Subject: [Smart] New Version Notification for draft-mcfadden-smart-endpoint-taxonomy-for-cless-00.txt

From: <[email-masked]>
Date: Mon, 8 Jul 2019 08:26:53 -0500

A new version of I-D, draft-mcfadden-smart-endpoint-taxonomy-for-cless-00.txt
has been successfully submitted by Mark McFadden and posted to the IETF repository.

Name:		draft-mcfadden-smart-endpoint-taxonomy-for-cless
Revision:	00
Title:		Endpoint Taxonomy for CLESS
Document date:	2019-07-08
Group:		Individual Submission
Pages:		15
URL:            https://www.ietf.org/internet-drafts/draft-mcfadden-smart-endpoint-taxonomy-for-cless-00.txt
Status:         https://datatracker.ietf.org/doc/draft-mcfadden-smart-endpoint-taxonomy-for-cless/
Htmlized:       https://tools.ietf.org/html/draft-mcfadden-smart-endpoint-taxonomy-for-cless-00
Htmlized:       https://datatracker.ietf.org/doc/html/draft-mcfadden-smart-endpoint-taxonomy-for-cless

Abstract:
   A separate document [I-D:draft-taddei-smart-cless-introduction]
   (CLESS) attempts to establish the capabilities and limitations of
   endpoint-only security solutions and explore potential alternative
   approaches. That document discusses endpoints in general terms. It
   has been suggested that there are classes of endpoints that have
   different characteristics. Those classes may have completely
   different threat landscapes and the endpoints may have completely
   different security capabilities. In support of the work on CLESS,
   this document provides a taxonomy of endpoints that is intended to
   provide a foundation for further work on CLESS and research on
   approaches to providing endpoint security alternatives in a diverse
   group of settings.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 8 Jul 2019 09:36:19 -0400

> But, there's an important question here. CLESS specifically rules out 
> network infrastructure in its discussion. Should the taxonomy for 
> CLESS incorporate endpoints that are part of the network 
> infrastructure? Said a different way: is network infrastructure out of 
> scope for CLESS? 
Do you intend this to be 5G relevant?

-tr

---

From: <[email-masked]>
Date: Mon, 8 Jul 2019 08:47:07 -0500

Those are pretty useful questions. I’ve gotten the same comments from others off-list.  The scoping of CLESS is something we should try to make progress on the list.

The 5G question is a little different for me. Do you think that 5G introduces categories of endpoints that would not be present in existing, or other, transport infrastructures?  If so, I’m happy to amend the text.

Thanks,

mark

From: Tony Rutkowski <[email-masked]> 
Sent: Monday, July 8, 2019 8:36 AM
To: [email-masked]; [email-masked]
Subject: Re: [Smart] New Version Notification for draft-mcfadden-smart-endpoint-taxonomy-for-cless-00.txt

But, there's an important question here. CLESS specifically rules out network infrastructure in its discussion. Should the taxonomy for CLESS incorporate endpoints that are part of the network infrastructure? Said a different way: is network infrastructure out of scope for CLESS? 

-tr

On 08-Jul-19 9:26 AM, [email-masked] <mailto:[email-masked]>  wrote:

Abstract:

 
 
The IETF Secretariat

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 8 Jul 2019 14:06:20 -0400

Full Stand Alone (SA) 5G specified by Rel. 16 will consist of fully 
virtualised architectures orchestrated on-demand using NFV based network 
slicing among virtualised Network Functions.  Given this reality and 
that the slices will be using different network protocols, including E2E 
Ethernet, and instantiating architectures and functions for periods of 
time using many different NF identifiers, it isn't clear how this 
comports with the typically highly rigid TCP/IP centric model.  (Indeed, 
it isn't clear that the term "internet" has meaning.)

In a 5G/NFV environment, enormously diverse Network Functions will exist 
all over the instantiated architectures - including on end user 
equipment.  The interesting question is whether a taxonomy for NFs 
exists, and whether your draft should use the conceptualisation in the 
interest of accommodating 5G.  It's worth noting that useful work along 
those lines exists out there.  Some is found in NFV ISG specifications, 
e.g., ETSI GS NFV-IFA 014. Other material can be found at IETF 
meetings.  See, e.g., 
https://www.ietf.org/proceedings/92/slides/slides-92-rtgarea-3.pdf

CLESS is certainly headed in the right direction - certainly in a 5G world.

