Subject: [sacm] SACM components (except at endpoints) MUST have time sync

From: Ira McDonald <[email-masked]>
Date: Fri, 14 Aug 2015 11:11:31 -0400

Hi,

[From our discussion on 8/14/15 on the Endpoint Identity team call]

I postulate that, within the SACM components domain, reliable and
trustworthy time synchronization is necessary:

(a) To support authentication, replay-defense, etc. in SACM transport
bindings of SACM data models;

(b) To timestamp collected SACM attributes and their metadata; and

(c) To correlate an event stream (timestamped) with SACM attribute
values at a given point in time, in order to make policy and/or
remediation decisions.

I propose that the following two conformance requirements be defined
in the information model and be normative for all SACM data models
and all SACM transport bindings of those data models:

(1) SACM endpoint collectors SHOULD implement time sync and
add correct timestamps to all collected SACM attributes.

(2) SACM components, except endpoints, MUST implement time sync
and add correct timestamps to all collected SACM attributes.

Comments?

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Winter  579 Park Place  Saline, MI  48176  734-944-0094
Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434

---

From: "Wolfkiel, Joseph L CIV DISA ID (US)" <[email-masked]>
Date: Fri, 14 Aug 2015 15:23:57 +0000

To further expand on the proposal, I propose that a set of SACM-relevant timestamps should be defined.  For example:

1. the time an "event" happened (based, for example, on an audit log entry)
2. the time an event record was discovered or collected by the sensing application
3. the time an event or data element was received by the manager/aggregator (regardless of which tier)

If we can define the timestamps that are of interest, then we can determine which "should" or "must" have rigidly synchronized timestamps applied.  I suggest that if all the timestamps end up being "should", then timestamp synchronization is unenforceable.

Joseph L. Wolfkiel
SCM Engineering Lead
DISA ID52
Work: (301) 225-8820
Gov Cell: (571) 814-8231
[email-masked]

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Ira McDonald
Sent: Friday, August 14, 2015 11:12 AM
To: [email-masked]; Ira McDonald
Subject: [sacm] SACM components (except at endpoints) MUST have time sync

Hi,

remediation decisions.

Comments?

Cheers,

- Ira