Subject: [sacm] Call for MTI Information Elements

From: "Cokus, Michael S." <[email-masked]>
Date: Fri, 1 Apr 2016 15:43:26 +0000

Hello All,

One of the Information Model "Next Steps" presented at the last virtual meeting was to begin discussion concerning the Mandatory-to-Implement (MTI) Information Elements.  The purpose of this message is to follow up on this.

What IEs should be mandatory?  

Are there general principles that should be applied to deciding what should be MTI IEs?
 
Another related question which may be helpful to consider is "From where should we draw MTI information element candidates?"  Potential sources are listed below (are there others we should consider?) 

- Architecture [1]
- Requirements [2]
- Vulnerability Assessment Scenario [3]
- Existing models which define relevant IEs to consider (e.g., SCAP, CIM, SWID, APP-ID)

Looking forward to your feedback on the MTI IEs, relevant principles to apply, and/or potential sources MTI IEs should be drawn from.  If you also have additional thoughts on how to approach this topic, please let the group know.

Thanks much,

--mike

[1] https://datatracker.ietf.org/doc/draft-ietf-sacm-architecture/
[2] https://datatracker.ietf.org/doc/draft-ietf-sacm-requirements/
[3] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/

Mike Cokus
Systems Engineer
The MITRE Corporation

---

From: Adam Montville <[email-masked]>
Date: Sun, 3 Apr 2016 18:38:26 -0300

I think this is a very good discussion to have, but I encourage the working group to defer this discussion until the information model is fleshed out more completely.

Kind regards,

Adam

> On Apr 1, 2016, at 12:43 PM, Cokus, Michael S. <[email-masked]> wrote:
> 
> Hello All,
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: Adam Montville <[email-masked]>
Date: Sun, 3 Apr 2016 23:02:03 -0300

As a point of clarification, I am not suggestion that we not talk about the information elements we want to see in the information model—in fact, just the opposite.  I would like us to discuss what we’d like to see in the information model, but I don’t think an MTI discussion about them would yet be helpful.

Kind regards,

Adam

> On Apr 3, 2016, at 6:38 PM, Adam Montville <[email-masked]> wrote:
>