Subject: [sacm] review comment to draft-shah-sacm-tnc-architecture-00

From: Linda Dunbar <[email-masked]>
Date: Mon, 11 Aug 2014 16:51:42 +0000

Atul and Lisa,

As promised at the SACM meeting in Toronto, I reviewed the draft-shah-sacm-tnc-architecture-00. Here are my comments:

-          Section 2.4: the draft states that "an anomaly detection system can notify other components when an endpoint's behavior is abnormal". I would think that the SACM is to specify the criteria for end point to declare "anomaly". The draft should have a section on those criteria.

-          Figure 2 shows the components of SACM architecture. It is very important to show what kind of data (or semantics) going through each interface.

-          Section 4.1: the SACM use case draft didn't elaborate what "attribute data to be collected from endpoints and the guidance data". I was hoping that architecture draft can elaborate those data.

Cheers,
Linda Dunbar
Huawei USA IP Technology Lab
5340 Legacy Drive,
Plano, TX 75024
Tel: +1 469-277 - 5840
Fax: +1 469 -277 - 5900

---

From: "Adam W. Montville" <[email-masked]>
Date: Fri, 15 Aug 2014 08:48:29 -0500

Linda,

Thank you for your review.  I’m sure the authors of draft-shah-sacm-tnc-architecture-00 will take your comments to heart.  I have one comment below.

Regards,

Adam

On Aug 11, 2014, at 11:51 AM, Linda Dunbar <[email-masked]> wrote:

> -          Section 2.4: the draft states that “an anomaly detection system can notify other components when an endpoint’s behavior is abnormal”. I would think that the SACM is to specify the criteria for end point to declare “anomaly”. The draft should have a section on those criteria.
> -          Section 4.1: the SACM use case draft didn’t elaborate what “attribute data to be collected from endpoints and the guidance data”. I was hoping that architecture draft can elaborate those data.

I think the information model submissions would be the better place for you to find what you’re looking for [1] [2].  SACM’s charter is concerned with endpoint posture assessment, and per the terminology draft, “posture” is defined as "configuration and/or status of hardware or software on an endpoint as it pertains to an organization’s security policy” (a definition taken from RFC 5209).  From this you might imagine the data that will be transiting the SACM ecosystem.  Think in terms of platform configurations, hardware and software inventories, and their respective configurations.

[1] http://tools.ietf.org/id/draft-lorenzin-sacm-tnc-information-model-00.txt
[2] http://tools.ietf.org/id/draft-wandw-sacm-information-model-00.txt

> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm