Subject: Re: [sacm] AD Review of SACM Use Case Draft

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Sun, 1 Mar 2015 09:51:52 +0000

Hi Kathleen,

Thanks for your support. The time seems right for the IETF Last Call now, especially as IETF 92 is scheduled in three weeks, and we will be able to address at the meetings in Dallas the comments we will receive and discuss their resolution.

Thanks and Regards,

Dan

From: sacm [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Friday, February 27, 2015 3:05 AM
To: Waltermire, David A.
Cc: [email-masked]
Subject: Re: [sacm] AD Review of SACM Use Case Draft

Dave & Dan,

Thank you for incorporating the updates and the WG for your efforts on this draft.  I just verified the updates and the draft looks like it is ready to start IETF last call.  If the shepherd (Dan) agrees, I'll kick that off right away.

The shepherd report looks good too, thanks Dan!

On Thu, Feb 26, 2015 at 7:08 PM, Waltermire, David A. <[email-masked]<mailto:[email-masked]>> wrote:
Kathleen,

I just posted an updated use cases draft based on your comments below and your previous comments on 11/5/2014 (http://www.ietf.org/mail-archive/web/sacm/current/msg02139.html<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ietf.org_mail-2Darchive_web_sacm_current_msg02139.html&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=hlgL0tJTX7JO-j10yWY5jEbfxXoECQpEZxzSwH0QMJw&s=3gBXtyjjAkY62ifhxh_j2nZW3IUpWSBhQageK5Iv-ZE&e=>).

Discussion of the changes are inline below. Please let me know if you’d like to see any additional edits.

Thanks,
Dave

From: sacm [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Kathleen Moriarty
Sent: Monday, February 16, 2015 10:54 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [sacm] AD Review of SACM Use Case Draft

Hello,

The following is my review of the SACM use case draft.  Since this is a charted item and milestone for SACM, the work can proceed.  A statement from the IESG on use case drafts will be coming out soon, thanks to those that assisted in building arguments.

SACM use case draft:

Introduction:
Second sentence - should this be a bulleted list or be multiple sentences?
   It provides a discussion of
   these use cases and associated building block capabilities that
   support securely aggregating configuration and operational data and
   evaluating that data to determine the security posture of individual
   endpoints, and, in the aggregate, the security posture of an
   enterprise.

[daw: I broke this out as a bulleted list.]

2nd paragraph, 1st sentence, "information" is redundant:
   These use cases and usage scenarios cross many IT security
   information domains.

[daw: Deleted “information”.]

There are lots of really long sentences, last sentence of 3rd paragraph is  run-on.

Section 2.2.2
Can you break this sentence into a few?
   Using the collected hardware and software inventory data and
   associated asset characterization data that may indicate the
   organizational defined functions of each endpoint, checklist guidance
   is queried, located and downloaded from the appropriate vendor and
   3rd-party security automation data store for the appropriate
   checklists.

[daw: Made this a bulleted list.]

Same section, following sentence:
 While specific applications for checklists results are out-of-scope
s/checklists/checklist/

And I don't really follow the logic of the full transitional sentence:
   While specific applications for checklists results are out-of-scope
   for current SACM efforts, how the data is used may illuminate
   specific latency and bandwidth requirements.  For this purpose use of
   checklist assessment results may include, but are not limited to:

[daw: A few paragraphs in this section jumped around in the concepts they were discussing. I reorganized and broke up some of the content in this section to make it easier to follow. Please let me know if you would like to see any additional changes.]

Could you introduce latency and bandwidth in a different way?  It seems odd to follow from descriptions on types of checklists (or 'applications of checklists').

[daw: I changed the text to call out data availability, timeliness, and liveness as something that needs to be considered relative to operational constraints around network latency and available bandwidth. Please let me know if you’d like to see further changes.]

Now that I read the types of checklists and how varied they are, I think it may be better to delete the transitional sentence listed above as there are many other types of checklists included in the list that follows.

[daw: There were multiple paragraphs identifying different checklist types. I consolidated these with a shorter transitional sentence.]

Section 2.2.4
Could you make it more clear that the query mechanism described int his section is to be provided by SACM?  I assume that is the case.  This may come up in other reviews, why is the section here if it doesn't use SACM.

[daw: Added text speaking to this.]

Section 4, Security Considerations.
I recommend replacing the following sentence:
   While it is about security, it does not affect
   security.
with something that explains where the security considerations will be addressed.  Something like:
   Security considerations will be provided in solution
   standards as appropriate to the function described
   in each solution document.

[daw: Added text speaking to this with examples of related documents.]

