Subject: Re: [sacm] updated text for proposed charter

From: Adam Montville <[email-masked]>
Date: Wed, 6 Mar 2013 14:26:05 +0000

Dan, Kathleen: Thanks for doing this.  Hopefully, this is the most recent
version.  Comments/suggestions inline.

Looking forward to seeing you in Orlando next week.

Adam

On 2/25/13 8:41 AM, "Romascanu, Dan (Dan)" <[email-masked]> wrote:

>This is a proposed text for the future SACM WG charter, slightly updated
>by Kathleen and myself relative to the 1/24 version submitted by Steve
>Hanna. 
>
>The Changes: 
>
>1. included "policy" as one of the management types in the second
>paragraph
>
>2. added a small paragraph that refers to relationship with other SDOs.
>Without entering to much in details at this point we want to make sure
>that we have the basis for entertaining collaboration and exchanging
>messages with other organizations.
>
>3. replaced (twice) 'A set of standards' by 'One or a set of standards'
>when talking about solutions. The desired outcome of IETF work is one
>solution for one problem (to differentiate from the multiple solutions to
>the same problem approach). We recognize however that this solution may
>come under the form of one standard or a set of complementary (but not
>competing) standards.
>
>Note that we should try to work a good text that reflects our goals but
>we need not wordsmith to death at this phase. We need to focus now on
>best preparing the meeting and demonstrating that we have clear focus and
>manageable deliverables so that the formal process for the formation of a
>WG starts soon after IETF-86. We can then work on exact wording of the
>charter we request to be approved by the IESG.
>
>Kathleen and Dan
>
>
>----------
>
>Proposed Working Group Charter
>
>Name: Security Automation and Continuous Monitoring (SACM)
>AREA: Security
>
>Chairs:
>TBD
>TBD
>
>Security Area Directors:
>     Stephen Farrell <stephen.farrell at cs.tcd.ie>
>     Sean Turner <turners at ieca.com>
>
>Security Area Advisor:
>     Sean Turner <turners at ieca.com>
>
>Mailing Lists:
>     General Discussion: sacm at ietf.org
>     To Subscribe:       http://www.ietf.org/mailman/listinfo/sacm
>     Archive:            http://www.ietf.org/mail-archive/web/sacm
>
>Description of Working Group
>
>Securing information and the systems that store, process, and transmit
>that information is a challenging task for organizations of all sizes,
>and many security practitioners spend most of their time on manual
>processes relegating them to ineffectiveness. The key to escaping this
>rut is security automation to collect, verify, and update system
>configurations with the ability to prioritize risk based

Replace "risk" with "operational tasks" such that the sentence reads,
"...ability to prioritize operational tasks based on timely information..."

> on timely information about threats. This working group will develop
>security automation protocols and data format standards in support of
>information security processes and practices. These standards will help
>security practitioners to be more effective by automating routine tasks
>related to client and server security freeing them to focus on more
>advanced tasks. The initial focus of this work is to
>address enterprise use cases pertaining to the assessment of endpoint
>posture (using the definitions of Endpoint and Posture from RFC 5209).

I would feel better about adding a hint about future work including
network device assessment.

>
>The working group will, whenever reasonable and possible, reuse existing
>protocols and mechanisms. Of particular interest to this working group
>are the security automation specifications supporting policy asset,
>change, configuration, and vulnerability management.

I'd add the word "processes" to the end of this sentence: "...supporting
policy asset, change, configuration, and vulnerability management
processes."

>
>There are multiple categories of problems in the security automation
>realm: enabling interoperable data exchanges through standardized
>protocols, defining expressions for particular domain concepts (i.e. data
>formats), establishing a standards-based foundation supporting the
>curation and exchange of security automation content collections in
>content repositories, and enabling interoperability through the
>development and use of standard interfaces and communication protocols.
>Content based on rich and extensible data standards and protocols will
>provide the authoritative instructions needed by data-driven tools to
>enable the automated collection of configuration and vulnerability data
>pertaining to enterprise assets. Information produced by these tools will
>provide accurate and timely situational awareness in support of
>organizational decision making.
>
>The data exchange protocols will need to support several exchange types
>including requesting assessments and reporting on assessment results.
>Exchanging information across organizational boundaries will not be
>within scope for this effort at this time.
>
>This working group will provide solutions to these categories of problems
>and the main areas of focus for this working group are described as
>follows:
>
>1. One or a set of standards to enable assessment of endpoint posture.
>   This area of focus provides for necessary language and data
>   format specifications.
>
>2. One or a set of standards for interacting with repositories of content
>   related to assessment of endpoint posture.
>
>In accordance with existing IETF processes, the group will communicate
>with and invite participation from other relevant standards bodies and
>groups, and if necessary reuse existing liaison relationships or request
>the establishment of new liaison relationships,
>
>This working group will achieve the following milestones:
>
>- An Informational document on Use Cases and Requirements
>- An Informational document on SACM Architecture
>- A Standards Track document to define a protocol for interacting
>  with content repositories
>- Standards Track documents specifying communication protocols and
>  data formats used for assessment of endpoint posture
>
>After these work items have been submitted to and approved by the IESG,
>the WG will recharter or close.
>
>_______________________________________________
>sacm mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/sacm
>
>