Subject: Re: [sacm] Perception of the term "Monitoring"

From: "Baker, Jon" <[email-masked]>
Date: Wed, 29 Aug 2012 12:28:39 +0000

I believe there are some US Gov leads that are considering using "continuous diagnostics and Mitigations" as a replacement for continuous monitoring. It might be nice to align sacm terms.

Sent with Good (www.good.com)

-----Original Message-----
From: Stephen Hanna [[email-masked]<mailto:[email-masked]>]
Sent: Wednesday, August 29, 2012 08:19 AM Eastern Standard Time
To: Adam Montville; [email-masked]; [email-masked]
Cc: Adam W. Montville
Subject: Re: [sacm] Perception of the term "Monitoring"

I agree. Many users are uncomfortable with the idea of having
someone or something monitoring their *activities*, which is
what people often think when they think of monitoring.

However, there's not much problem with taking existing systems
for checking security compliance of corporate-owned devices and
moving that from periodic and occasional compliance assessments
to continuous ones. I think that's what we're talking about here.

So I think that "continuous compliance" or "continuous assessment"
would be a good terms. Let's drop the word "monitoring" altogether
since it is often misunderstood.

Thanks,

Steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Adam Montville
> Sent: Wednesday, August 29, 2012 8:08 AM
> To: [email-masked]; [email-masked]
> Cc: Adam W. Montville
> Subject: Re: [sacm] Perception of the term "Monitoring"
>
> Responding on vacation - copying a personal address for off-thread
> contact, if needed.
>
> Remaining comments inline.
>
>
> On 8/29/12 5:01 AM, "[email-masked]" <[email-masked]>
> wrote:
>
> >
> >
> >
> >
> >A large number of hits associate monitoring with employee monitoring,
> >ethical monitoring, telephone-use employee monitoring, performance
> >monitoring, computer behavior monitoring,
> > etc.
> >Perhaps it is not a bad idea to dissociate the SACM effort from the
> >perceived impression that we are building tools for a ³Big Brother²
> kind
> >of society.
>
>
>
> Thanks for the additional insight, David - I think it bolsters the case
> nicely.
>
>
>
> >
> >David Oliva
> >
> >
> >
> >On 08/27/12,
> >David Solin<[email-masked]> wrote:
> >
> >
> >Google "continuous monitoring" (~7 million results), and you'll see
> why
> >people who have spent a long time working with the US government think
> >it's a good fit for what we're talking about.
> >
> >Google "continuous compliance" (~48 million results), and you'll see
> why
> >people who have spent a long time working with commercial enterprise
> >software think it's a good fit for what we're talking about.  You'll
> also
> >notice a lot of the same links from the first
> > list.
> >
> >And that's why I think "continuous compliance" is a better fit.  It
> also
> >has the benefit of being in current use by vendors and analysts, and
> so
> >the marketplace wouldn't need to be trained to understand it.
>
>
>
> It's the "continuous" part that matters to the effort, not the
> "monitoring" part.
>
> To me, it's 100% acceptable to drop the term "monitoring" in favor of a
> replacement, and I would, in fact, prefer to do so.
>
> Others?
>
>
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 29 Aug 2012 08:42:23 -0400

Interesting suggestion, that could also let us keep the acronym and list in tact with the use of a lower case d...

Thanks,
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Baker, Jon [[email-masked]]
Sent: Wednesday, August 29, 2012 8:28 AM
To: 'sacm'
Subject: Re: [sacm] Perception of the term "Monitoring"

-----Original Message-----
From: Stephen Hanna [[email-masked]<mailto:[email-masked]>]
Sent: Wednesday, August 29, 2012 08:19 AM Eastern Standard Time
To: Adam Montville; [email-masked]; [email-masked]
Cc: Adam W. Montville
Subject: Re: [sacm] Perception of the term "Monitoring"

Thanks,

Steve

---

From: Stephen Hanna <[email-masked]>
Date: Wed, 29 Aug 2012 08:50:26 -0400

I'm not sure that would be beneficial, overall. The term
"security automation" has many broad definitions that far
exceed the proposed charter. I'd like to see a WG name
that reflects the actual scope of the charter. But we
could consider Continuous Diagnostics and Mitigations
for the WG/BOF name.

I still like Adam's suggestion: Acceptable State/Security
Enforcement and Setting Support (ASSESS). It's cute, has
a good acronym, and reflects the proposed scope. But I'm
sure the group will reach consensus on a good name.

