Subject: Re: [netmod] mud documents

From: Michael Richardson <[email-masked]>
Date: Fri, 08 Apr 2016 16:05:00 -0400

Eliot and I have been conversing about policies.  I proposed that I want a
policy like:

He asked me three questions:

0 what happens when the policy enforcement point (PEP) that actually
  operationalizes the policy does not understand the policy in its
  entirety? Does it implement what it can, or does it discard?

1 Where does connections per unit of time fit in the above?
2 Where does logging/notification fit into the above?

I proposed that we wanted policies like this:

>---<
I am a printer.
I accept connections on the IPP port.
Please be suspicious when the connections are non-local.

Eliot asked:
    > There is no concept today of <be-suspicious>.  Let me ask what network
    > behavior you would associate with that?

I answered:
mcr> Consider blocking them if they occur too frequently, or the
mcr> connections have a small number of RTTs.

I also think that the "be-suspicious" part might be significantly modified by
local policy.  It could be that this results in no connections, it could be
that it must be approved by an admin, that it's subject to some kind of
site-wide ACL (such connections from the VPN, intranet and partners okay, not
the wild internet...)

We discussed whether we could clearly articulate other policies like
connections/minute or connections/day that would be not-suspicious.

I also suggested that this could extend beyond "THINGS" to *APPS* as well:

   consider that the MUD could well be packaged with PC/Android/iPhone
   *apps* as part of their security profile.
   SELinux pretends to do this, but in practice configuring it is still close
   to impossible.  The MUD specification would help a lot I think.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-