Subject: Re: [sacm] [draft-ietf-sacm-requirements] Matching Algorithms (#73)

From: "Wolfkiel, Joseph L CIV DISA ID (US)" <[email-masked]>
Date: Wed, 2 Dec 2015 13:32:50 +0000

The other way to look at is that the IM is not sufficient if it doesn't support enough information about an endpoint to determine if two sensors evaluating an endpoint are evaluating the same endpoint or a different endpoint.  It should also provide enough metadata about an endpoint for the same sensor to determine if a endpoint it evaluated at a previous time is the same endpoint currently under evaluation.

Endpoint identification through matching of some data set is, I think, a critical function of any SACM solution.

Or are you saying that the "specific data models" will contain data elements that are not in the IM?  If that's the case, then is the IM really important?

If interoperability is a goal of the standard (maybe it isn't), then the ability to share device identities between products that implement the standard seems like a critical requirement.

Joseph L. Wolfkiel
SCM Engineering Lead
DISA ID52
Fort Meade DISA Acquisiton Bldg Cube A4A58E
Work: (301) 225-8820
Gov Cell: (571) 814-8231
[email-masked]

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Tuesday, December 01, 2015 9:30 PM
To: sacmwg/draft-ietf-sacm-requirements
Subject: Re: [sacm] [draft-ietf-sacm-requirements] Matching Algorithms (#73)

I don't see this a something that needs to be mentioned in this document. I would expect that the exact matching algorithm used is going to be highly proprietary and dependent on specific data models. At this point is is not even clear if the IM would provide the necessary points to hang the result of the matching algorithm is expressed as this implies This means that it would not even be clear at this point how the result of a matching algorithm is even expressed.

We have not even expressed that there is a set of operations that needs to be supported. 

—
Reply to this email directly or view it on GitHub < Caution-https://github.com/sacmwg/draft-ietf-sacm-requirements/issues/73#issuecomment-161159674 > . <Caution-https://github.com/notifications/beacon/AKbE0Z7IuoKGp1MBV90XzcmG5xAGVlXJks5pLk8agaJpZM4GlJCy.gif>

---

From: Jerome Athias <[email-masked]>
Date: Mon, 14 Dec 2015 07:18:06 +0300

1) I would agree that the current IM "is not sufficient if <edited>you
want it to</edited> support enough information about an endpoint to
determine if two sensors evaluating an endpoint are evaluating the
same endpoint or a different endpoint.  It should also provide enough
metadata about an endpoint for the same sensor to determine if a
endpoint it evaluated at a previous time is the same endpoint
currently under evaluation."
I would ask the WG if they agree?

2) "Endpoint identification through matching of some data set is, I
think, a critical function of any SACM solution."
I would ask the WG if they agree?

3) I don't think that the "specific data models" would offer a
sufficient, or efficient solution.
(I would think more about: an aggregation of data models, or (maybe an
utopia) a mega Cyber Model (Ontology))

4) As we agreed, so far, that "the model must let SACM components and
humans reason with uncertainty. There are no facts, only assertions."
I only see mechanisms to support 1) under uncertainty, but with
acceptable (or highest) level of accuracy, confidence, etc.
(NB: the mechanisms/algorithms I envision are not possible with the current IM)

5) "If interoperability is a goal of the standard (maybe it isn't),
then the ability to share device identities between products that
implement the standard seems like a critical requirement."
I would ask the WG if they agree?

2015-12-02 16:32 GMT+03:00 Wolfkiel, Joseph L CIV DISA ID (US)
<[email-masked]>:
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>