Subject: [sacm] [draft-ietf-sacm-information-model] is whether or not attributes were collected in an authenticated or unauthenticated manner metadata we care about? (#35)

From: Danny Haynes <[email-masked]>
Date: Wed, 06 Jan 2016 06:55:53 -0800

As part of feedback on the vulnerability assessment scenario, it was asked if authenticated data always takes precedence over unauthenticated data  This needs to be discussed further, but, we should consider whether or not attributes were collected in a authenticated or unauthenticated manner is metadata that we care about and if we should include it in the information model (eg similar how we want to capture if an attribute can be used for designation/identification or if it is has privacy concerns)

Please see the following mailing list thread for more information

http://wwwietforg/mail-archive/web/sacm/current/msg03597html

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/35

---

From: Danny Haynes <[email-masked]>
Date: Thu, 07 Jan 2016 06:52:20 -0800

Agree.

If the WG agrees that authenticated data always takes precedence over unauthenticated data, I think you are correct.  However, another option might be to make this precedence configurable in evaluation guidance.  Yet another option might be to define an algorithm that specifies how precedence should be handled and when.  Anyways, thinking through these options and how we want to handle this is where I think we need further discussion.

Agree.

Do you have a pointer to the question on the list?  

Agree.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/35#issuecomment-169685109

---

From: Danny Haynes <[email-masked]>
Date: Thu, 07 Jan 2016 07:43:56 -0800

That is a good question and I don't know that I have a definitive answer.  Although, I do agree that all authenticated data is not necessarily created equal.  It probably depends on the details of the authentication mechanisms.  For example, what if the multi-factor authentication includes a mandatory 25-character password, passcode token, fingerprint recognition, and a key to get into the only room where the endpoint/service can be accessed/activated from.  That seems like it would be equivalent to a certificate (at least for practical purposes) :). 

I think when we start getting into the "quality" of something whether it is authentication, collected data, etc. it starts to get very subjective and will likely be something that is dependent on the organization deploying the SACM ecosystem and their risk tolerance.

In these cases, I don't think we want to mandate a specific behavior.  Rather, I think we want to provide organizations with the information and mechanisms to tailor the SACM ecosystem to address their needs and tolerances.  Of course, we need to be careful not to create something that is overly complex and unusable.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/35#issuecomment-169700126

---

From: stevensj <[email-masked]>
Date: Thu, 07 Jan 2016 08:22:16 -0800

Agree. Good discussion and great point on the slippery slope related to varying quality levels of authenticated results - for example a limited privileges service account vs. root level permissions will differ in scan accuracy. However, if there is an opportunity provide a high level category or an ability to notate a greater trust to authenticated data in the event it is compared to a future unauthenticated result - ideally this could accommodate broader enterprise vulnerability programs.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/35#issuecomment-169714026