Subject: [sacm] updated text for proposed charter

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 25 Feb 2013 16:41:33 +0000

This is a proposed text for the future SACM WG charter, slightly updated by Kathleen and myself relative to the 1/24 version submitted by Steve Hanna. 

The Changes: 

1. included "policy" as one of the management types in the second paragraph

2. added a small paragraph that refers to relationship with other SDOs. Without entering to much in details at this point we want to make sure that we have the basis for entertaining collaboration and exchanging messages with other organizations. 

3. replaced (twice) 'A set of standards' by 'One or a set of standards' when talking about solutions. The desired outcome of IETF work is one solution for one problem (to differentiate from the multiple solutions to the same problem approach). We recognize however that this solution may come under the form of one standard or a set of complementary (but not competing) standards. 

Note that we should try to work a good text that reflects our goals but we need not wordsmith to death at this phase. We need to focus now on best preparing the meeting and demonstrating that we have clear focus and manageable deliverables so that the formal process for the formation of a WG starts soon after IETF-86. We can then work on exact wording of the charter we request to be approved by the IESG. 

Kathleen and Dan

----------

Proposed Working Group Charter

Name: Security Automation and Continuous Monitoring (SACM)
AREA: Security

Chairs:
TBD
TBD

Security Area Directors:
     Stephen Farrell <stephen.farrell at cs.tcd.ie>
     Sean Turner <turners at ieca.com>

Security Area Advisor:
     Sean Turner <turners at ieca.com>

Mailing Lists:
     General Discussion: sacm at ietf.org
     To Subscribe:       http://www.ietf.org/mailman/listinfo/sacm
     Archive:            http://www.ietf.org/mail-archive/web/sacm

Description of Working Group

Securing information and the systems that store, process, and transmit that information is a challenging task for organizations of all sizes, and many security practitioners spend most of their time on manual processes relegating them to ineffectiveness. The key to escaping this rut is security automation to collect, verify, and update system configurations with the ability to prioritize risk based on timely information about threats. This working group will develop security automation protocols and data format standards in support of information security processes and practices. These standards will help security practitioners to be more effective by automating routine tasks related to client and server security freeing them to focus on more advanced tasks. The initial focus of this work is to address enterprise use cases pertaining to the assessment of endpoint posture (using the definitions of Endpoint and Posture from RFC 5209).

The working group will, whenever reasonable and possible, reuse existing protocols and mechanisms. Of particular interest to this working group are the security automation specifications supporting policy asset, change, configuration, and vulnerability management.

There are multiple categories of problems in the security automation
realm: enabling interoperable data exchanges through standardized protocols, defining expressions for particular domain concepts (i.e. data formats), establishing a standards-based foundation supporting the curation and exchange of security automation content collections in content repositories, and enabling interoperability through the development and use of standard interfaces and communication protocols. Content based on rich and extensible data standards and protocols will provide the authoritative instructions needed by data-driven tools to enable the automated collection of configuration and vulnerability data pertaining to enterprise assets. Information produced by these tools will provide accurate and timely situational awareness in support of organizational decision making.

The data exchange protocols will need to support several exchange types including requesting assessments and reporting on assessment results. Exchanging information across organizational boundaries will not be within scope for this effort at this time.

This working group will provide solutions to these categories of problems and the main areas of focus for this working group are described as follows:

1. One or a set of standards to enable assessment of endpoint posture.
   This area of focus provides for necessary language and data
   format specifications.

2. One or a set of standards for interacting with repositories of content
   related to assessment of endpoint posture.

In accordance with existing IETF processes, the group will communicate with and invite participation from other relevant standards bodies and groups, and if necessary reuse existing liaison relationships or request the establishment of new liaison relationships, 

This working group will achieve the following milestones:

- An Informational document on Use Cases and Requirements
- An Informational document on SACM Architecture
- A Standards Track document to define a protocol for interacting
  with content repositories
- Standards Track documents specifying communication protocols and
  data formats used for assessment of endpoint posture

After these work items have been submitted to and approved by the IESG, the WG will recharter or close.