Subject: [sacm] Vulnerability Scenario and Endpoint Identification

From: Adam Montville <[email-masked]>
Date: Thu, 7 Apr 2016 11:32:42 -0300

Hi. I’m spending some time with the vulnerability scenario draft (-01 of the I-D, which needs to be renamed) and I have specific questions about the scenario and endpoint identity.

One of the assumptions made by this draft is that “the enterprise has a means of identifying enterprise endpoints.”  Later, the first step in the scenario [1] “identification of endpoints must occur.”

At this point, the enterprise is assumed to have a means of identifying endpoints, and a pre-requisite to a successful vulnerability assessment will exercise those means.  This much seems sane.

Then, what follows in section 3.1 are a bunch of requirements levied against the “existing means” of endpoint identification, which feels odd to me, given that endpoint identification has already been assumed.  In fact, it really begins to feel like endpoint identification has been assumed true, but later deemed insufficient.

Can someone set me straight on this?

Thanks.

Adam

[1] This is actually less of a step to me and more of a pre-requisite to a successful vulnerability assessment flow.