Subject: [sacm] Next Steps

From: Adam Montville <[email-masked]>
Date: Fri, 3 Aug 2012 17:43:28 +0000

All:

Yesterday's meeting went very well, in my opinion - thank you to all who
attended and participated.  We received a lot of very good advice, and we
have a lot of work to do.  It seems that the first order of business is
really getting our use cases and charter squared off, with a goal of
getting an acceptable draft charter done within the next four to six
weeks.  I propose that we shoot for five weeks (September 7), provided
that is enough time to submit before Atlanta.

With respect to the use cases, there seemed to be some agreement that we
would focus on use cases 1 and 3 ("Acceptance and Enforcement of
Acceptable State" and "Security Control Verification and Monitoring"
respectively).  I'm assuming that Dave will continue acting as the editor
for the use case document and that Kent will continue acting as the editor
for the charter.

There has already been excellent discussion on the list regarding the
above, and I hope to see this continue.  Dave and Kent, can each of you
provide a list of things that need to get done for each document so we can
effectively track the work (I'm willing to do the tracking)?

I would also like to propose that we consider two additional informational
drafts.  The first would provide additional background and motivation for
the use cases - essentially tying them, in a very generic way, to the
business processes that would leverage security automation and continuous
monitoring standards to their benefit.  The second would be an
informational glossary sacm, and other efforts, could leverage to help us
all stay on the same page.

If these are things the community would find useful, I would certainly
volunteer to draft them.

Finally, if it makes sense, perhaps we should set up a weekly call for the
next few weeks, especially with respect to the charter.  I can provide
dial-in details for these calls.  If this is deemed a good idea by the
community, we can work out an acceptable time that will accommodate our
international base.

Regards,

Adam

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 3 Aug 2012 14:01:49 -0400

Adam,

Thanks for sending this out.  I agree on your timeframe for the charter and would be glad to participate in the effort to complete the draft.

I am also happy to continue editing the use case draft.  I like your idea of providing some background information and use case motivations.  I also see a glossary as useful.  In these cases, there are existing sections in the use cases draft that map to these items.  The "1. Introduction" and "2 Key Concepts" sections would be a good place for the background information.  One possible approach for capturing motivations might be to include them in each of the use case sections.  We could add a new section for a glossary maybe under key concepts or as a standalone section.  I personally like this approach better than creating multiple drafts that would make the information much more disconnected and harder to follow.

If this approach is acceptable, would you be interested in co-editing the use case draft with me to work in this content?

As for holding weekly meetings, I think this is a great idea that will allow us to move more efficiently.  Would you send 2-3 day/time options that we can use to develop some consensus on a timeslot?

Thanks,
Dave
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Adam Montville [[email-masked]]
Sent: Friday, August 03, 2012 7:43 PM
To: [email-masked]
Subject: [sacm] Next Steps

All:

Regards,

Adam

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: Adam Montville <[email-masked]>
Date: Fri, 3 Aug 2012 20:02:56 +0000

On 8/3/12 11:01 AM, "Waltermire, David A." <[email-masked]>
wrote:

>Adam,
>
>Thanks for sending this out.

You're welcome.

>I agree on your timeframe for the charter and would be glad to
>participate in the effort to complete the draft.

Great!

>
>I am also happy to continue editing the use case draft.  I like your idea
>of providing some background information and use case motivations.  I
>also see a glossary as useful.  In these cases, there are existing
>sections in the use cases draft that map to these items.  The "1.
>Introduction" and "2 Key Concepts" sections would be a good place for the
>background information.  One possible approach for capturing motivations
>might be to include them in each of the use case sections.  We could add
>a new section for a glossary maybe under key concepts or as a standalone
>section.  I personally like this approach better than creating multiple
>drafts that would make the information much more disconnected and harder
>to follow.

I'm not certain I agree (which is not to say that I disagree).  The
motivations for these use cases are, when you trace it all back to
business processes, not brief.  The skeletal document I've been working on
already contains about five pages of overview and expands to ten when
simply enumerating information security controls and required models
(where the enumerated controls and models are only placeholders).  Perhaps
not all of that information is perceived as being required, but I think
this type of information would be useful in setting the exact context in
which we intend to work and from which the use cases are derived.  In
short, I think it would enable us to be much more focused in our efforts.

That said, we could pare the overarching information down a bit to fit it
in to the use case document and decide at a later time whether a more
comprehensive, distinct document is required based on perceived demand
from the sacm and other communities.

With respect to the glossary, I'm thinking that this will be more or less
a living document with published updates every so often as we address new
problems.  Does a referential glossary of terms belong in a use case
document?  If I approach this effort using software architecture
communication mechanisms as a guide, the glossary would be distinct from
other documents.

