<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Cool – yeah, the “Defining CI/CE” deck is more appropriate for the NCAP Study work product as it contains details like port/protocol actions that are not yet defined anywhere (that I’ve seen).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The “Honeypots: A Cost-Benefit Analysis” deck is more appropriate for your document as it’s a comparison of techniques. Let me know what you think of that one.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Jeff<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> NCAP-Discuss <ncap-discuss-bounces@icann.org> <b>
On Behalf Of </b>Casey Deccio<br>
<b>Sent:</b> Wednesday, November 9, 2022 3:48 PM<br>
<b>To:</b> ncap-discuss@icann.org<br>
<b>Subject:</b> Re: [NCAP-Discuss] Defining CI/CE<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Jeff,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm just looking at this now (apparently I missed it back in February). I think that the issues (happily, but not surprisingly) correlate very well with those in the comparison doc. In particular:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">1. "<span style="color:black">TCP/!(80 & 443)" [1] -> </span>On SYN return RST" and <span style="color:black">"UDP/all -> Drop"</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> - considered in "User Experience" under "Communication Interruption". The differences are:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> - the comparison doc doesn't really specify which ports/applications, but rather speaks more generically (because, again, it doesn't seek to define/specify).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> - the comparison doc proposes suggests that UDP is responded to with ICMP port unreachable for "quick response" rather than dropping.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">2. "TCP/80"<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:black"> - considered in "User Experience" under "Communication Interception" / "Web Browser / HTTP"<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">3. "TCP/443"<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:black"> - considered in "User Experience" under "Communication Interception" / "Web Browser / HTTPS"<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">4. "Timestamp, IP, sport, dport":</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> - considered in "Telemetry".</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><br>
<br>
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">5. "SSL Certificate Note":</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> - There is a whole discussion on this in the "User Experience" section under "Communication Interception" / "Web Browser / HTTPS".</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><br>
<br>
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Casey</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">[1] Should be "!(80 | 443)" :)<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Nov 9, 2022, at 10:38 AM, Jeff Schmidt via NCAP-Discuss <<a href="mailto:ncap-discuss@icann.org">ncap-discuss@icann.org</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Agreeing with Matt (L) - recall in Feb I sent the below/attached to this list attempting to pin down some pesky technical details on these techniques being promoted. My content is only intended to be a starting point - I would love to see
the promoters of these techniques make additions/corrections so at least we're debating from a common frame of reference.<br>
<br>
Jeff<br>
<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt">-----Original Message-----<br>
From: Jeff Schmidt <<a href="mailto:jschmidt@jasadvisors.com">jschmidt@jasadvisors.com</a>><br>
Sent: Friday, February 25, 2022 6:28 PM<br>
To: <a href="mailto:ncap-discuss@icann.org">ncap-discuss@icann.org</a><br>
Subject: Re: [NCAP-Discuss] Defining CI/CE<br>
<br>
Sorry, I was too imprecise in my SSL certificate language in the last one.<br>
Please replace with this one.<br>
<br>
Thx,<br>
Jeff<br>
<br>
<br>
On 2/25/22, 6:20 PM, "NCAP-Discuss on behalf of Jeff Schmidt via NCAP-<br>
Discuss" <<a href="mailto:ncap-discuss-bounces@icann.org">ncap-discuss-bounces@icann.org</a> on behalf of ncap-<br>
<a href="mailto:discuss@icann.org">discuss@icann.org</a>> wrote:<br>
<br>
All:<br>
<br>
I think a very important point has come out of this discussion - one of the<br>
reasons for the circular arguments is that we have never carefully defined CE<br>
and therefore we're operating under a number of assumptions which have<br>
vastly different implementation outcomes. Credit to Matt L and Danny for<br>
pointing this out.<br>
<br>
Attached is my shot at a careful technical definition of the Controlled<br>
Interruption and Controlled Exfiltration options. We need to come to<br>
consensus on this before we can further discuss/recommend. The attached<br>
is the most conservative technical approach I can think of. This is just a<br>
strawman to start the conversation. I'm happy to be wrong on any/all of this.<br>
But no more glossing over the details - let's be super specific.<br>
<br>
I would suggest the Chair(s) "force the issue" and call for consensus on this<br>
as quickly as discussion allows. Our lack of fundamental agreement here is<br>
blocking progress on this important item.<br>
<br>
Thx,<br>
Jeff<br>
<br>
<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
<NCAP Implementation Spec2.pptx>_______________________________________________<br>
NCAP-Discuss mailing list<br>
<a href="mailto:NCAP-Discuss@icann.org">NCAP-Discuss@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/ncap-discuss">https://mm.icann.org/mailman/listinfo/ncap-discuss</a><br>
<br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy">https://www.icann.org/privacy/policy</a>)
and the website Terms of Service (<a href="https://www.icann.org/privacy/tos">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery
or disabling delivery altogether (e.g., for a vacation), and so on.<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>