Subject: Re: [sacm] Requirements draft review

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Fri, 8 May 2015 04:54:39 +0000

Hi Chris,

Many thanks for all the commentsŠ.see further comments/questions below:

On 4/20/15, 2:55 PM, "Chris Inacio" <[email-masked]> wrote:

>My comments / suggestions are enclosed in ³!!² - search for that.  :)
>
>
>1. Introduction - last sentence
>	. . . involve posture assessment of endpoint.
>!!  should that also have ³in the enterprise² added? !!
[NCW] Fair enough as it is in the charter, I can add it here too (in -05).

>
>
>G-003  Scalability: The data models, protocols, and transports MUST
>    be scalable.  SACM must support a broad set of deployment scenarios.
>    Scalability must be addressed to support:
>
>    *  Large datagrams: It is possible that the size of posture
>       assessment information can vary from a single assessment that is
>       small in (record or datagram) size to a very large datagram or a
>       very large set of assessments.
>
>   *  Large number of providers and consumers: A deployment may consist
>       of a very large number of endpoints requiring !! should be
>requesting? !! or producing (or
>       both) posture assessment information.
[NCW] Update done in -05.

>
>
>G-005  Information Extensibility: A method for expressing both
>    standard and non-standard (implementation-specific) data attributes
>    while avoiding collisions SHOULD be defined.  For interoperability
>    and scope boundary, an explicit set of data attributes MUST be
>    defined as mandatory to implement.
>
>!! should the data attributes be data model defined or info model
>defined? !!
[NCW] Information model (that of course the data model employs in their
own representation)Š.but I will clarify that the MUST to implement needs
to be specified in the IM

>
>G-010 !! is this possible with multiple / various data models & protocols
>in use? !!
[NCW] Not sure I understand the question?  The intent is to allow for a
data model and operations on the data model to discover target endpoints
(and SACM ³component² endpoints).

>
>G-012 !! I don¹t know what this means. !!
[NCW] The intent is to say that the means by which components within the
SACM architecture (e.g. A provider has an interface defined so it can
communicate and provide posture information to a requestorŠor to the
control plane).  In previous threads, a similar comment was made by Jim to
my inconsistent use of terminologyŠ.the interface in this instance is the
coupling of a transport to courier an operation based on a data model.
Does that help?  If there is agreement, then I could make clarifications
to that extent.

>
>ARCH-003 !! Does this mean that SACM must define a method to manage the
>preference / selection of data models and transport protocols employed in
>the deployment of a SACM assessment solution? !!
[NCW] Yes.

>
>ARCH-005 !! Does this combine or conflict with ARCH-003?  !!
[NCW] They are meant to complement each other. Perhaps make ARCH-005 a
subset of -003?

>
>IM-003  !! Seems to really conflict with ARCH-003 !!
[NCW] Perhaps more clarification is needed?  The Architecture speaks to
the role of the different functional roles (of provider, consumer of data
and the management of the components and brokering of the data) whereas
the IM speaks to the allowance of different data models to be able to be
invoked through the ³interfaces² per my definition above. Does that help?
Can you help me by pinpointing how your interpretation makes them conflict
so I can attempt to clarify?

>
>DM-003 / DM-004 !! 3 says rootless searches must be supported and 4 says
>rooted searches must be supported?  Can these be combined to say
>³rootless and rooted searches MUST be supported²? !!
[NCW] Yes, that was also suggested by Jim SchaadŠ.so given both similar
comments, I¹ll go ahead and merge.

>
>DM-008 / DM-011 !! duplicates? !!
[NCW] Yes, that was also suggested by Jim SchaadŠ.I¹ve removed DM-011

>
>DM-006 !! please rewrite, but I read it to duplicate DM-016 !!
[NCW] I think you mean a duplicate to DM-017?  If so, the distinction is
that DM-006 speaks to the ability to do full or partial data information
acquisition as an operation; DM-016 speaks to ensuring that when the data
is provided it is tagged to be ³full² or ³partial" .

>
>DM-018  The data model MUST support the collection of attributes by a
>    variety of collectors, including internal collectors, external
>    collectors with an authenticated relationship with the endpoint, and
>    external collectors based on network and other observations !!
>observers !!.
[NCW] Updated in -05

>
>
>OP-001  !! Time !! Synchronization: Request and response operations
>SHOULD be
>    timestamped, and published information SHOULD capture time of
>    publication.  Actions or decisions based on time-sensitive data
>    (such as user logon/logoff, endpoint connection/disconnection,
>    endpoint behavior events, etc.) are all predicated on a synchronized
>    understanding of time.  A method for detecting and reporting time
>    discrepancies SHOULD be provided.
[NCW] Updated in -05

>
>OP-004  Attribute-based query: A query operation SHOULD be based on a
>    set of attributes.  !! Can we remove previous sentence, it seems
>better without it !!  Use Case 2.1.2 describes the need for the data
>    model to support a query operation based on a set of attributes to
>    facilitate collection of information such as posture assessment,
>    inventory (of endpoints or endpoint components), and configuration
>    checklist.
[NCW] As a requirement, there has to be a MUST or SHOULD language there
which is why that sentence was added.

>
>OP-005  Information-based query with filtering: The query operation
>    MUST support filtering.  Use Case 2.1.3 describes the need for the
>    data model to support the means for the information to be collected
>    through a query mechanism.  Furthermore, the query operation
>    requires filtering capabilities to allow for only a subset of
>    information to be retrieved.  !! separate requirement follows, right?
>!! The query operation MAY be a
>    synchronous request or asynchronous request.
[NCW] Yes, that is a soft requirement.

>
>
>T-004 !! does this have to be provided by the transport protocol?  Are we
>only using SCTP (if even that.) !!
[NCW] Yes as likely a lot of the data model operations will rely on the
network layer transport security (like TLS).

>
>
>!! Sentence fragment follows, get rid of ³With²?? !! With SACM's charter
>focus on the sharing of posture information for
>   improving efficacy of security applications such as compliance,
>   configuration, assurance and other threat and vulnerability reporting
>   and remediation systems.  While the goal is to facilitate the flow of
>   information securely, it is important to note that participating
>   endpoints may not be cooperative or trustworthy.
[NCW] Will do in -05.

>
>In the information transport flow, it is possible that some of the
>   devices may serve as proxies or brokers and as such, may be able to
>   observe the communications flowing between an information provider
>   and requester.  Without appropriate protections !! I¹ve got nothing,
>it just stopsŠ !!
[NCW] My bad, it is meant to caution on MiM attacks if the data and/or
end-to-end transport is not protected.

>
>
>A requestor beyond distrusting the network service provider, must
>   also account that the information received from the provider may have
>   been communicated through an undetermined network communications
>   system.  That is, the posture information may have traversed through
>   many devices before reaching the requestor.  !! get rid of ³As such,²
>!! As such, providing non-
>   repudiation in SACM is out of scope.  However, SACM specifications
>   should provide the means for allowing non-repudiation possible and at
>   minimum, provide endpoint authentication and transport integrity.
[NCW] Will do oin -05.

>
>
>
>
>--
>Chris Inacio
>[email-masked]
>
>
>
>_______________________________________________
>sacm mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/sacm