programs/SNIATechnicalProposal-Securi
ty-BCPs.20080904.pdf) and the SNIA Logging Whitepaper
(http://www.snia.org/forums/ssif/knowledge_center/white_papers/forums/
ssif/knowledge_center/white_papers/SNIA-Logging-WP.050921.pdf); the
whitepaper is being rewritten as week speak

.         IETF Syslog WG (http://tools.ietf.org/wg/syslog/) - The IETF
has finally published multiple standards-track RFC related to Syslog,
which is the primary protocol for all external/centralized logging.
These RFC cover architecture, protocol, and security.

.         Mitre - Mitre has done some work with its Common Even
Expression Taxonomy (CEET), which the Security TWG has been
investigating as a possible way of "standardizing" message events so
that the event log vendors could parse and react to them. Check out
http://cee.mitre.org/ceelanguage.html

With the possible exception of PCI DSS, most of the drivers for this
technology are indirect (i.e., monitor and respond, or establish and
maintain accountability and traceability). This means that a certain
amount of interpretation is required, and of course this leads to
vendor hype and organizational indecision.

Best regards,

-Eric

Eric A. Hibbard, CISSP, CISA, ISSAP, ISSMP, ISSEP
CTO Security and Privacy

International Representative, INCITS TC CS1 Cyber Security

Vice Chair, American Bar Association - SciTech Law - eDiscovery &
Digital Evidence Committee

Vice Chair, IEEE Information Assurance Standards Committee (IASC)

Member, SNIA Technical Council

Chair, SNIA Security Technical Work Group

Vice Chair, IEEE Security in Storage Work Group (P1619)

HITACHI DATA SYSTEMS
750 Central Expressway
Santa Clara, CA 95050-2627
P 408.970.7979/ C 408.314.0515
eric.hibbard <blocked::mailto:[email-masked]> @hds.com

---

From: Eric Hibbard <[email-masked]>
Date: Thu, 23 Jul 2009 09:58:47 -0400

David,

Thank you for the feedback. A couple of us within SNIA and the INCITS/CS1 organizations have been monitoring the progress. We are definitely pleased to have the new standards-track RFCs for syslog.

-Eric

From: David Harrington [mailto:[email-masked]]
Sent: Thursday, July 23, 2009 6:04 AM
To: Eric Hibbard; [email-masked]
Cc: [email-masked]; [email-masked]; 'Chris Lonvick'; [email-masked]
Subject: RE: [snia-security] Audit Logging SIG/TWG

Hi,

The IETF Syslog WG has been chartered to address security issues. The WG has almost completed its current work plan. Some of the features that have been included in the IETF syslog standards will probably be useful for audit logging purposes, such as increased message sizes, secure transport, structured data elements, and digitally signed messages,  http://www.ietf.org/dyn/wg/charter/syslog-charter.html

The WG is considering re-chartering to do additional work. Much of the proposed work relates to standardizing how syslog is used, and for standardizing some types of logging content.

The Syslog WG will be meeting at the upcoming IETF meeting (http://www.ietf.org/meeting/75/). Attached is a Powerpoint presentation that shows what topics are expected to be discussed. Proposals for additional work are welcome.

In the IETF, official work is done using mailing lists rather than face-to-face meetings. If anybody wishes to monitor or contribute to the discussion, here is where the official discussions occur:
General Discussion: [email-masked]
To Subscribe: [email-masked]<mailto:[email-masked]>
In Body: subscribe
Archive: http://www.ietf.org/mail-archive/web/syslog

Your input is welcome.

David Harrington
co-chair, Syslog WG

Standards Manager, HuaweiSymantec Technologies
[email-masked]
[email-masked]
[email-masked]<mailto:[email-masked]>

________________________________

I understand that you have expressed some interest in the area of audit logging and have floated the idea of forming a SIG or TWG for such an activity. I have a mixed reaction to this...on the one hand, the Security TWG has been advocating that storage ecosystems must participate in audit logging (as opposed to just health and fault logging)...on the flip side, we don't see SNIA being a serious leader in this space (we're about 3 years too late for that)...more like a consumer. However, the Security TWG considers this an important area and we're more than happy to participate and/or support whatever surfaces.

