Subject: [sacm] call for reviewers for NEA/TNC specs (corrected)

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 20 May 2015 09:12:39 +0000

Following the virtual interim meeting last week we would like to have (at least) one SACM assigned reviewer looking into the relevant NEA/TNC specifications.

The relevant specifications are available at:

Endpoint Compliance Profile: http://www.trustedcomputinggroup.org/files/static_page_files/1B8D6839-1A4B-B294-D005B7E08AFD599C/Endpoint%20Compliance%20Profile%20v1r10.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_1B8D6839-2D1A4B-2DB294-2DD005B7E08AFD599C_Endpoint-2520Compliance-2520Profile-2520v1r10.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=F9UWbX2-VvBwthJ6zxRlHI8telBw-9u1zMk3wT8Wfyw&e=>

IF-IMC: http://www.trustedcomputinggroup.org/files/static_page_files/1D8C8F15-1A4B-B294-D0CD725393CC0A93/TNC_IFIMC_v1_3_r18.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_1D8C8F15-2D1A4B-2DB294-2DD0CD725393CC0A93_TNC-5FIFIMC-5Fv1-5F3-5Fr18.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=xAxT9cvhiY96L0stYHZkcNkjXnTgT1DlchZcj4GT59Y&e=>

IF-IMV: http://www.trustedcomputinggroup.org/files/static_page_files/1B8DC7E9-1A4B-B294-D03FF940B830FADE/TNC_IFIMV_v1_4_r10.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_1B8DC7E9-2D1A4B-2DB294-2DD03FF940B830FADE_TNC-5FIFIMV-5Fv1-5F4-5Fr10.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=aKjwHATD-6rWHd1OecZRRcgwYlGJgtM2CUDGuWgDNVc&e=>

SWID Messages for IF-M (DRAFT): http://www.trustedcomputinggroup.org/files/static_page_files/14609086-1A4B-B294-D01DE94EC996C8B9/SWID_Messages_For_IFM_v1r26-forreview.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_14609086-2D1A4B-2DB294-2DD01DE94EC996C8B9_SWID-5FMessages-5FFor-5FIFM-5Fv1r26-2Dforreview.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=I5_VmcDFCBZelKYXc8yl3SemYD_POgn6PYGCf3UnLiE&e=>

PDP Server Discovery and Validation (DRAFT): http://www.trustedcomputinggroup.org/files/static_page_files/AC1492C5-1A4B-B294-D0C02056A4F9A400/PDP_Discovery_And_Validation_v1_0r9.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_AC1492C5-2D1A4B-2DB294-2DD0C02056A4F9A400_PDP-5FDiscovery-5FAnd-5FValidation-5Fv1-5F0r9.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=1KfSQg7cx9B50Qm7VrFirN3WhKw13x7Pqy1Zq09Rni8&e=>
(note: a new draft, with substantial revisions, is due out for public review quite soon)

NEA specifications: https://datatracker.ietf.org/wg/nea/documents/<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_wg_nea_documents_&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=ruOyuWwnHnogIhqUeg8XacVqUkSHfA6h9zxqe6CFkdY&e=>

strongSwan's implementation: https://wiki.strongswan.org/projects/strongswan/wiki/TrustedNetworkConnect<https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.strongswan.org_projects_strongswan_wiki_TrustedNetworkConnect&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=4W-yiw2AChRs6ihRRhXHGrynlAhTESFtwMJgOcq1xuU&e=>

The purpose of this assessment is to evaluate how the NEA/TNC specifications meet the requirements for SACM and can fit into the SACM framework.
The timeline is until the next SACM interim meeting on June 29 or 30. Earlier would be appreciated.

Thanks and Regards,

Dan

---

From: Jerome Athias <[email-masked]>
Date: Fri, 22 May 2015 21:01:23 +0300

Hi,

I can't commit to that.
However, after first review of TCG ECP (Endpoint Compliance Profile)
Specification Version 1, Revision 10, 5 December 2014:

I can feel the overlap.
"The Trusted Network Connect Work Group (TNC-WG) has defined an open
architecture for network security, including standard protocols for
endpoint assessment and remediation."
TNC Architecture should be investigated further.
I found a reference to rfc5209 in this document.
Due to yet non-existing standardized Cybersecurity Ontology; different
taxonomies. (I found no Glossary in this document)
"The TNC and the IETF define an endpoint as any network-connected
device": we (SACM) had or MUST come with a better definition.
It relies on ISO/IEC SWID
Note that 2.4 Future Work indicates that they "will incorporate other
types of data available from endpoints, such as configuration
settings, when suitable schema are developed and are supported by
vendors" => @OVAL Folks, @CIS Friends: opportunity
The use cases are, in few words, mainly for Network Access Control.
It uses a TNC Client and TNC Server to exchange messages, and a CMDB.
It comes with simplified Threat Models, and Countermeasures

/EOT

2015-05-20 12:12 GMT+03:00 Romascanu, Dan (Dan) <[email-masked]>:
> Following the virtual interim meeting last week we would like to have (at
> least) one SACM assigned reviewer looking into the relevant NEA/TNC
> specifications.
>
>
>
> Endpoint Compliance Profile:
> http://www.trustedcomputinggroup.org/files/static_page_files/1B8D6839-1A4B-B294-D005B7E08AFD599C/Endpoint%20Compliance%20Profile%20v1r10.pdf
>
>
>
> IF-IMC:
> http://www.trustedcomputinggroup.org/files/static_page_files/1D8C8F15-1A4B-B294-D0CD725393CC0A93/TNC_IFIMC_v1_3_r18.pdf
>
>
>
> IF-IMV:
> http://www.trustedcomputinggroup.org/files/static_page_files/1B8DC7E9-1A4B-B294-D03FF940B830FADE/TNC_IFIMV_v1_4_r10.pdf
>
>
>
> SWID Messages for IF-M (DRAFT):
> http://www.trustedcomputinggroup.org/files/static_page_files/14609086-1A4B-B294-D01DE94EC996C8B9/SWID_Messages_For_IFM_v1r26-forreview.pdf
>
>
>
> PDP Server Discovery and Validation (DRAFT):
> http://www.trustedcomputinggroup.org/files/static_page_files/AC1492C5-1A4B-B294-D0C02056A4F9A400/PDP_Discovery_And_Validation_v1_0r9.pdf
>
> NEA specifications: https://datatracker.ietf.org/wg/nea/documents/
>
>
>
> strongSwan's implementation:
> https://wiki.strongswan.org/projects/strongswan/wiki/TrustedNetworkConnect
>
>
>
>
>
> The purpose of this assessment is to evaluate how the NEA/TNC specifications
> meet the requirements for SACM and can fit into the SACM framework.
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>