Subject: [sacm] Comments on the vulnerability assessment scenario

From: "Takeshi Takahashi" <[email-masked]>
Date: Mon, 18 Apr 2016 14:36:25 +0900

Hello,

The draft "sacm vuln assessment scenario" is very interesting.

We have a prototype system that collects asset information of all the PCs
(incl. servers and terminals) on an Intranet, determines the identifiers of
software assets inside each of the PCs (using CPE-ID, not SWID at this
moment), and receives relevant vulnerability information of NVD (and JVN).
The purpose of the system is to distribute vulnerability information that is
relevant to each organization.

I have one comment from the viewpoint of our use case:

In section 4 "Vulnerability description data":

I assume that the items of NVD is a typical instance of the data mentioned
in the section 4.
Our prototype appreciates the "Vulnerable software and versions" field of
the NVD items.
It queries the NVD by using the CPE-ID that is automatically generated based
on the collected asset information.
>From the purpose of automation (in our prototype), the field is very
important.

I guess "Vulnerable software and versions" information is a type of the
applicability information in this draft.
If we are focusing on automated operation, it would be helpful to mention
that applicability information is appreciated in the vulnerability
description data.

It is not that easy in practice for ordinary administrators to read all the
vulnerability notes.
(We are not dealing with giant companies that has enough resources to buy
everything needed, but with local governments that have only a couple of
administrators.)
Though they cannot read all the notes, they wish to read relevant ones at
minimum.

Thank you, and regards,
Take

---

From: Adam Montville <[email-masked]>
Date: Mon, 18 Apr 2016 15:26:08 -0500

Take,

Thank you for your review.  I have a pull request submitted, which has not yet been reviewed by the authors, in our GitHub repository.  I attached a text version of the draft embodied by that pull request, which is significantly different (in form) from the existing draft: https://github.com/sacmwg/vulnerability-scenario/pull/3 <https://github.com/sacmwg/vulnerability-scenario/pull/3>

If you care to review that version and provide your opinions, that would be appreciated as well.

Kind regards,

Adam

> On Apr 18, 2016, at 12:36 AM, Takeshi Takahashi <[email-masked]> wrote:
> 
> Hello,
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm