Subject: [sacm] FW: New Version Notification for draft-ietf-sacm-use-cases-05.txt

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 20 Nov 2013 23:27:22 +0000

I just posted an updated use case draft based on the editorial sessions during the IETF 88 meeting in Vancouver, BC, Canada. My thanks to all that provided input.

I used the word version that we edited as a starting point. Here is what I did:

- I worked through the use cases we planned to remove and made sure to merge in any concepts that would be lost. If you submitted a previous use case that was removed, please double check that I didn't miss anything.
- I broke up "Endpoint Identification and Assessment" into 3 distinct and somewhat separable use cases: "Endpoint Identification and Assessment Planning", "Endpoint Posture Attribute Value Collection", "Posture Evaluation". Please let me know what you think about this change.
- Addressed some aspects of the discussion thread based on the working session changes. Please provide any suggested edits for aspects that I might have missed or got wrong.

The rest of the changes can be found in the draft's change log.

If possible, I'd like to get to a fairly stable place with this draft in the next revision or two to allow for progress to be made on the requirements. In addition to the embedded questions in the document, I'd like to focus on the following questions:

Is the draft approachable for a newcomer to the effort? Do you see the updated use case structure as an improvement?
Does this draft paint a complete enough picture? Are we missing any important concepts?
Is there anything you can't live with?

I hope to release at least one or two more updates to this draft within the next few weeks before the holidays catch up on us.  I know everyone is busy; timely comments are appreciated to allow for a quick turnaround on the next revision.

Thanks,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, November 20, 2013 5:58 PM
To: Waltermire, David A.; David Harrington
Subject: New Version Notification for draft-ietf-sacm-use-cases-05.txt

A new version of I-D, draft-ietf-sacm-use-cases-05.txt has been successfully submitted by David Waltermire and posted to the IETF repository.

Filename:	 draft-ietf-sacm-use-cases
Revision:	 05
Title:		 Endpoint Security Posture Assessment - Enterprise Use Cases
Creation date:	 2013-11-20
Group:		 sacm
Number of pages: 24
URL:             http://www.ietf.org/internet-drafts/draft-ietf-sacm-use-cases-05.txt
Status:          http://datatracker.ietf.org/doc/draft-ietf-sacm-use-cases
Htmlized:        http://tools.ietf.org/html/draft-ietf-sacm-use-cases-05
Diff:            http://www.ietf.org/rfcdiff?url2=draft-ietf-sacm-use-cases-05

Abstract:
   This memo documents a sampling of use cases for securely aggregating
   configuration and operational data and evaluating that data to
   determine an organization's security posture.  From these operational
   use cases, we can derive common functional capabilities and
   requirements to guide development of vendor-neutral, interoperable
   standards for aggregating and evaluating data relevant to security
   posture.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 21 Nov 2013 11:45:01 +0000

> From: sacm [mailto:[email-masked]] On Behalf Of Waltermire, David
> A.
> Sent: Thursday, November 21, 2013 1:27 AM
> To: [email-masked]
> Subject: [sacm] FW: New Version Notification for draft-ietf-sacm-use-
> cases-05.txt
> 
> I just posted an updated use case draft based on the editorial sessions
> during the IETF 88 meeting in Vancouver, BC, Canada. My thanks to all
> that provided input.
> 
[[DR]] Thanks, David and all contributors!
...
> 
> I hope to release at least one or two more updates to this draft within
> the next few weeks before the holidays catch up on us.  I know everyone
> is busy; timely comments are appreciated to allow for a quick turnaround
> on the next revision.

[[DR]] Please do not forget about the virtual interim scheduled for 12/17. Hopefully one more version could be released before this date addressing the comments against the current version 

Regards,

Dan

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 21 Nov 2013 13:14:13 +0000

> > I hope to release at least one or two more updates to this draft
> > within the next few weeks before the holidays catch up on us.  I know
> > everyone is busy; timely comments are appreciated to allow for a quick
> > turnaround on the next revision.
> 
> [[DR]] Please do not forget about the virtual interim scheduled for 12/17.
> Hopefully one more version could be released before this date addressing
> the comments against the current version

Good point. I'll target an updated draft for before the meeting.

Thanks,
Dave

---

From: Henk Birkholz <[email-masked]>
Date: Fri, 22 Nov 2013 10:28:48 +0100

Regarding the first two question in section 2:

1.) Security automation today often supports the user/operator, I think. 
There are cases a security-process can be fully automated, of course, 
and in order to manage the sheer amount of security related system 
events automation is essential, but it seems to me that the complexity 
and heterogeneity of root-causes (that might trigger the work-flow) make 
the inclusion of a user/operator necessary.

2.) To include acquisition methods can provide an intuitive insight 
about the scope and intend of the endpoint posture assessment domain, I 
think. On one hand, that might bloat the use-case document a bit (and 
maybe renders the title "sacm use cases" too specific?). On the other 
hand, I like the inclusion of a work-flow scenario and I think it is a 
good place to highlight acquisition methods.

- Henk

On 11/21/2013 12:27 AM, Waltermire, David A. wrote:
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>