From nobody Thu Jan 24 09:44:48 2019 Return-Path: X-Original-To: smart@ietfa.amsl.com Delivered-To: smart@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B60C130EE7 for ; Thu, 24 Jan 2019 09:44:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.552 X-Spam-Level: X-Spam-Status: No, score=-6.552 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-4.553, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ncsc.gov.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CgL9lKWDjU6C for ; Thu, 24 Jan 2019 09:44:44 -0800 (PST) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100125.outbound.protection.outlook.com [40.107.10.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6FE41312B5 for ; Thu, 24 Jan 2019 09:44:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ncsc.gov.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2PA7Nz//wYbXfQQNyTYRIKK0gr1RtW3OqvNBYVMLph0=; b=DW6TN0Aek/ryysCY8KsPZiIP1Di9mjuI5iTdoj/ToJWB4+I8o6BTGR8yUeeD5cZD0GwbVlol6UI2QiT3IS4AnJLCNuZGCkkS/P+spTdfaJsXHt3gdEL/oAqJY0xCPEA3+RzUBcxNqotdfgLtxJuXLI9Ne7UPa44h/k7S2A0EqBk= Received: from LO2P123MB2527.GBRP123.PROD.OUTLOOK.COM (20.176.158.74) by LO2P123MB1805.GBRP123.PROD.OUTLOOK.COM (20.176.154.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1558.18; Thu, 24 Jan 2019 17:44:41 +0000 Received: from LO2P123MB2527.GBRP123.PROD.OUTLOOK.COM ([fe80::c7e:6629:76af:26f2]) by LO2P123MB2527.GBRP123.PROD.OUTLOOK.COM ([fe80::c7e:6629:76af:26f2%2]) with mapi id 15.20.1558.016; Thu, 24 Jan 2019 17:44:41 +0000 From: Kirsty P To: "smart@irtf.org" CC: Kathleen Moriarty Thread-Topic: SMART BoF - Prague - call for presentations Thread-Index: AQHUs+RcQYVgAQMUVUqiDh3gvjpQ7g== Date: Thu, 24 Jan 2019 17:44:41 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Kirsty.p@ncsc.gov.uk; x-originating-ip: [51.141.26.231] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; LO2P123MB1805; 6:ifpGsmexFi4Yy8bICYGgaFSbbiq8nhdOguOWVmypDEemzfESKTUbdHHxE40V/4vULTD+WiOx5JFNQPgLVrUmlAyJ0rpJek2c9rs6vh4KxdlIsT0qCW6IxM5kB9/pjYPn4oDy+8YLbGYC5n1n+fIUnAbkiPcYC4XWTs/+IJvtlPiP2X5XZCn8wq0H7o45Am7PJC6ewqnMyxNiIrmvpHnlE2zt3dRsWIqO4bs2Q5vA6Pv6lD40UApSPllW0VFu7mht5IEAu5eMKK7MmTiS0zE0pmUN0kwx5t1VV9LNXdb0wEOYH4ovo2jY3AEWNysxZEZPjrTHkxYRU1kjDtHcDeQkIrrgosZcdEwFUTOXFaPzAbg+pEMi7tC+N+R+WfRSYWBsKhSi3M3eCyR2DmEadsZpD3+R5who5i4LooEchR2BQsCrbIk7yQd0rZ+HVuzMFcpZJFFs6UimWKcbzmaAFpgqcg==; 5:jBwwZS7DSogo4WYdxTrwoDpUuNF55BcYIaV/hffizc0qUUxYIlB4Dt8o1y4n5a1CiYpPBag0WPVvIUYkFLlyIu55NCwaOxvtbFpfGDKt6YLh5Dzz7+t4iQwIyiflYdwzEWzD+riy9PMWfrdevFTbaSxwNOOGjHDIZCU9f3HJcvtnzHqPmem8ovInZlcudnHdrc41Pdik3kkoFIm1dfCEyg==; 7:P4AxIayf10rXLpUyBq8BRoisjmI6dE0f9P2lkC8GH9ihgVu3Bc0OTD21ASjtnMuBasBJO4KAAHWJ94eIKwhGQpLYJBD/pQfNZOJyihF2L6txv8al9HRooT21UFMJ1mXxK8x3Ks2UAwzUhy9BhAmxWA== x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 9184508d-6fb6-4c8c-debb-08d682239e93 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020); SRVR:LO2P123MB1805; x-ms-traffictypediagnostic: LO2P123MB1805: x-microsoft-antispam-prvs: x-forefront-prvs: 0927AA37C7 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(136003)(366004)(376002)(39850400004)(396003)(189003)(199004)(5640700003)(486006)(26005)(102836004)(4326008)(55236004)(39060400002)(7696005)(74482002)(1730700003)(81166006)(81156014)(53936002)(6506007)(25786009)(476003)(3846002)(6116002)(55016002)(9686003)(6436002)(86362001)(71200400001)(71190400001)(54896002)(186003)(2906002)(66066001)(72206003)(256004)(14444005)(7736002)(6916009)(74316002)(75922002)(478600001)(14454004)(6606003)(33656002)(8676002)(2501003)(97736004)(68736007)(8936002)(99286004)(316002)(19627405001)(2351001)(105586002)(106356001); DIR:OUT; SFP:1102; SCL:1; SRVR:LO2P123MB1805; H:LO2P123MB2527.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ncsc.gov.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: YOPE7LVXkTWTREVY0YTs+64CRYhO6NBiBB/V+OHJIoBH9B5J+uWdZ8/HePfauOVm/5ODYWo9FoK9bORGHGG2yg3JvF766K/Miniq4lbkJOzlzfTkf8dcmqTpShBsnFpb9qheXyvrzJE5cYnKbp2Fg4GdHUzi3l5Uue6kHTYBVTmnrtfQA8bxQjOjDYIBEjiMYcMY3QU4qyMaapimY6LpmE09nx8Nls9t9P3VRPo9WO7Pokmt3Jt9Juy62Egi/V+RlCylr8hAXMoQYj3OUZhh12Ya2imyK5DE1t47nVxnSP9jsQPPr931wgzqpWLUKmaF3FfTMc0LKy6VCgwgxPjVPtA3JXFCZ2D+EAPMMAmhwbjJ1jy9ValLBRpKLzeejheyp7i6dXoveGfccNZ4SFuCFZhGW/Fx9Ld7vCDXnn+GQi8= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_LO2P123MB25274A6BA31B34A0709A767BD79A0LO2P123MB2527GBRP_" MIME-Version: 1.0 X-OriginatorOrg: ncsc.gov.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 9184508d-6fb6-4c8c-debb-08d682239e93 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jan 2019 17:44:41.4470 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 14aa5744-ece1-474e-a2d7-34f46dda64a1 X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB1805 Archived-At: Subject: [Smart] SMART BoF - Prague - call for presentations X-BeenThere: smart@irtf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Stopping Malware And Researching Threats List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Jan 2019 17:44:47 -0000 --_000_LO2P123MB25274A6BA31B34A0709A767BD79A0LO2P123MB2527GBRP_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable SMART folks, We are planning to meet at IETF 104 in Prague!* ...And this is an open call for research presentations, so we can finalise = our agenda. But what research are we looking for? Well, it's pretty broad as this is ou= r first meeting, but we're interested in any of the following: * case studies of previous incidents and attacks: how they were detecte= d, prevented, mitigated - particularly where there are IETF protocols invol= ved * best practice, e.g. use of DMARC, to prevent phishing * new methods for detection and mitigation =96 including automation * reports and statistics on the current threat landscape * how to spot slow and bulk data exfil from a network reliably * endpoint detection capabilities and limitations * threat detection on encrypted traffic * or research we are completely unaware of! Please email myself and Kathleen if you have research you'd like to bring, = or an idea you'd like to discuss. Kirsty * For those new to IETF/IRTF, this means we will have a meeting for about t= wo hours sometime in the w/c 25th March, subject to confirmation - the agen= da is announced three weeks before, so we won't know which date in that wee= k SMART will be on until then. This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk --_000_LO2P123MB25274A6BA31B34A0709A767BD79A0LO2P123MB2527GBRP_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

