Subject: [sacm] Strategic alignment of security with business in SACM in an international context

From: [email-masked]
Date: Wed, 08 Aug 2012 09:22:10 -0500 (CDT)

Luis and all:

Unless we can demonstrate that the technologies and specifications we are developing align with the security objectives of international compliance models (such as ISO 27001) we cannot demonstrate strategic alignment of business and security objectives in their context.

Strategic alignment of security objectives with business objectives can be at least partially joined via SACM thru the SP 800-53 to ISO 27001 mapping table.  If this were to happen to SACM then the validated products will have less appeal and less marketability. The validated products will work fine, but they will work with limited capability and scope.  For example, currently validated SCAP 1.0 products do not use the Open Checklist Interactive Language (OCIL).   OCIL is an open specification (created by the security community for use by anybody, any developer, any country) that facilitates non-automated assessment of security processes.  OCIL would allow an ISO 27001 compliance assessor in Germany to create a question “Does the organization comply ISO/IEC 27001:2005 para 4.2.2 e) ‘Does the organization implement a training and awareness programme’” and answer ‘yes’ or ‘no’.  Then the results can be accessed and read whether the organization uses product X or product Y because OCIL is an open security specification.  Another example of OCIL is a rather mundane security function of universal use.  OCIL allows an ISO 27001 security compliance officer to answer ‘yes’ or ‘no’ to the question “Is the door shut?” and make the result electronically readable whether he/she uses product X or product Y.  As for business, the flexibility of OCIL allows a company to create a question “Did the company reach our 7% profit strategic objective over the past 10 years?” and able to answer it ‘yes’ or ‘no’ with product X, Y, or Z and ensure interoperability.

David Oliva

On 08/07/12, Luis Nunez<[email-masked]> wrote:

Thanks the comment.  I am glad someone agrees with me :)

-ln

On Aug 7, 2012, at 11:46 AM, [email-masked] wrote:

Luis and all:

You are on target.

SACM is not a law enforcement thing, but is a facilitator of legal issues in association with the protection of private information and health-related information.

I think a couple of examples to show how SACM facilitates legal issues about personal information is in order.

A SACM configuration scanner is able to monitor the configuration of security controls as specified in ISO/IEC 27001:2005.  This can be accomplished when tier IV SCAP content is used because the output maps the finding (compliance or non-compliance) of the scanner to security control ISO/IEC 27001:2005 paragraph A.10.6.2 “Security of Network Services”.  Thus a SACM scanner is able to assist in international governance compliance about personal information because SP 800-53 maps to ISO 27001.

A SACM vulnerability scanner is able to meet compliance with ISO 27001, para A.12.6.1 “Control of technical vulnerabilities” because a SACM scanner using SCAP tier IV content can map its output to the ISO governance.  SACM Vulnerability scanning can address aspects of confidentiality of personal information by identifying software vulnerabilities of the databases that house them, and do it in the context of an international set of security standards.

David Oliva

On 08/06/12, Luis Nunez<[email-masked]> wrote:

Looking at it another way I could see security automation as a way to discover if a system is configured to meet privacy policies .

Security automation is an enabler for transparency  so that individuals and organizations may understand the complex computing environment.

Thanks for bring up this issue.  As a community we may want to look at building content around privacy controls.

-ln

On Aug 6, 2012, at 12:42 PM, <[email-masked]> wrote:

None of the efforts we are talking about for SACM are targeted toward PII or individuals. They are targeted at the configuration of the platforms deployed in the enterprise to assure they comply with the site's security policy.  PII is not collected. This is not monitoring of individual or employee actions.  I am not a lawyer and will not speak as one. We will let the lawyer's decide at the appropriate time.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com

From: Martin Rex <[email-masked]>
Reply-To: "[email-masked]" <[email-masked]>
Date: Monday, August 6, 2012 11:32 AM
To: "[email-masked]" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [sacm] Legal aspects of System monitoring

Tony Rutkowski wrote:

Martin Rex wrote:

In Germany, an employer monitoring a company-owned PC that an employee uses

for communication (EMail, VoiP, IM) would be unconditionally illegal.

Really?

No kidding!

That is not consistent with comments

I've seen concerning German law.

There is a significant amount of mis-information floating the internet.

And a mindboggling large number of lawyers are making wild guesses, rather

that doing research.