Thanks,

Steve

> Moriarty, Kathleen
> Sent: Wednesday, August 29, 2012 8:42 AM
> To: Baker, Jon; 'sacm'
> Interesting suggestion, that could also let us keep the acronym and
> list in tact with the use of a lower case d...
> 
> Thanks,
> Kathleen
> I believe there are some US Gov leads that are considering using
> "continuous diagnostics and Mitigations" as a replacement for
> continuous monitoring. It might be nice to align sacm terms.
> 
> 
>

---

From: Adam Montville <[email-masked]>
Date: Wed, 29 Aug 2012 05:53:18 -0700

> I believe there are some US Gov leads that are considering using "continuous diagnostics and Mitigations" as a replacement for continuous monitoring. It might be nice to align sacm terms.

In terms of replacing the term "monitoring" with something else, this seems good - especially when looking at the larger picture where compliance is not the only diagnostic in which we may be interested.  However, given that we are focusing on UC1 and UC2, which are compliance focused, and given that we have decided to wait on tackling remediation, which is a form of mitigation, I'm not sure that the label "Continuous Diagnostics and Mitigations" would be accurate for our present list of proposed deliverables.

Of course, by that line of reasoning, we should revisit the label "Security Automation" as well (as I believe several others on the list have pointed out in the past), as it reasonably implies a broader scope than just compliance.  

I know we would prefer a clever working group name, but do any of these resonate with anyone?  

Continuous Compliance - "concom" ??
Security Configuration - "seconf" ??
Security Configuration and Continuous Compliance - "SC3" ??
Security Configuration Management - "seconman" ?? (OK, "conman" isn't great, right?)
Security Configuration Management and Continuous Compliance - "scmcc" or "seconmc" ??
Security Configuration Assessment and Compliance - "seconac"
Security Configuration Diagnostics - "second"
Configuration Assessment and Compliance - "cac"

It's going to be difficult to find a name to please everyone, but I think what matters more than a clever abbreviation is that the name describes the effort as clearly as possible.

Others?  

For what it's worth, "diagnostics" is a noun with a couple of definitions, one of which is "the practice or techniques of diagnosis."  It seems UC1 and UC2 are essentially doing this with respect to compliance.  The more I mull it over, the more I actually like "Security Configuration Diagnostics."

> From: Stephen Hanna [[email-masked]]

---

From: David Solin <[email-masked]>
Date: Wed, 29 Aug 2012 07:56:02 -0500

When you invent new terms for anything you're trying to introduce into 
the marketplace, you're swimming against the current.  Also, we really 
aren't addressing mitigation at this point.  I'm also sure the idea of 
continuous mitigation would raise eyebrows for anyone who works in a 
change-controlled environment.

And, since the door has been opened ... I'm not a fan of SACM.  It's too 
close to SCAM.  I'd hate for us to introduce another contentious or 
unfamiliar term to keep a marginal acronym.

Regards,
--David Solin

-- 

jOVAL.org: OVAL implemented in Java.
/Scan any machine from any machine. For free!/
Learn More <http://www.joval.org> | Features 
<http://www.joval.org/features/> | Download 
<http://www.joval.org/download/>

---

From: Michael Hammer <[email-masked]>
Date: Wed, 29 Aug 2012 13:31:37 +0000

Or just refer to it as compliance management.

Probably best not to get too specific to future-proof it.

I always get amused how these naming storms take place.

And in the end someone in IESG gets the final say.

You might want to ping them on magic words to avoid.

That might cut down on the churn.

Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of
David Solin
Sent: Wednesday, August 29, 2012 8:56 AM
To: [email-masked]
Subject: Re: [sacm] Perception of the term "Monitoring"

When you invent new terms for anything you're trying to introduce into the
marketplace, you're swimming against the current.  Also, we really aren't
addressing mitigation at this point.  I'm also sure the idea of continuous
mitigation would raise eyebrows for anyone who works in a change-controlled
environment.

Regards,
--David Solin

Interesting suggestion, that could also let us keep the acronym and list in
tact with the use of a lower case d...
 
Thanks,
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Baker, Jon
[[email-masked]]
Sent: Wednesday, August 29, 2012 8:28 AM
To: 'sacm'
Subject: Re: [sacm] Perception of the term "Monitoring"
 
I believe there are some US Gov leads that are considering using "continuous
diagnostics and Mitigations" as a replacement for continuous monitoring. It
might be nice to align sacm terms.