In fact, if we take that type of approach, we would be inclined to create
a couple of different "meta" documents, which to me would include a "frame
of reference," "derived use cases," and a "glossary" to start.  Our data
models would then be the conceptual details of the use cases we decide to
tackle, and the specific bindings (I.e. to XML, or whatever) would be the
lower-level logical details.  Using this type of approach might prove to
be useful not only to us, but to the other IETF working groups with which
we need to cooperate.

This seems like a lot of work to get done within a short timeframe, but
I'm willing to put in a little extra effort over the short term to help
ensure our long term success.

>
>If this approach is acceptable, would you be interested in co-editing the
>use case draft with me to work in this content?

Yes.

>
>As for holding weekly meetings, I think this is a great idea that will
>allow us to move more efficiently.  Would you send 2-3 day/time options
>that we can use to develop some consensus on a timeslot?

Yes.  How would these options work for everyone wishing to participate in
these meetings (all times Eastern)?

   Monday   08:00 - 09:00
   Tuesday  08:00 - 09:00
   Thursday 08:00 - 09:00

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 3 Aug 2012 16:07:53 -0400

Regarding the Use Case/Background/Glossary discussion, it would be interesting to consider what IETF WGs have done in this regard.  I think it makes sense to follow the "IETF approach" to this kind of exercise.

Does anyone have any guidance based on historic examples?

Dave

----- Original Message -----
From: Adam Montville <[email-masked]>
To: Waltermire, David A.; [email-masked] <[email-masked]>
Sent: Fri Aug 03 16:02:56 2012
Subject: Re: Next Steps

You're welcome.

Great!

Yes.

   Monday   08:00 - 09:00
   Tuesday  08:00 - 09:00
   Thursday 08:00 - 09:00

---

From: Sean Turner <[email-masked]>
Date: Fri, 03 Aug 2012 14:29:18 -0700

There are drafts that address each one and then there are drafts that do 
all three.  Regardless of which choice you make somebody will say that 
it would have better to have made the other choice ;) I'd not spend too 
much time worrying about which path to take - unless it's going to be 
300 pages.

spt

---

From: Stephen Hanna <[email-masked]>
Date: Fri, 3 Aug 2012 18:25:57 -0400

Could we get a glimpse at the latest draft Background document before
we decide whether it should be added to the use cases? I'd be glad
to have more background for the use cases (either as one doc or two)
but I'm a bit concerned about documenting business processes. Those
vary widely from one enterprise to the next. We shouldn't tie
ourselves to one set of business processes.

I'm perfectly fine with having a Glossary document, if we end up
using a lot of special words. If it's only a few (less than 30-40),
it will be easier to just include a glossary section in each document
or (maybe even better) in an Overview document with use cases and a
reference model, as we did in NEA with RFC 5209.

Thanks,

Steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Sean Turner
> Sent: Friday, August 03, 2012 5:29 PM
> To: Waltermire, David A.
> Cc: [email-masked]'; [email-masked]'
> Subject: Re: [sacm] Next Steps
> 
> > Regarding the Use Case/Background/Glossary discussion, it would be
> interesting to consider what IETF WGs have done in this regard.  I
> think it makes sense to follow the "IETF approach" to this kind of
> exercise.
> >
> >> From: [email-masked] [[email-masked]] On Behalf Of
> Adam
> >> Montville [[email-masked]]

---

From: Adam Montville <[email-masked]>
Date: Fri, 3 Aug 2012 22:38:33 +0000

I'll get something out tomorrow. Just landed.

Sent from my iPhone

---

From: Michael Hammer <[email-masked]>
Date: Fri, 3 Aug 2012 22:48:55 +0000

I think there is lots of flexibility as long as it is an ID.
You can always merge IDs later, if that makes sense.
Or split as well.
After all, they expire in 6 months anyway.  :)

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Waltermire, David A.
Sent: Friday, August 03, 2012 4:08 PM
To: [email-masked]'; [email-masked]'
Subject: Re: [sacm] Next Steps

Regarding the Use Case/Background/Glossary discussion, it would be
interesting to consider what IETF WGs have done in this regard.  I think it
makes sense to follow the "IETF approach" to this kind of exercise.

Dave

----- Original Message -----
From: Adam Montville <[email-masked]>
To: Waltermire, David A.; [email-masked] <[email-masked]>
Sent: Fri Aug 03 16:02:56 2012
Subject: Re: Next Steps

You're welcome.

Great!

>
>I am also happy to continue editing the use case draft.  I like your 
>idea of providing some background information and use case motivations.  
>I also see a glossary as useful.  In these cases, there are existing 
>Introduction" and "2 Key Concepts" sections would be a good place for 
>the background information.  One possible approach for capturing 
>motivations might be to include them in each of the use case sections.  
>We could add a new section for a glossary maybe under key concepts or 
>as a standalone section.  I personally like this approach better than 
>creating multiple drafts that would make the information much more 
>disconnected and harder to follow.