In the spirit of sharing, you might want to take a look at the following resources:

*         SNIA docs - Storage Security best practices (http://www.snia.org/forums/ssif/programs/SNIATechnicalProposal-Security-BCPs.20080904.pdf) and the SNIA Logging Whitepaper (http://www.snia.org/forums/ssif/knowledge_center/white_papers/forums/ssif/knowledge_center/white_papers/SNIA-Logging-WP.050921.pdf); the whitepaper is being rewritten as week speak

*         IETF Syslog WG (http://tools.ietf.org/wg/syslog/) - The IETF has finally published multiple standards-track RFC related to Syslog, which is the primary protocol for all external/centralized logging. These RFC cover architecture, protocol, and security.

*         Mitre - Mitre has done some work with its Common Even Expression Taxonomy (CEET), which the Security TWG has been investigating as a possible way of "standardizing" message events so that the event log vendors could parse and react to them. Check out http://cee.mitre.org/ceelanguage.html

With the possible exception of PCI DSS, most of the drivers for this technology are indirect (i.e., monitor and respond, or establish and maintain accountability and traceability). This means that a certain amount of interpretation is required, and of course this leads to vendor hype and organizational indecision.

Best regards,

-Eric

Vice Chair, American Bar Association - SciTech Law - eDiscovery & Digital Evidence Committee

HITACHI DATA SYSTEMS
750 Central Expressway
Santa Clara, CA 95050-2627
P 408.970.7979/ C 408.314.0515
[email-masked]<blocked::mailto:[email-masked]>

---

From: "David Harrington" <[email-masked]>
Date: Thu, 23 Jul 2009 10:13:47 -0400

Hi,
 
I just read the SNIA Logging white paper, and found some things that
are no longer recommended (the BEEP raw and cooked profiles), and some
changes to Syslog terminology in order to better address the security
issues. 
 
You mentioned the white paper is being updated as we speak. Would you
like reviewers that have a good knowledge of the IETF Syslog RFCs?
 
David Harrington
[email-masked]
[email-masked]
[email-masked]

  _____  

From: Eric Hibbard [mailto:[email-masked]] 
Sent: Thursday, July 23, 2009 9:59 AM
To: David Harrington; [email-masked]
Cc: [email-masked]; [email-masked]; 'Chris Lonvick';
[email-masked]
Subject: RE: [snia-security] Audit Logging SIG/TWG

David,

Thank you for the feedback. A couple of us within SNIA and the
INCITS/CS1 organizations have been monitoring the progress. We are
definitely pleased to have the new standards-track RFCs for syslog.

-Eric

Cc: [email-masked]; [email-masked]; 'Chris Lonvick';
[email-masked]

Hi,

Your input is welcome.

David Harrington 

co-chair, Syslog WG

 

  _____  

Michael,

Best regards,

-Eric

HITACHI DATA SYSTEMS
750 Central Expressway
Santa Clara, CA 95050-2627
P 408.970.7979/ C 408.314.0515
[email-masked] <blocked::mailto:[email-masked]>

---

From: Eric Hibbard <[email-masked]>
Date: Thu, 23 Jul 2009 13:43:53 -0400

David,

We would definitely welcome such input. Please keep in mind that we expect to change the updated whitepaper from one of educating the storage vendors to one that is more useful to organizations.

-Eric

Sent: Thursday, July 23, 2009 7:14 AM

Hi,

I just read the SNIA Logging white paper, and found some things that are no longer recommended (the BEEP raw and cooked profiles), and some changes to Syslog terminology in order to better address the security issues.

You mentioned the white paper is being updated as we speak. Would you like reviewers that have a good knowledge of the IETF Syslog RFCs?

David Harrington
[email-masked]
[email-masked]
[email-masked]

-Eric

Hi,

Your input is welcome.

David Harrington
co-chair, Syslog WG

Best regards,

-Eric

HITACHI DATA SYSTEMS
750 Central Expressway

---

From: [email-masked]
Date: Thu, 23 Jul 2009 09:10:07 -0700

Eric,

Regarding the mitre reference below. It appears that the mitre activities haven't gotten far enough to be useful to anyone right now. Do they have a timeline in mind?

Curious,
Larry H

Sent: Thursday, July 23, 2009 7:59 AM

David,

-Eric

Hi,

Your input is welcome.

David Harrington
co-chair, Syslog WG

Best regards,

-Eric

HITACHI DATA SYSTEMS
750 Central Expressway