The decisions of the german federal constitional court (GFCC) have been

quite consistent over the past decade about what with respect to

encroaching on the general right of personality, informational

self-determination, freedom of conduct and created a "fundamental right

to the guarantee of the integrity and confidentiality of information

technology systems".  The court has set the minimum requirements that

are prerequisite to such encroachment, such as the prerequisite of a

clear formal statute law, which needs to be limited to situation where

real facts create probable cause.

The original GFCC decision in german language is quite comprehensible

(to me, at least), while I'm having some difficulties understanding

the english translation (and the english translation is shorter!?).

BVerfG-Entscheidung "1 BvR 370/07 vom 27.2.2008" Randnummer 196-

http://www.bverfg.de/entscheidungen/rs20080227_1bvr037007.html#abs196

english translation of "1 BvR 370/07 vom 27.2.2008"

http://www.bverfg.de/entscheidungen/rs20080227_1bvr037007en.html#abs130

To be *unconditionally* illegal, would

preclude almost any rationally required

maintenance or threat mitigation.

It is possible to perform maintenance and threat mitigation entirely

without "monitoring" systems.

A mere threat is insufficient for monitoring, if that involves collecting

PII data, i.e. data from which a persons conduct can be infered.

It is fair to observe that recent German

Constitutional Court decisions impose

constraints, but they certainly are

not "unconditional."

One of the prerequisite is a clear formal statute law,

which currently does not exist for the purposes "sacm" is about.

quoting from the above GFCC decision:

2. The fundamental right to the guarantee of the confidentiality and

integrity of information technology systems is not unrestricted.

Encroachments may be justified both for preventive purposes, and for

criminal prosecution.  The individual must only accept such restrictions

of his or her right which are based on a statutory foundation that

is constitutional.

This currently makes collecting data about peoples conduct "unconditionally"

illegal for most practical purposes (exempting from prosecution only

individual occasions of justified self-defence against an imminent

vicious attack based on real facts that create probable cause).

This applies to all surveillance that impairs persons "freedom of conduct".

The majority of past decisions of specific events was about surveillance

with a camera, but the GFCC decision makes it crystal clear that

this applies to *any* kind of surveillance.  Different to monitoring of

computer systems, there is statutory law for camera surveillance,

that allows optical surveillance under certain conditions

(Art. 6b BDSG "BundesDatenSchutzGesetz).

The lack of a formal statutory foundation makes surveillance illegal

and entitles subjects to "cease and desist" rulings and sometimes

damages.

In one more recent (and constitutionally correct) rulings, an employer

had put up a camera that had in view not only the entrance door, but

also two workplaces.  The employees protested against this camera,

but the employer would not "fix" it, so at least one employee sued,

The court confirmed that this camera surveillance at the workplace

was illegal due to its chilling effect alone, and since it had been

installed for a whole year, the employee was arwarded 4 month of income

as damages (for the chilling effect).

Another recent decision was about evidence from a covert video

surveillance showing an employee taking a package of cigarettes

on two occasions, where the German Federal Labour Court

(the supreme court for labor related issues) remanded the decision

to the trial court because it had failed to establish whether the

covert video surveillance really met all constitutional prerequisites

otherwise the video surveillance would have been illegal and not

be admissible as evidence in court.

(German decision: http://lexetius.com/2012,2351)

The German Federal Constitional Court neutered numerous laws during the

last decade due to lack of clarity and/or overbroad encroachment of

the personal right of self-determination and the right to confidentiality

of telecommunications.

See also the GFCC decision about the scanning of license plates

(the decision 1 BvR 2074/05 vom 11.3.2008 in german)

http://www.bverfg.de/entscheidungen/rs20080311_1bvr2-07405.html

where it confirmed that data collection requires formal statue law,

and that the law in question wasn't limited to probable cause and

therefore unconstitutional.

The only currently existing formal statue law in Germany, that could be

used in some limited fashion for "Monitoring" is Art.100 TKG,

http://www.gesetze-im-internet.de/tkg_2004/__100.html

but that statue is clearly limited in purpose, it will not allow that data

to be used for automatic surveillance of "employee conduct" with respect

to "company-defined policies".  Employers try hard to avoid TKG for their

networks (for which they will have to formally register), but that also

means that they do not have a formal statutory law for performing any

kind of surveillance/monitoring as described in Art. 100 TKG for systems

that are used by employees for telecommunications and a significant part

of their daily activies.

