Subject: [sacm] Mobile devices

From: Clifford Kahn <[email-masked]>
Date: Thu, 26 Mar 2015 00:23:28 +0000

If I understand right, the consensus is that mobile devices are not central. In some slice of the world they aren't. But in the commercial world they are. I believe that in much of the commercial world, mobile devices are the *main* compliance concern.

If the initial SACM standards are silent on how to monitor compliance of these devices, the standards will not help a large segment. That will hinder adoption - perhaps terribly.

I appreciate that we need to create a set of standards that are *useful*, *soon*. I am all over that.

But that requires wise pruning, not just pruning. There won't be a SACM 2.0 unless SACM 1.0 gets adopted.

Full disclosure: I work for a mobile security company. I don't think that invalidates my argument.

Best,
                                                Cliff

Clifford Kahn
Principal Engineeer, Technical Lead

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 26 Mar 2015 00:54:25 +0000

Cliff,

I believe that most would agree that mobile is important and even central to what we are trying to accomplish. Where there is concern around is the "useful" and "soon" dimensions. I don't believe that we should focus on mobile to the exclusion of servers, workstations (e.g., desktops, laptops) and network devices (e.g., routers, switches, firewalls). The important thing to consider is do we have enough of the right people participating to do all of this and mobile at the same time?

Do not take any of this as personal criticism. You and Lisa have both been valuable participants in this effort. We would not have made the progress we have without your help. In fact, we need your continued help to continue to make progress. But to make progress on all of this we need more of the right people in the room. We need people from multiple organizations that can propose protocol and data model drafts and see them to completion. Without increased participation from other organizations, I don't see a way forward to do all of this at the same time.

I may be wrong, but our current progress indicates otherwise. So how do we keep the focus broad while increasing our ability to deliver "useful" "soon"?

Sincerely,
Dave

From: sacm [mailto:[email-masked]] On Behalf Of Clifford Kahn
Sent: Wednesday, March 25, 2015 7:23 PM
To: [email-masked]
Subject: [sacm] Mobile devices

Best,
                                                Cliff

Clifford Kahn

---

From: "Adam W. Montville" <[email-masked]>
Date: Wed, 25 Mar 2015 20:51:55 -0500

> On Mar 25, 2015, at 7:54 PM, Waltermire, David A. <[email-masked]> wrote:
> 
> Cliff,
>  
> I believe that most would agree that mobile is important and even central to what we are trying to accomplish. Where there is concern around is the “useful” and “soon” dimensions. I don’t believe that we should focus on mobile to the exclusion of servers, workstations (e.g., desktops, laptops) and network devices (e.g., routers, switches, firewalls). The important thing to consider is do we have enough of the right people participating to do all of this and mobile at the same time?
>  
> Do not take any of this as personal criticism. You and Lisa have both been valuable participants in this effort. We would not have made the progress we have without your help. In fact, we need your continued help to continue to make progress.

+1, definitely +1

> But to make progress on all of this we need more of the right people in the room. We need people from multiple organizations that can propose protocol and data model drafts and see them to completion. Without increased participation from other organizations, I don’t see a way forward to do all of this at the same time.
>  
> I may be wrong, but our current progress indicates otherwise. So how do we keep the focus broad while increasing our ability to deliver “useful” “soon”?

There may be a saving grace in MDM solutions (having no hands-on experience).  These seem like applications to me - something that runs on a “traditional” endpoint, so we could assess that, which allows for some indirect assessment of the actual device (or maybe in that space it’s the same thing).

One of the questions I asked in a different thread is whether we’re using the proper language to talk about these things.  Instead of discussing servers, desktops, mobile, and network devices, should we instead be talking in terms of collection mechanisms (hoping that term isn’t overloaded or with serious baggage)?  A rudimentary example is this.  I’m confident we’re going to want to support assessing configurations expressed in text files (including XML and JSON or key/value type files).  We’re probably going to want to support assessing configurations found in registry keys and Windows GPOs.  This is a different way to talk about scope, and perhaps one that starts to slice across more device types than simply saying “this device” or “that device”.

I’m simply trying to further the discussion with such suggestions.

> If the initial SACM standards are silent on how to monitor compliance of these devices, the standards will not help a large segment. That will hinder adoption – perhaps terribly.
>  
> But that requires wise pruning, not just pruning. There won’t be a SACM 2.0 unless SACM 1.0 gets adopted.
>  
> Full disclosure: I work for a mobile security company. I don’t think that invalidates my argument.
>  
> Best,
>                                                 Cliff
>  
> Clifford Kahn
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: "Adam W. Montville" <[email-masked]>
Date: Thu, 26 Mar 2015 07:24:14 -0500

> On Mar 26, 2015, at 7:20 AM, Wolfkiel, Joseph L CIV DISA ID (US) <[email-masked]> wrote:
> 
> I'm not completely understanding why there's a belief that the SACM guidance can afford to differentiate between mobile and non-mobile devices at this point.  If the focus is on device identification and characterization/profiling, I would expect that determining whether a given device is a "mobile" device, whatever that means, would be part of the discovery and characterization process.  Once you have a profile of an identified device, you can determine how much and which assessments you are capable of running against it.

Your comment seems to speak to talking not in terms of device class but collection mechanisms.  Fair statement?

> 
> What, exactly, is the working definition of mobile device in this discussion?  Is it a form-factor attribute or is it that a device is running an OS built to run on mobile devices?  If a device has a software configuration, hardware configuration, and network configuration, determining that it is "mobile" is some function of assessing its software and hardware configuration, right?
> 
> Joseph L. Wolfkiel
> SCM Engineering Lead
> DISA ID52
> (301) 225-8820
> [email-masked]
> 
> 
> 
> -----Original Message-----
> From: sacm [mailto:[email-masked]] On Behalf Of Adam W. Montville
> Sent: Wednesday, March 25, 2015 9:52 PM
> To: Dave Waltermire
> Cc: Clifford Kahn; [email-masked]
> Subject: Re: [sacm] Mobile devices
> 
>

---

From: "Wolfkiel, Joseph L CIV DISA ID (US)" <[email-masked]>
Date: Thu, 26 Mar 2015 12:32:25 +0000

Possibly.  I'm not sure that's the answer either, but maybe it's a matter of better defining what we're talking about.  Are "mechanisms" defined as agent-based (e.g. software management agents) vs network-based (e.g vulnerability scanners) vs boundary based (e.g. NAC), or is "SCAP" a "mechanism", or is it some other concept?  I would usually lean toward defining a set of attributes that must be collected about a device to characterize it to the extent necessary to understand the limits of your "sensing" infrastructure to build a correct profile.

Joseph L. Wolfkiel
SCM Engineering Lead
DISA ID52
(301) 225-8820

---

From: Clifford Kahn <[email-masked]>
Date: Thu, 26 Mar 2015 17:45:18 +0000

It's true that "mobile" is not a cut and dried category. 
- An iPad is a mobile device. But it's not that different from a laptop.
- An iPhone or Android is not that different from an iPad. 
- The most obvious difference is physical size, but that is irrelevant to SACM.  
- For that matter, laptops are mobile too. 

So "mobile" is a category with fuzzy boundaries. But it still has meaning. 

Some things are more true of smaller mobile devices. 
1. Smaller mobile devices are connected a smaller part of the time. Because of battery life, they mostly cannot maintain a constant connection. So the continuous monitoring cannot be altogether continuous. (Laptops also have this issue -- they sleep.)
2. Mobile devices are mobile (of course). Monitoring their compliance when they are off premises is still interesting. But the mechanism of doing so may be different. MDM systems come into play. 

If SACM is to be good for monitoring mobile devices, it should accommodate those realities, especially 1.

Ice Station Zebra is also not continuously connected. So, 1 is not a new requirement. 

I don't see how 2 affects the attributes to be collected. But 2 may place requirements on the transport protocol. 

To David's question about who can do the work of fleshing out SACM for mobile devices -- Lisa and I bring both knowledge and interest. 

Best,
			Cliff

-----Original Message-----
From: Wolfkiel, Joseph L CIV DISA ID (US) [mailto:[email-masked]] 
Sent: Thursday, March 26, 2015 8:32 AM
To: Adam W. Montville
Cc: Clifford Kahn; Dave Waltermire; [email-masked]
Subject: Re: [sacm] Mobile devices

Joseph L. Wolfkiel
SCM Engineering Lead
DISA ID52
(301) 225-8820