Subject: Re: [Smart] Draft Charter For SMART Proposed RG

From: "Arnaud.Taddei.IETF" <[email-masked]>
Date: Fri, 07 Dec 2018 03:01:36 +0000

I will do my best to support this group, indirectly for the moment and then directly before IETF104

Thank you for organising and structuring this important work

Sent with [ProtonMail](https://protonmail.com) Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Wednesday 26 September 2018 22:36, Kirsty P <Kirsty.p=[email-masked]> wrote:

> This is the draft charter for the Proposed Research Group: Stopping Malware and Researching Threats (SMART).
>
> Your thoughts and suggestions are very welcome - please post to the list with your comments! - and keep an eye out for a list of proposed research problems soon...
>
> # Stopping Malware and Researching Threats  (SMART) Proposed RG - Draft Charter
>
> ## BACKGROUND
>
> The Stopping Malware and Researching Threats Research Group (or SMART RG) will investigate how cyber attack defence requirements can be met in a world of encrypted data. It will research the effects, both positive and negative, of existing, proposed and newly published protocols and Internet standards on attack defence. It will gather evidence from information security practitioners on methods used to defend against attacks and make this available to protocol designers. As a result, designers, implementers and users of new protocols will be better informed about the possible impact on attack prevention and mitigation.
>
> The IRTF is in a unique position to provide this research and evidence to the IETF. This research group aims to describe the effect of protocol changes where relevant and stimulate methodical research into attack defence methods for new protocols. Protocols are already rigorously assessed for their security properties, but ensuring attack defence methods are also rigorously assessed alongside protocol design changes would provide a fuller understanding of the value for such change, enabling a better engineered Internet.
>
> ## AIMS
>
> This research group has these major aims:
>
> - To bring evidence on attacks and the methods that are or could be used to defend against them to the attention of the IETF.
>
> - To highlight the attack mitigation impact, both positive and negative, of new protocols and updates to existing protocols.
>
> - To stimulate and generate research into attack defence methods for new protocols, and to increase awareness in the technical community of new and existing methodology for detecting and mitigating attacks.
>
> - To provide systematic guidance to designers of new protocols as to what attack defence considerations to review, and to inform implementers by default about the effects of new protocols on attack defence.
>
> - To produce problem statements that describe key issues in cyber security for the group to research (initial research project ideas are listed below).
>
> ## OUTPUTS
>
> The research group plans to create documents that may include, but are not limited to, the following:
>
> - Internet drafts, some of which may be published through the IRTF RFC stream. These will include outline problem statements, use cases, case studies and convey research results. They will be written for use by other groups to inform protocol design.
>
> - Policy papers, for in-depth analysis and discussion of the relationship between attack defence and the Internet architecture and protocols.
>
> - Research papers, containing quantitative evidence of actual attacks and the success of defence methods against them, as well as theoretical and formal analyses of the implications of proposed protocols on attack defence. Defence methods will be analyzed to determine if there are ways to optimize in order to better scale attack detection and mitigation.
>
> - Survey of current and historic IETF material to discover existing deliberations on attack defence.
>
> - Best practice papers, describing methodologies that will enable researchers to conduct experiments and report results that are useful to designers of protocols. These methodologies will give descriptions of the effects of protocols on attack defence backed by evidence from real-world attacks, laboratory-based testing and theoretical analysis of protocols, through the analysis lens of attacks, detection methods and systematic assessment methodologies.
>
> Within the first year, the research group aims to:
>
> - Survey existing attack detection methods and determine the relative effectiveness of these methods against different attack defence threats (e.g. phishing, DDoS, spambots, C&C, endpoint malware)
>
> - Publish case studies of historical attacks and make recommendations where attacks could have been stopped more quickly, or even prevented
>
> - Publish an Informational RFC, titled: "Important Attack Defence Considerations for Protocol Design and Deployment".
>
> ## MEMBERSHIP
>
> Membership is open to any interested parties who intend to remain current with the published documents and mailing list issues. Wide participation from industry, academia, government and non-profits is encouraged.
>
> This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]