-Martin

_______________________________________________

sacm mailing list

[email-masked]

https://www.ietf.org/mailman/listinfo/sacm

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 08 Aug 2012 11:11:37 -0400

Hi David,

Could you provide a copy of ISO 27001 so we could
take a look at it?

--tony

On 8/8/2012 10:22 AM, [email-masked] wrote:
>
> Luis and all:
>
> Unless we can demonstrate that the technologies and specifications we 
> are developing align with the security objectives of international 
> compliance models (such as ISO 27001) we cannot demonstrate strategic 
> alignment of business and security objectives in their context.
>

---

From: Adam Montville <[email-masked]>
Date: Wed, 8 Aug 2012 16:11:55 +0000

>Could you provide a copy of ISO 27001 so we could

I have a copy, but it's restricted to my use only.  I believe most
distributions might be that way.

>
>--tony
>
>On 8/8/2012 10:22 AM,
>[email-masked] <mailto:[email-masked]> wrote:
>
>
>Luis and all:
>Unless we can demonstrate that the technologies and specifications we are
>developing align with the security objectives of international compliance
>models (such as ISO 27001)
> we cannot demonstrate strategic alignment of business and security
>objectives in their context.
> 
>
>
>
>

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 8 Aug 2012 12:37:25 -0400

The challenge we will likely face in scoping down the effort is that we might not be able to work on the full stack that supports low-level data collection, as well as higher level security processes and controls.  This is because we will likely need to charter around a lower layer of function.  This is why we need to scope as part of this work an architecture document that illustrates how the smaller scope of work fits into the larger picture that supports alignment with international compliance models.

To say it a different way, we need to define a comprehensive picture of the “end state”, even though we may only get part way there based on an initial SACM charter.

We can use documents like ISO 27001 as guidance in producing the architecture document to insure that the end state aligns well with your concerns below.

Sincerely,
Dave

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, August 08, 2012 10:22 AM
To: [email-masked]; [email-masked]
Subject: [sacm] Strategic alignment of security with business in SACM in an international context

Luis and all:

David Oliva

On 08/07/12, Luis Nunez<[email-masked]<mailto:[email-masked]>> wrote:

-ln

On Aug 7, 2012, at 11:46 AM, [email-masked]<mailto:[email-masked]> wrote:

 Luis and all:

You are on target.

David Oliva

On 08/06/12, Luis Nunez<[email-masked]<mailto:[email-masked]>> wrote:

-ln

On Aug 6, 2012, at 12:42 PM, <[email-masked]<mailto:[email-masked]>> wrote:

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Martin Rex <[email-masked]<mailto:[email-masked]>>
Reply-To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Monday, August 6, 2012 11:32 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Legal aspects of System monitoring

Tony Rutkowski wrote:
Martin Rex wrote:

Really?

No kidding!

-Martin
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

________________________________

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Luis Nunez <[email-masked]>
Date: Wed, 8 Aug 2012 12:50:59 -0400

I had mention the Cloud Security Matrix (Cloud Security Alliance) in another thread.
1. is this something we can use as basis for mapping the various regulations to a common id?
2. Is this SACM or MILE GRC related work?

thanks.
-ln

---

From: Adam Montville <[email-masked]>
Date: Wed, 8 Aug 2012 17:22:19 +0000

On 8/8/12 9:37 AM, "Waltermire, David A." <[email-masked]>
wrote:

> 
>We can use documents like ISO 27001 as guidance in producing the
>architecture document to insure that the end state aligns well with your
>concerns below.
> 

This is one way we can leverage the frame of reference information I sent
previously.  I think we could agree that the control objectives mentioned
in a control framework, such as NIST 800-53 or ISO 27002 are generally
supported by the processes and procedures used to implement concepts such
as "security configuration management."  I would argue that any of the
low-level controls, or "activities" as some might prefer, can be mapped
back to a given control framework quite easily, and without getting into
the specific process/procedure details that will differ from organization
to organization.

>Strategic alignment of security objectives with business objectives can
>be at least partially joined via SACM thru the SP 800-53 to ISO 27001
>mapping
> table.  

