Subject: [sacm] Endpoint ID Design Team Minutes+Recording: 2015-04-10

From: "Adam W. Montville" <[email-masked]>
Date: Fri, 10 Apr 2015 10:12:55 -0500

A few of us met today to continue discussing endpoint identity test cases; the recording is available [1].  Below are the notes I took during the meeting.  But, before presenting those, here is the plan of action moving forward.  Danny and Cliff have both agreed to continue working on specific test cases.  I have also placed two PowerPoint decks at [1] as well.  One is "usage-scenarios+daw.pptx”, which is the (modified) deck we discussed during side-meetings in Dallas.  The other is "2015-04-10_Chair.pptx”, which contains a slide with test case assignments.  These are as follows:

Network Profiler (Cliff)
SACM Collector on an endpoint (Danny)
Management Component managing collection of endpoints (Cliff)
Evaluator (Danny)
Datastore (e.g. CMDB) (Danny)

Our goal is to complete these test cases for discussion next week (2015-04-17), then to move on to considering the specific details of each identifying attribute we might need to consider (i.e is modeling the public key of Certificate and/or Cryptographic information sufficient?) for the following week (2015-04-24).  From these final details we should have enough information to begin making updates to the information model.  At that point, we might be able to consider this design team effort complete.

[START NOTES]
We started out talking about how to start defining models for the things we're planning to use for endpoint identification.

Who is going to do which scenarios?

We have some names next to items.  1 - 2 weeks outside latest.  We need to wrap this up then take Danny's approach of really looking at which attributes of these things we want to actually model.

What seems important to Cliff is the public key of the endpoint.  

Cliff is asserting that the Public Key is hte most important aspect of cryptographic information, even for certificates.

Jess is agreeing with the 1-2 week goal.  

The present thought is that our test cases will make their way into the Information Model, possibly as frontmatter to the/a Endpoint Identity Section.

Adding examples of different types of attributes, i.e. different types of certificates, may be useful as a follow on to test case development. 

It became clear at the f2f that understanding the attributes we're going to have will produce some "output" (yield assertions, for example).  We want to identify the endpoints with which they're associated.

There's nothing yet defined in the terminology document about guidance.  So, do we want this to be covered in our current work?  Guidance is probably best thought of as a separate problem, and likely one that will build upon the endpoint identification work we're doing with exploring test cases and building out the information model.

Jess also notes that we haven’t sorted out the scope discussion.
[END NOTES]

Please let me know if you have any comments or questions.

Regards,

Adam

[1] https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0 <https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0>