Subject: [sacm] review of draft-ietf-sacm-use-cases-05

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Tue, 17 Dec 2013 18:55:47 +0000

In prep for the call, here are some comments to the draft .- Nancy

Section Type    Comments
general tech/nit        application can be an application that sits either on the network or on the endpoint itself, so this needs to be clear
2       editorial       worflow #1: "…or the endpoint might trigger",  we can either clarify that either the application on the endpoint or on the (network) can trigger the request for processing through an event.  I think the point is that it can be triggered manually (e.g. operator or user) or automated through the application (either on the endpoint or on the network)
2       question #1     I'm okay with dropping user, but I think the clarification of bi-directional trigger is needed
2               for the reference of this section, I believe application is the application on the server (I don't think we want an endpoint to target posture of other endpoints?)
2               the use of target and enpoint seems to be used to mean the same thing?
2       question #2     given that this is a use case document, I suggest we not enumerate the known acquisition methods here
2       question #2     the evaluator may send the result of the comparison as a simple "yes/no", or in a comprehensive form….I think the formats vary
2.1.1   nit     I'm not sure that a requestor cares that the information come from a data store as in some cases the evaluation and information may be obtained at the point it is requested (e.g. the posture assessment is done right then vs. extracting it from a data store).
        nit     "explicit use" is mainly because our charter speaks to posture only?
                I am concerned that we believe we will need multiple data models for posture assessment?  I can see different protocols and transports, and different contextual data models for the general secure automation, but the focus of this is for posture assessment only.
        nit     By content you mean the set of attributes that can be collected, published and queried?  So "content" would be a collection of attributes?  We should probably add this to the terminology to clarify meaning and intent.
Also, content could be a set of attributes that map to only 1 index (e.g. endpoint or mac address or device type?)?Content Retrieval seems to blur "content" as I'm not sure what a content entry could be then?
        nit     Because a requestor or responder may provide information without having full physical store, I am not sure it makes sense to articulate it as such "e.g. content data store", as posture assessors especially dynamic ones may choose to do the collection realtime.
        technical       one missing building block (which could be the intent behind change detection?) is the asynchronous notification of content; that is there is content publication and query, but we also discussed asynchronous notification (so it could be part of query or detection? or perhaps explicitly clarified as its own building block?)
2.1.2   technical       for the discovery, I describe it as an endpoint profile vs. type.  That is, the type of assessment may be based on a set of attributes beginning with a device type (e.g. laptop, camera, printer, etc), but other influencing attributes could be the device make, model, and perhaps where or how the device is connecting (e.g. wired vs. wireless)
        nit     we use "target" in section 2 to mean endpoint but this is a group of endpoints, so could we just say that vs. "target"?
        question        not sure what that means, prev collected data from where? And for what purpose?  I think we're OK with the blocks defined now
2.1.4   technical       is posture attr query based on a specific individual target or a general profile to be used as targets are discovered?
        technical       I'm not sure what content means in this building block?
2.1.5   nit     I don't think this is an alternate use case to 2.1.4 but a rather different one
        nit     general comment on data store as the publisher of the information may or may not have a physical data store
        technical       change detection I think the timeliness is really from undeterministic timed query to realtime/on demand response
        question        this is a separate use case where the posture information may be "mined" by different applications for different purposes than just posture evaluation