I don't see how SACM would join SP 800-53 and ISO 27001.  Instead, I see
that SACM would support each, as mentioned above.  Joining frameworks and
similar guidance is more along the lines of what UCF does, and is not what
I understand this effort to accomplish.  Rather, I see the SACM effort as
the start to providing a comprehensive set of automation and monitoring
capabilities that can be leveraged by organizations seeking to
substantiate the particular control objectives detailed by a given
framework. 

That said, I believe it is critical to ensure that the work we are doing
does, in fact, lead to such substantiation.  Therefore, I believe it's
necessary to have a solid frame of reference that ties back to one or more
widely accepted control frameworks.  It's great to work from the
bottom-up, but if we're not meeting the top-down view somewhere in the
middle, we're failing.

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 8 Aug 2012 17:26:25 +0000

To avoid distribution restrictions you may purchase a copy at http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=42103

From: [email-masked] [mailto:[email-masked]] On Behalf Of Tony Rutkowski
Sent: Wednesday, August 08, 2012 8:12 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [sacm] Strategic alignment of security with business in SACM in an international context

Hi David,

--tony

On 8/8/2012 10:22 AM, [email-masked]<mailto:[email-masked]> wrote:
Luis and all:
Unless we can demonstrate that the technologies and specifications we are developing align with the security objectives of international compliance models (such as ISO 27001) we cannot demonstrate strategic alignment of business and security objectives in their context.

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 08 Aug 2012 14:09:30 -0400

Wow, only CHF 134 to take a peek!
Doesn't seem to comport with IETF practices.

On 8/8/2012 1:26 PM, Anthony Nadalin wrote:
>
> To avoid distribution restrictions you may purchase a copy at 
> http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=42103 
>
>

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 8 Aug 2012 18:14:09 +0000

Take that up with ISO, I'm sure they would be  interested in your views and suggestions on how to improve the standards world

From: [email-masked] [mailto:[email-masked]] On Behalf Of Tony Rutkowski
Sent: Wednesday, August 08, 2012 11:10 AM
To: Anthony Nadalin
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] Strategic alignment of security with business in SACM in an international context

---

From: Adam Montville <[email-masked]>
Date: Wed, 8 Aug 2012 18:24:39 +0000

>Doesn't seem to comport with IETF practices.

There are a variety of sources to look at without buying or borrowing a
copy.  Here are a few.  If you google for "iso 27001 appendix A" you'll
get information about the same major section headings detailed in ISO
27002.

http://blog.iso27001standard.com/2010/10/20/iso-27001-annex-a-controls/

http://en.wikipedia.org/wiki/ISO/IEC_27002

A book: 
http://www.amazon.com/IT-Governance-Managers-Guide-Security/dp/0749452714/r
ef=sr_1_1?ie=UTF8&qid=1344449747&sr=8-1&keywords=iso27002

ISACA has some information about COBIT<-->ISO 27001 mapping for non
members, and more for members.

http://www.isaca.org/Knowledge-Center/Research/Documents/Aligning-COBIT,ITI
LV3,ISO27002-Bus-Benefit-12Nov08-Research.pdf

All that available, and here's the rough structure of 27002:

* Security Policy
* Organization of Information Security
* Asset Management
* Human Resources Security
* Physical Security
* Communications and Ops Management
* Access Control
* Information Systems Acquisition, Development, Maintenance
* Information Security Incident management
* Business Continuity
* Compliance

And, I just found a full table of contents here:
http://www.praxiom.com/iso-security-toc.htm

It would certainly be a useful exercise to map the capabilities provided
by multiple working groups, not just sacm, into a framework such as this.
I can see IODEF and mile being mapped into several sections, as well as
nea, and perhaps some of the opsec stuff as well.

Adam

Adam

---

From: [email-masked] (Martin Rex)
Date: Thu, 9 Aug 2012 10:32:52 +0200 (CEST)

> Could you provide a copy of ISO 27001 so we could

ISO (and all of its national member organizations)
are  "traditional" standardization developing organizations (SDOs)
that are in the publishing business.  i.e. a non-marginal part
of their budget is from selling copies of their standards
(and the national member bodies may offer translations as well).

I believe the selling price is (or once was) calculated
from number of pages.