-----Original Message-----
From: Stephen Hanna [[email-masked] <mailto:[email-masked]>
<mailto:[email-masked]>]
Sent: Wednesday, August 29, 2012 08:19 AM Eastern Standard Time
To: Adam Montville; [email-masked]; [email-masked]
Cc: Adam W. Montville
Subject: Re: [sacm] Perception of the term "Monitoring"

 
 
Thanks,
 
Steve

-----Original Message-----

On 8/29/12 5:01 AM,  <mailto:[email-masked]>
"[email-masked]"  <mailto:[email-masked]>
<[email-masked]>
wrote:

 

kind

of society.

 

David Oliva

On 08/27/12,
David Solin <mailto:[email-masked]> <[email-masked]> wrote:

why

why

also

also

so

 

 
Others?

 

-- 

jOVAL.org: OVAL implemented in Java.
Scan any machine from any machine. For free!
 <http://www.joval.org> Learn More |  <http://www.joval.org/features/>
Features |  <http://www.joval.org/download/> Download

---

From: Luis Nunez <[email-masked]>
Date: Wed, 29 Aug 2012 09:58:07 -0400

early on we ran into issues with the term "continuous management".  Not sure if the word "management" will ignite another storm. 

To me I don't see what the big deal is.  SACM sounds fine with me.  If it causes controversy great.  Getting people interested and engaged is a good thing.

-ln
 
On Aug 29, 2012, at 9:31 AM, Michael Hammer wrote:

> From: [email-masked] [mailto:[email-masked]] On Behalf Of David Solin
> When you invent new terms for anything you're trying to introduce into the marketplace, you're swimming against the current.  Also, we really aren't addressing mitigation at this point.  I'm also sure the idea of continuous mitigation would raise eyebrows for anyone who works in a change-controlled environment.
> 
> And, since the door has been opened ... I'm not a fan of SACM.  It's too close to SCAM.  I'd hate for us to introduce another contentious or unfamiliar term to keep a marginal acronym.
> 
> Regards,
> --David Solin
> 
> 
> Learn More | Features | Download
>

---

From: Michael Hammer <[email-masked]>
Date: Wed, 29 Aug 2012 14:10:33 +0000

BTW, the reason I used those two words was to be less precise.

One can read a number of things into both compliance and management.

You have the option of trying to be more granular or more specific.

The danger I see in too much specificity is that you leave out someone’s
favorite element.

And hence a battle between whose favorites get in or don’t.

My 2 cents.  Now, I will avoid commenting again like the plague.  J

Enjoy,

Mike

From: Luis Nunez [mailto:[email-masked]] 
Sent: Wednesday, August 29, 2012 9:58 AM
To: Michael Hammer
Cc: [email-masked]; [email-masked]
Subject: Re: [sacm] Perception of the term "Monitoring"

early on we ran into issues with the term "continuous management".  Not sure
if the word "management" will ignite another storm. 

To me I don't see what the big deal is.  SACM sounds fine with me.  If it
causes controversy great.  Getting people interested and engaged is a good
thing.

-ln

Mike

Regards,
--David Solin

 
Thanks,
Kathleen

 

-----Original Message-----

 
 
Thanks,
 
Steve

-----Original Message-----

 

kind

of society.

 

David Oliva

On 08/27/12,

why

why

also

also

so

 

 
Others?

 

--

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 29 Aug 2012 10:11:50 -0400

One more point to consider is that the WG name will eventually go away (after we are done with the work items and a group is closed out) and what will live on are the names of standards produced by a working group.

Best regards,
Kathleen 
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Michael Hammer [[email-masked]]
Sent: Wednesday, August 29, 2012 10:10 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [sacm] Perception of the term "Monitoring"

You have the option of trying to be more granular or more specific.
The danger I see in too much specificity is that you leave out someone’s favorite element.
And hence a battle between whose favorites get in or don’t.

