Subject: [sacm] Identifying Vulnerability Assessment Code

From: Adam Montville <[email-masked]>
Date: Tue, 16 May 2017 13:07:05 +0000

All:

Last week a list of goals were sent to this list [1]. I did see some
back-channel conversation, but nothing that made its way to the list. Then,
those are our stated goals, and it is now time to start considering what
code may already exist for our agreed upon components. Once again, these
components are listed at [2] and repeated here:

* Vulnerability Detection Data Repository
* Vulnerability Assessor
* Endpoint Repository
* Collector
* Target Endpoint
* Assessment Results Repository

We need to drive this to some conclusion relatively quickly. If you have or
know of components filling these roles, please respond by the end of this
week. Note that the target endpoint component will likely be determined
based on which real-world vulnerability(ies) we choose to deal with as part
of this exercise.

Kind regards,

Adam

[1] https://mailarchive.ietf.org/arch/msg/sacm/LskQ7tj9Wvy1-0DSlEN_VakYj64
[2] https://mailarchive.ietf.org/arch/msg/sacm/w_kL2vzDBPk0NN9N1WQcpb3Qwfw

---

From: "Banghart, Stephen A. (Fed)" <[email-masked]>
Date: Tue, 16 May 2017 16:50:52 +0000

Adam,

I’m planning on bringing a ROLIE implementation with me to the Hackathon that could fill the Vulnerability Detection Data Repository component. The ROLIE implementation could also provide arbitrary data to any component along the pipeline in order to simulation data input/output. I intend to pre-load the ROLIE server implementation with sample NVD data and sample SWID tags so that we have something for the other components to work with if need be.

Regards,
Stephen Banghart

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Tuesday, May 16, 2017 9:07 AM
To: [email-masked]
Subject: [sacm] Identifying Vulnerability Assessment Code

All:

Last week a list of goals were sent to this list [1]. I did see some back-channel conversation, but nothing that made its way to the list. Then, those are our stated goals, and it is now time to start considering what code may already exist for our agreed upon components. Once again, these components are listed at [2] and repeated here:

We need to drive this to some conclusion relatively quickly. If you have or know of components filling these roles, please respond by the end of this week. Note that the target endpoint component will likely be determined based on which real-world vulnerability(ies) we choose to deal with as part of this exercise.

Kind regards,

Adam

---

From: Adam Montville <[email-masked]>
Date: Tue, 16 May 2017 17:17:13 +0000

Great, thanks!

On Tue, May 16, 2017 at 11:50 AM Banghart, Stephen A. (Fed) <
[email-masked]> wrote:

> Adam,
>
>
>
> I’m planning on bringing a ROLIE implementation with me to the Hackathon
> that could fill the Vulnerability Detection Data Repository component. The
> ROLIE implementation could also provide arbitrary data to any component
> along the pipeline in order to simulation data input/output. I intend to
> pre-load the ROLIE server implementation with sample NVD data and sample
> SWID tags so that we have something for the other components to work with
> if need be.
>
>
>
> Regards,
>
> Stephen Banghart
>
>
>
> *From:* sacm [mailto:[email-masked]] *On Behalf Of *Adam Montville
> *Sent:* Tuesday, May 16, 2017 9:07 AM
> *To:* [email-masked]
> *Subject:* [sacm] Identifying Vulnerability Assessment Code
>
>
>
> All:
>
>
>
> We need to drive this to some conclusion relatively quickly. If you have
> or know of components filling these roles, please respond by the end of
> this week. Note that the target endpoint component will likely be
> determined based on which real-world vulnerability(ies) we choose to deal
> with as part of this exercise.
>
>
>
> Kind regards,
>
>
>
> Adam
>
>
>
>
>

---

From: Bill Munyan <[email-masked]>
Date: Wed, 17 May 2017 13:59:18 -0400

Adam,
I'm planning on contributing components for collection (of endpoint
characteristics), vulnerability assessment (evaluation of endpoint
characteristics vs. expected state), and an assessment results repository
to the hackathon.

Once further components are identified, I would be happy to help develop
the "interaction goop" (aka: glue) that will allow for the components to
interface.

Cheers,
-Bill M.

On Tue, May 16, 2017 at 1:17 PM, Adam Montville <[email-masked]>
wrote:

> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>
>

---

From: Adam Montville <[email-masked]>
Date: Wed, 17 May 2017 19:23:15 +0000

Great, thanks!

On Wed, May 17, 2017 at 12:59 PM Bill Munyan <[email-masked]>
wrote:

> On Tue, May 16, 2017 at 1:17 PM, Adam Montville <
> [email-masked]> wrote:
>
>> Great, thanks!
>>
>>> [1]
>>> https://mailarchive.ietf.org/arch/msg/sacm/LskQ7tj9Wvy1-0DSlEN_VakYj64
>>>
>>> [2]
>>> https://mailarchive.ietf.org/arch/msg/sacm/w_kL2vzDBPk0NN9N1WQcpb3Qwfw
>>>
>>

---

From: Adam Montville <[email-masked]>
Date: Fri, 19 May 2017 13:52:44 +0000

I'm resending this call to the list. We have some contributions already
indicated, but we could use more. Specifically, we don't have an endpoint
repository at this point. Does anyone have any ideas of what we might use
for that?

I know there are some free/open source tools out there targeting
endpoint/asset management. Here's a list of a few of them:

   - Assetview: https://www.qualys.com/free-tools-trials/
   - NEWT Professional Network Inventory:
   http://www.komodolabs.com/network-inventory/
   - OCS Inventory-NG: http://www.ocsinventory-ng.org/en/
   - Open-AudIT: http://www.open-audit.org/
   - Snipe-IT: https://snipeitapp.com/

CIS will provide an operational environment with endpoints in AWS.

Kind regards,

Adam

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Fri, 19 May 2017 14:01:13 +0000

I mentioned this in another thread.

I can bring some software that has a SWID tag and a CoSWID tag bundled that can be installed on a device. I can even provide multiple versions of the same software to simulate a release -> vulnerability -> update/patch cycle.

Regards,
Dave

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Friday, May 19, 2017 9:53 AM
To: [email-masked]
Subject: Re: [sacm] Identifying Vulnerability Assessment Code

I'm resending this call to the list. We have some contributions already indicated, but we could use more. Specifically, we don't have an endpoint repository at this point. Does anyone have any ideas of what we might use for that?

I know there are some free/open source tools out there targeting endpoint/asset management. Here's a list of a few of them:

  *   Assetview: https://www.qualys.com/free-tools-trials/
  *   NEWT Professional Network Inventory: http://www.komodolabs.com/network-inventory/
  *   OCS Inventory-NG: http://www.ocsinventory-ng.org/en/
  *   Open-AudIT: http://www.open-audit.org/
  *   Snipe-IT: https://snipeitapp.com/

Kind regards,

Adam
On Tue, May 16, 2017 at 8:07 AM Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:
All:

Kind regards,

Adam

---

From: Adam Montville <[email-masked]>
Date: Fri, 19 May 2017 14:04:33 +0000

Great, thanks for attaching it to this thread also; sorry I didn't do that
up front.

Adam

On Fri, May 19, 2017 at 9:01 AM Waltermire, David A. (Fed) <
[email-masked]> wrote:

> I can bring some software that has a SWID tag and a CoSWID tag bundled
> that can be installed on a device. I can even provide multiple versions of
> the same software to simulate a release -> vulnerability -> update/patch
> cycle.
>
>
>
> Regards,
>
> Dave
>
>
>
> *Sent:* Friday, May 19, 2017 9:53 AM
> *To:* [email-masked]
> *Subject:* Re: [sacm] Identifying Vulnerability Assessment Code
>
>
>