-Martin

---

From: Luis Nunez <[email-masked]>
Date: Wed, 15 Aug 2012 11:45:49 -0400

John,
thanks for the information and intro.

Hi Becky,
CCM is a worth while effort that contributes tremendously to community.

Some questions I have is:
1. Do you see CCM expand to other controls sets or what is currently mapped good enough for coverage? 
2. CCM is for cloud environments, is there a difference if you apply to non-cloud environments?  Looking to see if there is gap in mapping if CCM is applied to non-cloud environments.

Thanks.

-ln
 
On Aug 15, 2012, at 10:16 AM, Becky Swain wrote:

> John, thanks for adding me to the communication thread.
>  
> Luis et al, if there are any questions on CCM or specifically on what is changing for CCM v2.0, please let me know how I could assist.
>  
> Becky Swain
> (mobile) +1 (650) 520-0263
> (skype) rebeccadswain
> (twitter) @rebeccadswain
>  
> From: John Howie [mailto:[email-masked]] 
> Sent: Tuesday, August 14, 2012 9:39 PM
> To: Luis Nunez; Waltermire, David A.
> Cc: Ruben Oliva; [email-masked]; [email-masked]; Becky Swain
> Subject: Re: [mile] [sacm] Strategic alignment of security with business in SACM in an international context
>  
> Hi all,
>  
> The Cloud Security Alliance intellectual property, including the Cloud Controls Matrix, can be used royalty free with attribution, should you wish to use it. We are making some updates to the Cloud Controls Matrix, and I have Cc'ed Becky Swain who can answer any questions you might have about the updates.
>  
> Regards,
>  
> John
>  
> From: Luis Nunez <[email-masked]>
> Date: Wednesday, August 8, 2012 9:50 AM
> To: "Waltermire, David A." <[email-masked]>
> Cc: Ruben Oliva <[email-masked]>, <[email-masked]>, <[email-masked]>
> Subject: Re: [mile] [sacm] Strategic alignment of security with business in SACM in an international context
>  
> _______________________________________________ mile mailing list [email-masked] https://www.ietf.org/mailman/listinfo/mile

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Thu, 16 Aug 2012 03:16:24 -0400

Thank you very much for the disclosure and offer, this could be extremely helpful!

We will also need a form filled in on the IETF site for the disclosure, I'll email you separately.

Thank you,
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of John Howie [[email-masked]]
Sent: Wednesday, August 15, 2012 12:39 AM
To: Luis Nunez; Waltermire, David A.
Cc: Ruben Oliva; [email-masked]; [email-masked]; Becky Swain
Subject: Re: [mile] [sacm] Strategic alignment of security with business in SACM in an international context

Hi all,

Regards,

John

From: Luis Nunez <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, August 8, 2012 9:50 AM
To: "Waltermire, David A." <[email-masked]<mailto:[email-masked]>>
Cc: Ruben Oliva <[email-masked]<mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]>>
Subject: Re: [mile] [sacm] Strategic alignment of security with business in SACM in an international context

thanks.
-ln

Sincerely,
Dave

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, August 08, 2012 10:22 AM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: [sacm] Strategic alignment of security with business in SACM in an international context

Luis and all:

David Oliva

-ln

 Luis and all:

You are on target.

David Oliva

-ln

Kent Landfield

Tony Rutkowski wrote:
Martin Rex wrote:

Really?

No kidding!

-Martin

_______________________________________________ mile mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/mile

---

From: John Howie <[email-masked]>
Date: Tue, 14 Aug 2012 21:39:04 -0700

Hi all,

The Cloud Security Alliance intellectual property, including the Cloud
Controls Matrix, can be used royalty free with attribution, should you wish
to use it. We are making some updates to the Cloud Controls Matrix, and I
have Cc'ed Becky Swain who can answer any questions you might have about the
updates.

Regards,

John

From:  Luis Nunez <[email-masked]>
Date:  Wednesday, August 8, 2012 9:50 AM
To:  "Waltermire, David A." <[email-masked]>
Cc:  Ruben Oliva <[email-masked]>, <[email-masked]>, <[email-masked]>
Subject:  Re: [mile] [sacm] Strategic alignment of security with business in
SACM in an international context

I had mention the Cloud Security Matrix (Cloud Security Alliance) in another
thread.
1. is this something we can use as basis for mapping the various regulations
to a common id?
2. Is this SACM or MILE GRC related work?

thanks.
-ln

On Aug 8, 2012, at 12:37 PM, Waltermire, David A. wrote:

> The challenge we will likely face in scoping down the effort is that we might
> not be able to work on the full stack that supports low-level data collection,
> as well as higher level security processes and controls.  This is because we
> will likely need to charter around a lower layer of function.  This is why we
> need to scope as part of this work an architecture document that illustrates
> how the smaller scope of work fits into the larger picture that supports
> alignment with international compliance models.
>  
> To say it a different way, we need to define a comprehensive picture of the
> ³end state², even though we may only get part way there based on an initial
> SACM charter.
>  
> We can use documents like ISO 27001 as guidance in producing the architecture
> document to insure that the end state aligns well with your concerns below.
>  
> Sincerely,
> Dave
>  
> models (such as ISO 27001) we cannot demonstrate strategic alignment of
> business and security objectives in their context.
> Strategic alignment of security objectives with business objectives can be at
> least partially joined via SACM thru the SP 800-53 to ISO 27001 mapping table.
> If this were to happen to SACM then the validated products will have less
> appeal and less marketability. The validated products will work fine, but they
> will work with limited capability and scope.  For example, currently validated
> SCAP 1.0 products do not use the Open Checklist Interactive Language (OCIL).
> OCIL is an open specification (created by the security community for use by
> anybody, any developer, any country) that facilitates non-automated assessment
> of security processes.  OCIL would allow an ISO 27001 compliance assessor in
> Germany to create a question ³Does the organization comply ISO/IEC 27001:2005
> para 4.2.2 e) ŒDoes the organization implement a training and awareness
> programme¹² and answer Œyes¹ or Œno¹.  Then the results can be accessed and
> read whether the organization uses product X or product Y because OCIL is an
> open security specification.  Another example of OCIL is a rather mundane
> security function of universal use.  OCIL allows an ISO 27001 security
> compliance officer to answer Œyes¹ or Œno¹ to the question ³Is the door shut?²
> and make the result electronically readable whether he/she uses product X or
> product Y.  As for business, the flexibility of OCIL allows a company to
> create a question ³Did the company reach our 7% profit strategic objective
> over the past 10 years?² and able to answer it Œyes¹ or Œno¹ with product X,
> Y, or Z and ensure interoperability.
>  
> David Oliva
>  
> 
>  
>  
> SACM is not a law enforcement thing, but is a facilitator of legal issues in
> association with the protection of private information and health-related
> information.
> A SACM configuration scanner is able to monitor the configuration of security
> controls as specified in ISO/IEC 27001:2005.  This can be accomplished when
> tier IV SCAP content is used because the output maps the finding (compliance
> or non-compliance) of the scanner to security control ISO/IEC 27001:2005
> paragraph A.10.6.2 ³Security of Network Services².  Thus a SACM scanner is
> able to assist in international governance compliance about personal
> information because SP 800-53 maps to ISO 27001.
> A SACM vulnerability scanner is able to meet compliance with ISO 27001, para
> A.12.6.1 ³Control of technical vulnerabilities² because a SACM scanner using
> SCAP tier IV content can map its output to the ISO governance.  SACM
> Vulnerability scanning can address aspects of confidentiality of personal
> information by identifying software vulnerabilities of the databases that
> house them, and do it in the context of an international set of security
> standards.
> 
>  
> David Oliva
>  
>  
>  
> Looking at it another way I could see security automation as a way to discover
> if a system is configured to meet privacy policies .
>  
> Security automation is an enabler for transparency  so that individuals and
> organizations may understand the complex computing environment.
>  
> Thanks for bring up this issue.  As a community we may want to look at
> building content around privacy controls.
>  
> -ln
>  
> None of the efforts we are talking about for SACM are targeted toward PII or
> individuals. They are targeted at the configuration of the platforms deployed
> in the enterprise to assure they comply with the site's security policy.  PII
> is not collected. This is not monitoring of individual or employee actions.  I
> am not a lawyer and will not speak as one. We will let the lawyer's decide at
> the appropriate time.
>  
> Kent Landfield
> 
> Web: www.mcafee.com <http://www.mcafee.com/>
>  

_______________________________________________ mile mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/mile