My 2 cents.  Now, I will avoid commenting again like the plague.  ☺

Enjoy,
Mike

-ln

Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of David Solin
Sent: Wednesday, August 29, 2012 8:56 AM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] Perception of the term "Monitoring"

Regards,
--David Solin

Thanks,

Kathleen

From: [email-masked]<mailto:[email-masked]> [[email-masked]<mailto:[email-masked]>] On Behalf Of Baker, Jon [[email-masked]<mailto:[email-masked]>]

To: 'sacm'

Sent with Good (www.good.com<http://www.good.com>)

-----Original Message-----

From: Stephen Hanna [[email-masked]<mailto:[email-masked]><mailto:[email-masked]><mailto:[email-masked]>]

To: Adam Montville; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

Cc: Adam W. Montville

Thanks,

Steve

-----Original Message-----

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of

Adam Montville

To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

Cc: Adam W. Montville

contact, if needed.

On 8/29/12 5:01 AM, "[email-masked]"<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]>

wrote:

etc.

kind

of society.

nicely.

David Oliva

On 08/27/12,

David Solin<[email-masked]><mailto:[email-masked]> wrote:

why

why

also

list.

also

so

"monitoring" part.

Others?

sacm mailing list

[email-masked]<mailto:[email-masked]>

sacm mailing list

[email-masked]<mailto:[email-masked]>

sacm mailing list

[email-masked]<mailto:[email-masked]>

--

jOVAL.org<http://jOVAL.org>: OVAL implemented in Java.
Scan any machine from any machine. For free!
Learn More<http://www.joval.org> | Features<http://www.joval.org/features/> | Download<http://www.joval.org/download/>
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Omar Santos (osantos)" <[email-masked]>
Date: Fri, 31 Aug 2012 04:16:08 +0000

You have an excellent point Kathleen!!! 

I think that we are easily making the selection of a WG name far more complicated than the actual standards that are supposed to be our deliverables.

David Solin had a *great* point: "When you invent new terms for anything you're trying to introduce into the marketplace, you're swimming against the current."

If the IETF community is already familiar with SACM, this alias is sacm, we have been talking everything SACM, I suggest we stay with it for now.

Mike Hammer also had a good suggestion of "compliance management"; therefore "Security Automation and Compliance Management", still SCAM..

To be honest, I am more interested to know the agreements/arguments of UC1 + UC3  vs. UC1 + UC2...

Regards,

Omar 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Wednesday, August 29, 2012 10:12 AM
To: Michael Hammer; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [sacm] Perception of the term "Monitoring"

Best regards,
Kathleen 

Enjoy,
Mike

-ln

Mike

Regards,
--David Solin

Thanks,

Kathleen

To: 'sacm'

-----Original Message-----

Cc: Adam W. Montville

Thanks,

Steve

-----Original Message-----

Adam Montville

Cc: Adam W. Montville

contact, if needed.

wrote:

etc.

kind

of society.

nicely.

David Oliva

On 08/27/12,

why

why

also

list.

also

so

"monitoring" part.

Others?

sacm mailing list

sacm mailing list

sacm mailing list

--

---

From: Adam Montville <[email-masked]>
Date: Fri, 31 Aug 2012 05:18:21 -0700

> To be honest, I am more interested to know the agreements/arguments of UC1 + UC3  vs. UC1 + UC2...

At this point there is consensus to go with UC1 and UC3 (the use case document will likely be reformatted with just these two use cases included).  The list archive should have all the relevant arguments and such.

---

From: Adam Montville <[email-masked]>
Date: Fri, 31 Aug 2012 05:21:50 -0700

> I think that we are easily making the selection of a WG name far more complicated than the actual standards that are supposed to be our deliverables.

Agreed.  I would much rather be focusing our energy on getting the content of the charter discussed more completely.  That said, I'd like to propose that we table the discussion of the working group name until Atlanta - unless there's a compelling reason to settle the issue now - and move on to completing the discussion of the draft charter.

---

From: Luis Nunez <[email-masked]>
Date: Fri, 31 Aug 2012 11:31:36 -0400

+1

-ln

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 31 Aug 2012 13:57:29 -0400

+1

Sincerely,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Luis Nunez
Sent: Friday, August 31, 2012 11:32 AM
To: Adam Montville
Cc: Michael Hammer; [email-masked]; Moriarty, Kathleen; [email-masked]; Omar Santos (osantos)
Subject: Re: [sacm] Perception of the term "Monitoring"

+1

-ln

---

From: David Solin <[email-masked]>
Date: Fri, 31 Aug 2012 13:00:02 -0500

I agree it's a fine idea, switching Continuous for Compliance, for the 
sake of both clarity (or politics) and re-use of a name that is just 
temporary anyway.

--