Subject: Re: [saag] [OPSAWG] Review and contribution requested: draft-boesch-idxp-idpef-01 (Bjoern-C. Boesch)

From: "B.-C. Boesch" <[email-masked]>
Date: Sat, 02 May 2015 14:32:34 +0200

Hi Randy,

thanks for your feedback and the start of a discussion about IDPEF and 
its management features / options.

IDXP provide already an interface for configuration exchange. Therefore 
IDPEF was developed close to IDMEF and IDXP. An important argument was 
that only one transport protocol is need for configuration and 
signalling. That reduces the probability of vulnerabilities in the 
implementation (one implementation instead of two).

The key point for IDPEF is that the parametrization of the Analyzer will 
be harmonized and the Manager become independent. Based on this you are 
able to combine different (vendor and analyzing technique) IDS Analyzers 
under one independent central Manager. With YANG and netconf the 
configuration will be still vendor-specific and vendor-specific 
adjustments are still needed on site of the central Manager. That is why 
I preferred a specialized format.

Maybe there are some other good points which plead for YANG as IDS 
configuration format that we should put focus on.

Kind regards

Bjoern-C.

Am 01.05.2015 um 00:45 schrieb Randy Presuhn:
> Hi -
>
> Has there been some discussion of the reasons why this work
> doesn't emply one of the established management information
> data modeling languages, such as Yang or SNMP SMI?
>
> Randy
>
> -----Original Message-----
>> From: "B.-C. Boesch" <[email-masked]>
>> Sent: Apr 29, 2015 7:41 AM
>> To: [email-masked], [email-masked], [email-masked], [email-masked], Kathleen Moriarty <[email-masked]>
>> Cc: Stephen Farrell <[email-masked]>
>> Subject: [OPSAWG] Review and contribution requested: draft-boesch-idxp-idpef-01 (Bjoern-C. Boesch)
>>
>> Dear community,
>>
>> I have post the attached draft and looking for feedback from people with
>> security management and / or security (IDS) operations expertise
>> (including IDS developer). I am particularly interested in your opinions
>> on the communication proceedings, the parametrization methodology and
>> the provided attributes (and such I did not think of). If the text needs
>> updating by your point of view, please let me know that as well. Here is
>> the link to the new draft:
>>
>> http://www.ietf.org/id/draft-boesch-idxp-idpef-01.txt
>>
>> At the first view the draft looks very long but after page 44 a lot of
>> examples and definitions are included for better understanding. So the
>> first 43 pages are primary in scope for feedback but feedback for the
>> other pages is welcome, too.
>>
>> Abstract
>>
>> The Intrusion Detection Parametrization Exchange Format (IDPEF) defines
>> data formats and exchange procedures to standardize parametrization
>> information exchange into intrusion detection and response systems from
>> an independent central Manager to any Analyzer. The IDPEF enables a
>> combination of different (vendor and analyzing technique) IDS Analyzers
>> under one independent central Manager. A separate operations of IDS is
>> not longer needed. Base is a new parametrization methodology where IDS
>> operating parameters (configurations) are separated in an environmental
>> parametrization part and a vendor-specific analyzing part.
>>
>> This Internet-Draft describes a data model to represent parametrization
>> information of intrusion detection system entities, and explains the
>> rationale for using this model. An implementation of the data model in
>> the Extensible Markup Language (XML) is presented, a XML Document Type
>> Definition is developed, and parametrization examples are provided.
>>
>>
>>
>> I am looking forward to your suggestions, feedback, notations, hints,
>> recommendations, etc. to improve the Internet Draft. Also native speaker
>> feedback with scope on wording and typo is welcome.
>>
>> Kind regards,
>>
>> Bjoern-C.
>>
>>
>> _______________________________________________
>> OPSAWG mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/opsawg

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sat, 2 May 2015 19:35:21 +0200

On Sat, May 02, 2015 at 02:32:34PM +0200, B.-C. Boesch wrote:
> 
> [...] With YANG and netconf the 
> adjustments are still needed on site of the central Manager. 
>

This argument likely needs an explanation. There are people working
quite hard towards standardized YANG models.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: "B.-C. Boesch" <[email-masked]>
Date: Sat, 02 May 2015 20:18:54 +0200

Hi Jürgen,

netconf will be used between a netconf server (Manager) and a networking 
device (netconf client = Analyzer). IDPEF standardize the exchanged 
content so that no additional information is needed at the Manager to 
interpret the exchanged data. With IDPEF it is not relevant which 
vendors of Analyzers and Manager are combined. How could the Manager 
interpret the configuration data of the Analyzer without any additional 
information (e.g. MIB) in the YANG environment? How could I change 
options (e.g. thresholds) of an IDS signature of any IDS vendor with 
YANG without additional information on the netconf server?

kind regards

Björn-C.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Sat, 2 May 2015 22:04:35 +0200

I am confused by 'netconf server (Manager) and a networking device
(netconf client = Analyzer)'. This is not how NETCONF usually works: A
device runs a NETCONF server and a management application a NETCONF
client.

Anyway, the way things work with NETCONF and YANG is that you define a
YANG data model that is understood by both the NETCONF server and the
NETCONF client.

I admit that I do not know much about your specific use case but if
you make statements that sound like YANG models have to proprietary
and hence IDPEF has an advantage because it is standardized, then you
need to be able to defend that.

/js

On Sat, May 02, 2015 at 08:18:54PM +0200, B.-C. Boesch wrote:
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag