Subject: Re: [sacm] FW: New Version Notification for draft-waltermire-sacm-architecture-00.txt

From: [email-masked]
Date: Sun, 17 Feb 2013 17:34:44 -0600 (CST)

David and all

The document appears good to me, but I have some questions.

1. Does the current SCAP architecture resemble the proposed SACM architecture?

2. If the current SCAP architecture reflects the proposed SACM architecture, can you correlate the components from SCAP to SACM?

David Oliva

On 02/10/13, Waltermire, David A.<[email-masked]> wrote:

I just posted an initial SACM Architecture document including what we have been discussing. The link is below.

This draft is fairly skeletal right now. It currently includes a simple ASCII art diagram based on the discussion thread that Gunnar started. The core sections of the document where I have done some work are section 2: Functional Components and section 3: Data Flows. Section 2.1 and 3.1 contain some example detail. Please let me know if this is the right approach. I'd like to capture additional details, but I am not sure what to include and how best to include it at this point. We need more discussion to fill this in. I'm happy to capture anything that we come up with.

Please review this draft and let me know if you have any comments or concerns. We have time before the 2/25 deadline for 00+ I-D submissions to make an any updates.

Sincerely,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Sunday, February 10, 2013 7:30 PM
To: Waltermire, David A.
Subject: New Version Notification for draft-waltermire-sacm-architecture-00.txt

A new version of I-D, draft-waltermire-sacm-architecture-00.txt
has been successfully submitted by David Waltermire and posted to the IETF repository.

Filename: draft-waltermire-sacm-architecture
Revision: 00
Title: Security Automation and Continuous Monitoring (SACM) Architecture
Creation date: 2013-02-11
WG ID: Individual Submission
Number of pages: 9
URL: http://www.ietf.org/internet-drafts/draft-waltermire-sacm-architecture-00.txt
Status: http://datatracker.ietf.org/doc/draft-waltermire-sacm-architecture
Htmlized: http://tools.ietf.org/html/draft-waltermire-sacm-architecture-00

Abstract:
This document identifies the architectural components, data flows,
and the supporting standards needed to define an interoperable
automation infrastructure required to support timely, accurate and
actionable situational awareness over an organization's IT systems.
This architecture is based on previous use case and requirements
analysis. Automation tools implementing the continuous monitoring
approach described in this document will utilize this infrastructure
together with existing and emerging event, incident and network
management standards to provide visibility into the state of assets,
user activities and network behavior. Stakeholders will be able to
use these tools to aggregate and analyze relevant security and
operational data to understand the organizations security posture,
quantify business risk, and make informed decisions that support
organizational objectives while protecting critical information.
Organizations will be able to use these tools to augment and automate
information sharing activities to collaborate with partners to
identify and mitigate threats. Other automation tools will be able
to integrate with these capabilities to enforce policies based on
human decisions to harden systems, prevent misuse and reduce the
overall attack surface.

The IETF Secretariat

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: Gunnar Engelbach <[email-masked]>
Date: Mon, 18 Feb 2013 15:39:39 -0500

David,

The current SACM architecture just shows a breakout of the components in 
the architecture and recognition in the broadest sense of the type of 
communications that are expected between each, but doesn't say anything 
about the format of those communications or how they are expected to be 
processed at each node.

In SCAP terms, the Collector could easily accept OVAL documents as its 
instructions for what to collect and return a System Characteristics 
document as the returned payload.  Similarly with an OCIL questionnaire 
where the collector would be interactive and not automated.

The Evaluator could then use the SC file and completed OCIL 
questionnaire in conjunction with OVAL/XCCDF to produce an XCCDF results 
document as its payload.

However, at this point there's nothing to say that all this could not be 
done via proprietary means.

At this point the desired overall architecture and resultant 
requirements haven't been defined well enough to know whether or not any 
existing standards such as SCAP will be the way to go.

On 2/17/2013 6:34 PM, [email-masked] wrote:
> 2. If the current SCAP architecture reflects the proposed SACM
> architecture, can you correlate the components from SCAP to SACM?
> David Oliva
> This draft is fairly skeletal right now. It currently includes a simple
> ASCII art diagram based on the discussion thread that Gunnar started.
> The core sections of the document where I have done some work are
> section 2: Functional Components and section 3: Data Flows. Section 2.1
> and 3.1 contain some example detail. Please let me know if this is the
> right approach. I'd like to capture additional details, but I am not
> sure what to include and how best to include it at this point. We need
> more discussion to fill this in. I'm happy to capture anything that we
> come up with.
>
> Please review this draft and let me know if you have any comments or
> concerns. We have time before the 2/25 deadline for 00+ I-D submissions
> to make an any updates.
>
> Sincerely,
> Dave
>
> From: [email-masked] <mailto:[email-masked]>
> [mailto:[email-masked]]
> Subject: New Version Notification for
> draft-waltermire-sacm-architecture-00.txt
>
>
> URL:
> http://www.ietf.org/internet-drafts/draft-waltermire-sacm-architecture-00.txt
> [email-masked] <mailto:[email-masked]>