5. Acknowledgements

Is "Security Automation" copyrighted or trademarked?  The first paragraph is odd if it is not.  If it is, then disclosures are needed.  By having this sentence in the draft, some type of disclosure may be needed so people understand why it is there as there are many instances of security automation by vendors and groups like ICASI and TCG.

[daw: There is not copyright or trademark for “Security Automation” that I am aware of. I deleted the sentence since it isn’t really relevant to this document.]

--

Best regards,
Kathleen

--

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Sun, 1 Mar 2015 18:56:18 -0500

Hi Dan,

Thank you, I have put in the request for last call to begin.  It will
likely start tomorrow.

Best regards,
Kathleen

On Sun, Mar 1, 2015 at 4:51 AM, Romascanu, Dan (Dan) <[email-masked]>
wrote:

>  Hi Kathleen,
>
>
>
> Thanks for your support. The time seems right for the IETF Last Call now,
> especially as IETF 92 is scheduled in three weeks, and we will be able to
> address at the meetings in Dallas the comments we will receive and discuss
> their resolution.
>
>
>
> Thanks and Regards,
>
>
>
> Dan
>
>
>
>
>
> *From:* sacm [mailto:[email-masked]] *On Behalf Of *Kathleen
> Moriarty
> *Sent:* Friday, February 27, 2015 3:05 AM
> *To:* Waltermire, David A.
> *Cc:* [email-masked]
> *Subject:* Re: [sacm] AD Review of SACM Use Case Draft
>
>
>
> Dave & Dan,
>
>
>
> Thank you for incorporating the updates and the WG for your efforts on
> this draft.  I just verified the updates and the draft looks like it is
> ready to start IETF last call.  If the shepherd (Dan) agrees, I'll kick
> that off right away.
>
>
>
> On Thu, Feb 26, 2015 at 7:08 PM, Waltermire, David A. <
> [email-masked]> wrote:
>
> Kathleen,
>
>
>
> I just posted an updated use cases draft based on your comments below and
> your previous comments on 11/5/2014 (
> http://www.ietf.org/mail-archive/web/sacm/current/msg02139.html
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ietf.org_mail-2Darchive_web_sacm_current_msg02139.html&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=hlgL0tJTX7JO-j10yWY5jEbfxXoECQpEZxzSwH0QMJw&s=3gBXtyjjAkY62ifhxh_j2nZW3IUpWSBhQageK5Iv-ZE&e=>
> ).
>
>
>
> *From:* sacm [mailto:[email-masked]] *On Behalf Of *Kathleen
> Moriarty
> *Sent:* Monday, February 16, 2015 10:54 AM
> *To:* [email-masked]
> *Subject:* [sacm] AD Review of SACM Use Case Draft
>
>
>
> Hello,
>
>
>
> The following is my review of the SACM use case draft.  Since this is a
> charted item and milestone for SACM, the work can proceed.  A statement
> from the IESG on use case drafts will be coming out soon, thanks to those
> that assisted in building arguments.
>
>
>
> SACM use case draft:
>
>
>
> Introduction:
>
> [daw: A few paragraphs in this section jumped around in the concepts they
> were discussing. I reorganized and broke up some of the content in this
> section to make it easier to follow. Please let me know if you would like
> to see any additional changes.]
>
>
>
> Could you introduce latency and bandwidth in a different way?  It seems
> odd to follow from descriptions on types of checklists (or 'applications of
> checklists').
>
>
>
> [daw: I changed the text to call out data availability, timeliness, and
> liveness as something that needs to be considered relative to operational
> constraints around network latency and available bandwidth. Please let me
> know if you’d like to see further changes.]
>
>
>
> Now that I read the types of checklists and how varied they are, I think
> it may be better to delete the transitional sentence listed above as there
> are many other types of checklists included in the list that follows.
>
>
>
> [daw: There were multiple paragraphs identifying different checklist
> types. I consolidated these with a shorter transitional sentence.]
>
>
>
> Section 2.2.4
>
> Could you make it more clear that the query mechanism described int his
> section is to be provided by SACM?  I assume that is the case.  This may
> come up in other reviews, why is the section here if it doesn't use SACM.
>
>
>
> Is "Security Automation" copyrighted or trademarked?  The first paragraph
> is odd if it is not.  If it is, then disclosures are needed.  By having
> this sentence in the draft, some type of disclosure may be needed so people
> understand why it is there as there are many instances of security
> automation by vendors and groups like ICASI and TCG.
>
>
>
> [daw: There is not copyright or trademark for “Security Automation” that I
> am aware of. I deleted the sentence since it isn’t really relevant to this
> document.]
>
>
>
> --
>
>
>
> Best regards,
>
> Kathleen
>
>
>
>
>
> --
>
>
>
> Best regards,
>
> Kathleen
>

-- 

Best regards,
Kathleen