Subject: [sacm] Requirements draft review

From: Chris Inacio <[email-masked]>
Date: Mon, 20 Apr 2015 21:55:30 +0000

My comments / suggestions are enclosed in “!!” - search for that.  :)

1. Introduction - last sentence
	. . . involve posture assessment of endpoint.
!!  should that also have “in the enterprise” added? !!

G-003  Scalability: The data models, protocols, and transports MUST
    be scalable.  SACM must support a broad set of deployment scenarios.
    Scalability must be addressed to support:

    *  Large datagrams: It is possible that the size of posture
       assessment information can vary from a single assessment that is
       small in (record or datagram) size to a very large datagram or a
       very large set of assessments.

   *  Large number of providers and consumers: A deployment may consist
       of a very large number of endpoints requiring !! should be requesting? !! or producing (or
       both) posture assessment information.

G-005  Information Extensibility: A method for expressing both
    standard and non-standard (implementation-specific) data attributes
    while avoiding collisions SHOULD be defined.  For interoperability
    and scope boundary, an explicit set of data attributes MUST be
    defined as mandatory to implement.

!! should the data attributes be data model defined or info model defined? !!

G-010 !! is this possible with multiple / various data models & protocols in use? !!

G-012 !! I don’t know what this means. !!

ARCH-003 !! Does this mean that SACM must define a method to manage the preference / selection of data models and transport protocols employed in the deployment of a SACM assessment solution? !!

ARCH-005 !! Does this combine or conflict with ARCH-003?  !!

IM-003  !! Seems to really conflict with ARCH-003 !!

DM-003 / DM-004 !! 3 says rootless searches must be supported and 4 says rooted searches must be supported?  Can these be combined to say “rootless and rooted searches MUST be supported”? !!

DM-008 / DM-011 !! duplicates? !!

DM-006 !! please rewrite, but I read it to duplicate DM-016 !!

DM-018  The data model MUST support the collection of attributes by a
    variety of collectors, including internal collectors, external
    collectors with an authenticated relationship with the endpoint, and
    external collectors based on network and other observations !! observers !!.

OP-001  !! Time !! Synchronization: Request and response operations SHOULD be
    timestamped, and published information SHOULD capture time of
    publication.  Actions or decisions based on time-sensitive data
    (such as user logon/logoff, endpoint connection/disconnection,
    endpoint behavior events, etc.) are all predicated on a synchronized
    understanding of time.  A method for detecting and reporting time
    discrepancies SHOULD be provided.

OP-004  Attribute-based query: A query operation SHOULD be based on a
    set of attributes.  !! Can we remove previous sentence, it seems better without it !!  Use Case 2.1.2 describes the need for the data
    model to support a query operation based on a set of attributes to
    facilitate collection of information such as posture assessment,
    inventory (of endpoints or endpoint components), and configuration
    checklist.

OP-005  Information-based query with filtering: The query operation
    MUST support filtering.  Use Case 2.1.3 describes the need for the
    data model to support the means for the information to be collected
    through a query mechanism.  Furthermore, the query operation
    requires filtering capabilities to allow for only a subset of
    information to be retrieved.  !! separate requirement follows, right? !! The query operation MAY be a
    synchronous request or asynchronous request.

T-004 !! does this have to be provided by the transport protocol?  Are we only using SCTP (if even that.) !!

!! Sentence fragment follows, get rid of “With”?? !! With SACM's charter focus on the sharing of posture information for
   improving efficacy of security applications such as compliance,
   configuration, assurance and other threat and vulnerability reporting
   and remediation systems.  While the goal is to facilitate the flow of
   information securely, it is important to note that participating
   endpoints may not be cooperative or trustworthy.

In the information transport flow, it is possible that some of the
   devices may serve as proxies or brokers and as such, may be able to
   observe the communications flowing between an information provider
   and requester.  Without appropriate protections !! I’ve got nothing, it just stops… !!

A requestor beyond distrusting the network service provider, must
   also account that the information received from the provider may have
   been communicated through an undetermined network communications
   system.  That is, the posture information may have traversed through
   many devices before reaching the requestor.  !! get rid of “As such,” !! As such, providing non-
   repudiation in SACM is out of scope.  However, SACM specifications
   should provide the means for allowing non-repudiation possible and at
   minimum, provide endpoint authentication and transport integrity.

--
Chris Inacio
[email-masked]