Subject: Re: [sacm] Perception of the term "Monitoring"

From: "Roger Callahan" <[email-masked]>
Date: Wed, 29 Aug 2012 09:54:34 -0400

Steve,

In looking at a version of the original draft charter and recognizing the
groups  focus is "security information" , I noted the draft  did have a
context that went beyond security; namely, 

" 1.Define, either by normative reference, adoption, or creation, a set of
standards that can be used for the purpose of assessing, aggregating and
comparing device states against expected values, and reporting on those
results in a predefined or ad hoc manner.",  And  

"3. Create relationships between existing operations management standards to
enable a comprehensive view of security automation, leveraging existing work
and implementations."

My personal view is that security management needs to be integral process
and part of the configuration management process.  A unique element of the
overall security management is more extensive use of analytics associated
with various information and we know general configuration management for
enterprises ( especially large ones)  does require more automation of the
management challenges.

In a specific new  research initiatives among several Universities we choose
to categorize the overall effort under an umbrella name of "Configuration
Analytics and Automation" for Enterprise IT.      

Versus  monitoring, compliance, diagnostics, continuous, enforcement, etc.
which are all sub-processes or outcomes; and if the context is specifically
to be only "security" - the group may want to consider "Security
Configuration Analytics and Automation (SCAA) as a name.

Roger Callahan
Information Assurance Advisory, LLC
Charlotte, NC

-----Original Message-----
From: Stephen Hanna [mailto:[email-masked]] 
Sent: Wednesday, August 29, 2012 8:50 AM
To: Moriarty, Kathleen; Baker, Jon; 'sacm'
Subject: Re: [sacm] Perception of the term "Monitoring"

I'm not sure that would be beneficial, overall. The term "security
automation" has many broad definitions that far exceed the proposed charter.
I'd like to see a WG name that reflects the actual scope of the charter. But
we could consider Continuous Diagnostics and Mitigations for the WG/BOF
name.

I still like Adam's suggestion: Acceptable State/Security Enforcement and
Setting Support (ASSESS). It's cute, has a good acronym, and reflects the
proposed scope. But I'm sure the group will reach consensus on a good name.

Thanks,

Steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf 
> Of Moriarty, Kathleen
> Sent: Wednesday, August 29, 2012 8:42 AM
> To: Baker, Jon; 'sacm'
> Subject: Re: [sacm] Perception of the term "Monitoring"
> 
> Interesting suggestion, that could also let us keep the acronym and 
> list in tact with the use of a lower case d...
> 
> Thanks,
> Kathleen
> ________________________________________
> From: [email-masked] [[email-masked]] On Behalf Of 
> Baker, Jon [[email-masked]]
> Sent: Wednesday, August 29, 2012 8:28 AM
> To: 'sacm'
> Subject: Re: [sacm] Perception of the term "Monitoring"
> 
> I believe there are some US Gov leads that are considering using 
> "continuous diagnostics and Mitigations" as a replacement for 
> continuous monitoring. It might be nice to align sacm terms.
> 
> 
> 
> Sent with Good (www.good.com)
> 
> 
> -----Original Message-----
> From: Stephen Hanna [[email-masked]<mailto:[email-masked]>]
> Sent: Wednesday, August 29, 2012 08:19 AM Eastern Standard Time
> To: Adam Montville; [email-masked]; [email-masked]
> Cc: Adam W. Montville
> Subject: Re: [sacm] Perception of the term "Monitoring"
> 
> 
> I agree. Many users are uncomfortable with the idea of having someone 
> or something monitoring their *activities*, which is what people often 
> think when they think of monitoring.
> 
> However, there's not much problem with taking existing systems for 
> checking security compliance of corporate-owned devices and moving 
> that from periodic and occasional compliance assessments to continuous 
> ones. I think that's what we're talking about here.
> 
> So I think that "continuous compliance" or "continuous assessment"
> would be a good terms. Let's drop the word "monitoring" altogether 
> since it is often misunderstood.
> 
> Thanks,
> 
> Steve
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]] On Behalf
> Of
> > Adam Montville
> > Sent: Wednesday, August 29, 2012 8:08 AM
> > To: [email-masked]; [email-masked]
> > Cc: Adam W. Montville
> > Subject: Re: [sacm] Perception of the term "Monitoring"
> >
> > Responding on vacation - copying a personal address for off-thread 
> > contact, if needed.
> >
> > Remaining comments inline.
> >
> >
> > On 8/29/12 5:01 AM, "[email-masked]"
> <[email-masked]>
> > wrote:
> >
> > >
> > >
> > >
> > >
> > >A large number of hits associate monitoring with employee
> monitoring,
> > >ethical monitoring, telephone-use employee monitoring, performance 
> > >monitoring, computer behavior monitoring,  etc.
> > >Perhaps it is not a bad idea to dissociate the SACM effort from the 
> > >perceived impression that we are building tools for a ³Big Brother²
> > kind
> > >of society.
> >
> >
> >
> > Thanks for the additional insight, David - I think it bolsters the
> case
> > nicely.
> >
> >
> >
> > >
> > >David Oliva
> > >
> > >
> > >
> > >On 08/27/12,
> > >David Solin<[email-masked]> wrote:
> > >
> > >
> > >Google "continuous monitoring" (~7 million results), and you'll see
> > why
> > >people who have spent a long time working with the US government
> think
> > >it's a good fit for what we're talking about.
> > >
> > >Google "continuous compliance" (~48 million results), and you'll 
> > >see
> > why
> > >people who have spent a long time working with commercial 
> > >enterprise software think it's a good fit for what we're talking 
> > >about.  You'll
> > also
> > >notice a lot of the same links from the first  list.
> > >
> > >And that's why I think "continuous compliance" is a better fit.  It
> > also
> > >has the benefit of being in current use by vendors and analysts, 
> > >and
> > so
> > >the marketplace wouldn't need to be trained to understand it.
> >
> >
> >
> > It's the "continuous" part that matters to the effort, not the 
> > "monitoring" part.
> >
> > To me, it's 100% acceptable to drop the term "monitoring" in favor 
> > of
> a
> > replacement, and I would, in fact, prefer to do so.
> >
> > Others?
> >
> >
> >
> > _______________________________________________
> > sacm mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/sacm
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm