Subject: [sacm] IETF 98: SACM Vulnerability Assessment Scenario Follow-Up Work

From: "Haynes, Dan" <[email-masked]>
Date: Thu, 23 Mar 2017 19:12:56 +0000

Hi Everyone,

During the Vulnerability Assessment Scenario session at IETF 98, we would like to work towards the following.

*        Reaching consensus on the components necessary for a single flow through the Vulnerability Assessment Scenario

*        Reaching consensus on the interactions between components

*        Reaching consensus on a diagram that shows the components and their interactions with each other

*        Reaching consensus on the different tasks and identify where they occur in the diagram

*        Enumerating the IEs necessary for the interactions between components

Since IETF 97, we have had a virtual interim meeting [1][2] and two follow-up calls [3][4] as well as some discussion on the mailing lists [5][6]. Also, the SACM Vulnerability Assessment Scenario has been moved to the SACM wiki [7][8].

Please let me know if you have any questions or if there is anything else you would like to add to the discussion since we have 90+ minutes according to the agenda :).

Thanks,

Danny

[1] https://www.ietf.org/proceedings/interim-2017-sacm-01/slides/slides-interim-2017-sacm-01-sessa-vulnerability-assessment-scenario-00.pdf
[2] https://www.ietf.org/proceedings/interim-2017-sacm-01/minutes/minutes-interim-2017-sacm-01-201701111000-00
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg04631.html
[4] https://www.ietf.org/mail-archive/web/sacm/current/msg04637.html
[5] https://www.ietf.org/mail-archive/web/sacm/current/msg04630.html
[6] https://www.ietf.org/mail-archive/web/sacm/current/msg04650.html
[7] https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario
[8] https://www.ietf.org/mail-archive/web/sacm/current/msg04697.html

---

From: Adam Montville <[email-masked]>
Date: Fri, 24 Mar 2017 11:50:01 +0000

Thanks for sending this out, Danny.  Those five bullet points seem big
enough to consume an hour and a half.  At one point we were going to look
at a couple of specific existing CVEs, but I don't think we ever got as far
as picking them out...  If doing something like that seems like a
reasonable idea, we could pick some representative CVEs to walk through the
diagram.  In that way, we'd have something more concrete to talk about,
especially when it comes to enumerating necessary information elements.

Thoughts?

Adam

On Thu, Mar 23, 2017 at 2:13 PM Haynes, Dan <[email-masked]> wrote:

> ·        Reaching consensus on the components necessary for a single flow
> through the Vulnerability Assessment Scenario
>
> ·        Reaching consensus on the interactions between components
>
> ·        Reaching consensus on a diagram that shows the components and
> their interactions with each other
>
> ·        Reaching consensus on the different tasks and identify where
> they occur in the diagram
>
> ·        Enumerating the IEs necessary for the interactions between
> components
>
>
>
> Since IETF 97, we have had a virtual interim meeting [1][2] and two
> follow-up calls [3][4] as well as some discussion on the mailing lists
> [5][6]. Also, the SACM Vulnerability Assessment Scenario has been moved to
> the SACM wiki [7][8].
>
>
>
> Please let me know if you have any questions or if there is anything else
> you would like to add to the discussion since we have 90+ minutes according
> to the agenda :).
>
>
>
> Thanks,
>
>
> Danny
>
>
>
> [1]
> https://www.ietf.org/proceedings/interim-2017-sacm-01/slides/slides-interim-2017-sacm-01-sessa-vulnerability-assessment-scenario-00.pdf
>
> [2]
> https://www.ietf.org/proceedings/interim-2017-sacm-01/minutes/minutes-interim-2017-sacm-01-201701111000-00
>
> [7]
> https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>