--tony

On 08-Jul-19 9:47 AM, [email-masked] wrote:
>
> Those are pretty useful questions. I’ve gotten the same comments from 
> others off-list.  The scoping of CLESS is something we should try to 
> make progress on the list.
>
> The 5G question is a little different for me. Do you think that 5G 
> introduces categories of endpoints that would not be present in 
> existing, or other, transport infrastructures?  If so, I’m happy to 
> amend the text.
>
> Thanks,
>
> mark
>
> *From:*Tony Rutkowski <[email-masked]>
> *Sent:* Monday, July 8, 2019 8:36 AM
> *To:* [email-masked]; [email-masked]
> *Subject:* Re: [Smart] New Version Notification for 
> draft-mcfadden-smart-endpoint-taxonomy-for-cless-00.txt
>
>     But, there's an important question here. CLESS specifically rules
>     out network infrastructure in its discussion. Should the taxonomy
>     for CLESS incorporate endpoints that are part of the network
>     infrastructure? Said a different way: is network infrastructure
>     out of scope for CLESS?
>
> On 08-Jul-19 9:26 AM, [email-masked] 
> <mailto:[email-masked]> wrote:
>
>     URL:https://www.ietf.org/internet-drafts/draft-mcfadden-smart-endpoint-taxonomy-for-cless-00.txt
>
>     Status:https://datatracker.ietf.org/doc/draft-mcfadden-smart-endpoint-taxonomy-for-cless/
>
>     Htmlized:https://tools.ietf.org/html/draft-mcfadden-smart-endpoint-taxonomy-for-cless-00
>
>     Htmlized:https://datatracker.ietf.org/doc/html/draft-mcfadden-smart-endpoint-taxonomy-for-cless
>
>     Abstract:
>

---

From: "Arnaud.Taddei.IETF" <[email-masked]>
Date: Tue, 09 Jul 2019 14:54:19 +0000

Yes I think Tony makes a point.

I don't think it introduces a new endpoint model type but we need to be mindful of the internal model representation of an endpoint with a 5G chip as it will have a number of side effects for defining the "attack surface" both internally and externally to the endpoint.

In fact if you take the perspective of say an employee in a company, from a zero trust perspective, 5G will actually have a major effect on the way organizations will have to completely change their security models and will have to reconsider their approach to endpoints. Think the day when Apple will ship a MacBookPro with no Wifi and a 5G chip.

I actually can see the effect beyond 3GPP and ETSI as the problem is now coming deeper even in ITU-T SG17. The past 2 ultra intense weeks in China including for Q7/17 and Q8/17 opened my eyes on the relevance of CLESS even there and especially for zero trust in 5G contexts.

Hope this helps

Sent with [ProtonMail](https://protonmail.com) Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Monday 8 July 2019 20:06, Tony Rutkowski <[email-masked]> wrote:

> Full Stand Alone (SA) 5G specified by Rel. 16 will consist of fully virtualised architectures orchestrated on-demand using NFV based network slicing among virtualised Network Functions.  Given this reality and that the slices will be using different network protocols, including E2E Ethernet, and instantiating architectures and functions for periods of time using many different NF identifiers, it isn't clear how this comports with the typically highly rigid TCP/IP centric model.  (Indeed, it isn't clear that the term "internet" has meaning.)
>
> In a 5G/NFV environment, enormously diverse Network Functions will exist all over the instantiated architectures - including on end user equipment.  The interesting question is whether a taxonomy for NFs exists, and whether your draft should use the conceptualisation in the interest of accommodating 5G.  It's worth noting that useful work along those lines exists out there.  Some is found in NFV ISG specifications, e.g., ETSI GS NFV-IFA 014.  Other material can be found at IETF meetings.  See, e.g., https://www.ietf.org/proceedings/92/slides/slides-92-rtgarea-3.pdf
>
>> From: Tony Rutkowski [<[email-masked]>](mailto:[email-masked])
>>> URL:
>>> https://www.ietf.org/internet-drafts/draft-mcfadden-smart-endpoint-taxonomy-for-cless-00.txt
>>>
>>> Status:
>>> https://datatracker.ietf.org/doc/draft-mcfadden-smart-endpoint-taxonomy-for-cless/
>>>
>>> Htmlized:
>>> https://tools.ietf.org/html/draft-mcfadden-smart-endpoint-taxonomy-for-cless-00
>>>
>>> Htmlized:
>>> https://datatracker.ietf.org/doc/html/draft-mcfadden-smart-endpoint-taxonomy-for-cless
>>>
>>>
>>>
>>>
>>>
>>> Abstract:
>>>