Subject: [sacm] Proposed Structural Changes to the Use Case Document

From: "Waltermire, David A." <[email-masked]>
Date: Tue, 10 Sep 2013 17:53:17 +0000

I am working on an update to the use cases document that breaks things out into two different sections: use cases and functional capabilities.

The first is a use cases section with short descriptions of business process-oriented activities that we need to address, at least in part, given the current SACM scope. This section is a further expansion on the current section 3 text.

The second section is a derived functional breakout of the capabilities needed to support the use cases written in architecturally neutral text. This is based on the existing section 4 text. I am flattening this section to get rid of the asset management, configuration management, change management, vulnerability management, etc. groupings that are distracting from clearly identifying the work that needs to be accomplished.

I am keeping  and expanding on the existing asset management subsections on asset identification and asset characterization based on the conversations to date.  I am also adding sections on deconfliction of reported asset identities (to deal with stable and mutable forms of asset identification) and asset targeting (which builds on asset identification and characterization).

Does this sound like, at least in theory, a reasonable way forward?

Sincerely,
Dave

---

From: Gunnar Engelbach <[email-masked]>
Date: Tue, 10 Sep 2013 14:39:35 -0400

Dave, sounds great.  Looking forward to seeing it.

On 9/10/2013 1:53 PM, Waltermire, David A. wrote:
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: "ietfdbh" <[email-masked]>
Date: Tue, 10 Sep 2013 17:07:16 -0400

Hi,

You say that the groupings are a distraction, but those categories come
directly from the charter:

" The working group will, whenever reasonable and possible, reuse existing
protocols, mechanisms, information and data models. Of particular interest
to this working group are existing industry standards, preferably IETF
standards, that could support automation of asset, change, configuration,
and vulnerability management."

There are use cases (shipping products) that do security assessment of
endpoints,  especially networking devices and host interfaces, using
existing IETF standards whose data models can support the general use cases
of asset management, change management, configuration management, and
vulnerability management. 

I have worked on applications that have done such security assessments and
reporting, including policy-based enforcement of approved configurations,
notifications of changes to configurations, changes to access-control via
AAA when user assignments changed, enforcement of policies based on
user/device behavior anomalies, enforcement of policies based on user/device
location, distribution and enforcement of policies based on detected
attacks, dynamic sharing of information/signatures between multiple devices
and multiple applications in the network, and so on. These all seem to fit
within the scope of security posture assessment (and policy-based response).

The IETF standards that provide data to support these types of use cases can
be roughly categorized - asset discovery and monitoring (e.g., SNMP/MIBs),
state change (e.g., syslog, SNMP notifications, ipfix), metadata change
(AAA, LDAP), configuration (Netconf/YANG) , and vulnerability (IODEF, NEA).

I'm not sure that we should eliminate these groupings from the document.

I have a concern that you may be moving away from real use cases to abstract
use cases and writing an abstract requirements wishlist.

That said, let's see what you come up with as an alternative to the current
doc.

David Harrington

 <mailto:[email-masked]> [email-masked]

+1-603-828-1401

> -----Original Message-----

> From: [email-masked] [mailto:[email-masked]] On Behalf Of

> Waltermire, David A.

> Sent: Tuesday, September 10, 2013 1:53 PM

> To: [email-masked]

> Subject: [sacm] Proposed Structural Changes to the Use Case Document

> I am working on an update to the use cases document that breaks things out

> into two different sections: use cases and functional capabilities.

> The first is a use cases section with short descriptions of business
process-

> oriented activities that we need to address, at least in part, given the
current

> SACM scope. This section is a further expansion on the current section 3
text.

> The second section is a derived functional breakout of the capabilities

> needed to support the use cases written in architecturally neutral text.
This is

> based on the existing section 4 text. I am flattening this section to get
rid of

> the asset management, configuration management, change management,

> vulnerability management, etc. groupings that are distracting from clearly

> identifying the work that needs to be accomplished.

> I am keeping  and expanding on the existing asset management subsections

> on asset identification and asset characterization based on the
conversations

> to date.  I am also adding sections on deconfliction of reported asset

> identities (to deal with stable and mutable forms of asset identification)
and

> asset targeting (which builds on asset identification and
characterization).

>  <mailto:[email-masked]> [email-masked]

>  <https://www.ietf.org/mailman/listinfo/sacm>