Subject: [sacm] Endpoint ID Design Team Notes: 2015-05-22

From: "Adam W. Montville" <[email-masked]>
Date: Fri, 22 May 2015 14:51:10 -0500

Thanks to Danny and Dave for carrying this forward when I could not attend.  I’ll get the recording uploaded once it is made available by the WebEx system (it’s not yet available, which is odd).  Notes provided here are from Danny (thanks!)

Adam

Attendees
·         Dave Waltermire
·         Henk Birkholz
·         Cliff Kahn
·         Ron Colvin
·         Danny Haynes
 
Note Well
 
Agenda
·         Discuss the outline for updates to the information model around endpoint identity (http://www.ietf.org/mail-archive/web/sacm/current/msg02797.html <http://www.ietf.org/mail-archive/web/sacm/current/msg02797.html>)
·         Next steps
 
Agenda Bashing
For this meeting, the primary focus should be discussing the outline that Cliff put together as well as the feedback that was received on the list. 
 
Materials
https://www.dropbox.com/sh/bs0hioy5qh6qzr1/AAA2lzSwCFE_pfYMlpP3bRu_a?dl=0 
 
Notes
First, the Endpoint ID Design Team discussed the feedback from the two messages on the mailing list.  Out of this discussion, a few important points were raised.
 
·         There was discussion around whether or not location information was endpoint identification or characterization.  If the location information could be used to uniquely identify an endpoint then it could be considered endpoint identification, but if it could not, it was probably endpoint characterization information.  This highlighted the need to define the terms “identification” and “characterization” so that they can be distinguished.  It was noted that having a controlled vocabulary would help and that a section on characterization should be added to the information model.
 
·         There was agreement that there is a need to be able to identify a particular assessment target on an endpoint, but, that it gets into other types of identification such as software identification, which is currently out of scope for the Endpoint ID Design Team charter.  The Endpoint ID Design Team charter states the team should specifically focus on endpoint identity.  To ensure that this is captured for later development, the team would like to include a stub for this and other areas that we are interested in.  The Endpoint ID Design Team also recognized that they may need to add a small amount of text around this area in their current work as it is related.
 
·         Who is the consumer of identity information?  In Joe Wolfkiel’s example, the location information would be especially useful to a human (owner of the phone, address of the phone, etc.), however, it may not be as useful for SACM components communicating with each other which would probably be more interested in information like IP addresses, etc.  It was noted that it may be good to describe this type of information in the information model and that the issues should be brought to the mailing list for further discussion.  It was also noted that SACM will need to be able to explain information to a human, but, that it might not be in the scope for right now.  The Endpoint ID Design Team may also want to look at standards for location.
 
For the remainder of the call, the Endpoint ID Design Team reviewed the outline that Cliff put together, discussed important topics, and provided feedback.  The results of this discussion are captured in a revised version of the outline that Cliff posted (http://www.ietf.org/mail-archive/web/sacm/current/msg02806.html <http://www.ietf.org/mail-archive/web/sacm/current/msg02806.html>).  A few other important points were raised.
 
·         The security considerations subsection was removed in favor of providing subsections describing the problems associated with endpoint identity (effects of misidentification, things that can cause misidentification, how to minimize misidentification) and the impact of those problems as it relates to security would be covered in the security considerations section of the information model which could then refer back to these subsections.
 
·         There was some discussion as to whether or not normative language should be used when describing the attributes and properties.  It was noted that the information model should include some text around how the value of attributes, based on the properties, will vary depending on the domain in which they are used.
 
·         It was noted that there is a need to define an endpoint assertion model in general as well as with respect to posture attributes and endpoint characterization.  As a result, a section to discuss the concept of raw and derived assertions was added to the outline.  However, there was some feedback that raw assertions may not be the correct term to describe the information produced by a collector.  In the interest of time, the Endpoint ID Design Team agreed this needed more discussion.
 
Action Items for Next Week
·         Develop a template for describing an attribute for Section 4.x.1 (Cliff Kahn)
 
·         Send a message to the list discussing why raw assertions may not be a good term to use (Henk Birkholz)
 
·         Start to put together the catalog for Section 4.x.2 (Dave Waltermire)