SMART folks,


We are planning to meet at = IETF 104 in Prague!* 


...And this is an open call for = research presentations, so we can finalise our agenda.


But what research are we looking= for? Well, it's pretty broad as this is our first meeting, but we're inter= ested in any of the following:

  • case studies of previous incidents and attacks: how they were detected, prevented, mitigated - particularly = where there are IETF protocols involved
  • best practice, e.g. use of DMARC, to prevent phishing
  • new methods for detection and mitigation =96 including automation<= br>
  • reports and statistics on the current threat landscape
  • how= to spot slow and bulk data exfil from a network reliably
  • endpoint detection capabilities and limitations
  • threat det= ection on encrypted traffic
  • or research we are completely unaw= are of!


Please email myself and Kathleen= if you have research you'd like to bring, or an idea you'd like to discuss= .


Kirsty



* For those new to= IETF/IRTF, this means we will have a meeting for about two hours sometime in the w/c 25th March, subject to confirmation - the age= nda is announced three weeks before, so we won't know which date in that = week SMART will be on until then.

This information is exempt under the Freedom of Information Act 2000 (FOIA)= and may be exempt under other UK information legislation. Refer any FOIA q= ueries to ncscinfoleg@ncsc.gov.uk --_000_LO2P123MB25274A6BA31B34A0709A767BD79A0LO2P123MB2527GBRP_--