I'm not certain I agree (which is not to say that I disagree).  The
motivations for these use cases are, when you trace it all back to business
processes, not brief.  The skeletal document I've been working on already
contains about five pages of overview and expands to ten when simply
enumerating information security controls and required models (where the
enumerated controls and models are only placeholders).  Perhaps not all of
that information is perceived as being required, but I think this type of
information would be useful in setting the exact context in which we intend
to work and from which the use cases are derived.  In short, I think it
would enable us to be much more focused in our efforts.

That said, we could pare the overarching information down a bit to fit it in
to the use case document and decide at a later time whether a more
comprehensive, distinct document is required based on perceived demand from
the sacm and other communities.

With respect to the glossary, I'm thinking that this will be more or less a
living document with published updates every so often as we address new
problems.  Does a referential glossary of terms belong in a use case
document?  If I approach this effort using software architecture
communication mechanisms as a guide, the glossary would be distinct from
other documents.

In fact, if we take that type of approach, we would be inclined to create a
couple of different "meta" documents, which to me would include a "frame of
reference," "derived use cases," and a "glossary" to start.  Our data models
would then be the conceptual details of the use cases we decide to tackle,
and the specific bindings (I.e. to XML, or whatever) would be the
lower-level logical details.  Using this type of approach might prove to be
useful not only to us, but to the other IETF working groups with which we
need to cooperate.

This seems like a lot of work to get done within a short timeframe, but I'm
willing to put in a little extra effort over the short term to help ensure
our long term success.

>
>If this approach is acceptable, would you be interested in co-editing 
>the use case draft with me to work in this content?

Yes.

   Monday   08:00 - 09:00
   Tuesday  08:00 - 09:00
   Thursday 08:00 - 09:00

>Yesterday's meeting went very well, in my opinion - thank you to all 
>who attended and participated.  We received a lot of very good advice, 
>and we have a lot of work to do.  It seems that the first order of 
>business is really getting our use cases and charter squared off, with 
>a goal of getting an acceptable draft charter done within the next four 
>to six weeks.  I propose that we shoot for five weeks (September 7), 
>provided that is enough time to submit before Atlanta.
>
>With respect to the use cases, there seemed to be some agreement that 
>we would focus on use cases 1 and 3 ("Acceptance and Enforcement of 
>respectively).  I'm assuming that Dave will continue acting as the 
>editor for the use case document and that Kent will continue acting as 
>the editor for the charter.
>
>provide a list of things that need to get done for each document so we 
>can effectively track the work (I'm willing to do the tracking)?
>
>I would also like to propose that we consider two additional 
>informational drafts.  The first would provide additional background 
>and motivation for the use cases - essentially tying them, in a very 
>generic way, to the business processes that would leverage security 
>automation and continuous monitoring standards to their benefit.  The 
>second would be an informational glossary sacm, and other efforts, 
>could leverage to help us all stay on the same page.
>
>Finally, if it makes sense, perhaps we should set up a weekly call for 
>the next few weeks, especially with respect to the charter.  I can 
>provide dial-in details for these calls.  If this is deemed a good idea 
>by the community, we can work out an acceptable time that will 
>accommodate our international base.
>
>Regards,
>
>Adam
>
>

---

From: Adam Montville <[email-masked]>
Date: Sat, 4 Aug 2012 20:26:03 +0000

Hi Steve,

Here's what I have.  Please note a few things.  First, it's still in very
rough form and will likely need a few more passes before it would be
concise enough (that's my guess anyway).  Second, the format may not be
correct - I'm experimenting with the nroff editor and formatting can be
updated easily enough so it's more important to focus on the message.
Third, some stakes are put in the ground with respect to common security
controls and derived information models, but they're intended to spark a
conversation - not a flameŠ

All that said, have a look, and if it makes sense we can continue working
on it.  Otherwise, we'll let it be and turn immediately to the use cases
and charter.

Regards,

Adam

On 8/3/12 3:25 PM, "Stephen Hanna" <[email-masked]> wrote:

>> idea
>> who
>> editor
>> informational

---

From: Luis Nunez <[email-masked]>
Date: Sat, 4 Aug 2012 17:40:26 -0400

Adam,
thank you for putting this together.  It is a great read and it sets the context for building a security communications model we need now and for the foreseeable future.

I think we see through sections 3.1 and 3.2 as a means to connect to the use cases.

-ln

On Aug 4, 2012, at 4:26 PM, Adam Montville wrote:

> <draft-ietf-sacm-frame-of-reference-00.txt>_______________________________________________
> sacm mailing list
> [email-masked]