Subject: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

From: Adam Montville <[email-masked]>
Date: Tue, 02 May 2017 21:42:23 +0000

Has anyone had time to take a look at the communication sequence here? I
know we've not yet completely settled on goals, but I feel like we should
still be able to have this discussion as well.

Thanks for your time.

Adam

On Fri, Apr 21, 2017 at 8:00 AM Adam Montville <[email-masked]>
wrote:

> Hello Everyone,
>
> After some discussion on this topic, I feel like we've got no real
> objection to this proposed list of components. As such, this brings us back
> to the second version of the sequence diagram that some of us were working
> with not too long ago (see attached PDF vector diagram).
>
> Given that set of components, we can now start talking about the expected
> communications between them in an ideal case through the system. Remember
> that the VDI (vulnerability information) is assumed to have been
> transformed and placed into the VDD (vulnerability detection) Repository.
> I've numbered the flows in the attached sequence diagram to show the
> proposed order and so that we can talk about each flow by that number.
>
> Does this flow feel right to everyone on the list? What needs to be
> different? What alternate flows may exist for the basic case of checking
> inventory against a new vulnerability?
>
> Let's carry this discussion on for a week or so. (Do we need longer?)
>
> Kind regards,
>
> Adam
>
> On Tue, Apr 18, 2017 at 8:03 AM Adam Montville <[email-masked]>
> wrote:
>
>> Hi All:
>>
>> We've got a list of components we think we care about for our
>> vulnerability assessment scenario (focusing on the narrowest "ideal case"
>> through the scenario for the time being.
>>
>> These are:
>>
>> * Vulnerability Detection Data Repository
>> * Vulnerability Assessor
>> * Endpoint Repository
>> * Collector
>> * Target Endpoint
>> * Assessment Results Repository
>>
>> For reference, see our wiki [1] and/or the slides from IETF 98 [2] and/or
>> the minutes from IETF 98 [3]
>>
>> Question to the WG: Is this an appropriate initial list of components?
>>
>> Please opine within the next few days (say by end of your day on
>> Thursday, wherever you may be), so that we can generate some momentum on
>> this effort.
>>
>> Kind regards,
>>
>> Adam
>>
>> [1]
>> https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario
>> [2]
>> https://www.ietf.org/proceedings/98/slides/slides-98-sacm-vulnerability-scenario-discussion-00.pdf
>>
>> [3] https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00.txt
>>
>>
>>

---

From: Jerome Athias <[email-masked]>
Date: Wed, 03 May 2017 03:06:17 -0400

Hi,

For now what is unclear for me is when/where it is determined that a VDI/VDD is interesting for me (applies to my endpoints).

For example:
I am retrieving everyday the latest CVE content from NVD.
Option 1: (apparently the current one) each new CVE/VDI is transformed and inserted in the VDD repository, which will trigger the flow. So for each and every CVE, I would enter the flow, and it will get/evaluate if I have endpoints that need to be evaluated before the assessment. - not optimized because they are more vulnerabilities released -not- affecting my endpoints than applicable ones

Option 2: (the one I'm using) each new CVE/VDI is evaluated by my Endpoint Manager (assets inventory/portfolio/cmdb) and ONLY IF it is relevant, it will be transformed and inserted in the VDD repository, which will trigger the flow. - more optimized, I will just assess what is relevant

Note that #2 could be assumed to be done up front, but imho would be nice to mention it.

Would this make sense?

Best regards

-------- Original Message --------
Subject: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)
Local Time: May 3, 2017 12:42 AM
UTC Time: May 2, 2017 9:42 PM
From: [email-masked]
To: [email-masked] <[email-masked]>

Has anyone had time to take a look at the communication sequence here? I know we've not yet completely settled on goals, but I feel like we should still be able to have this discussion as well.

Thanks for your time.

Adam

On Fri, Apr 21, 2017 at 8:00 AM Adam Montville <[email-masked]> wrote:

Hello Everyone,

After some discussion on this topic, I feel like we've got no real objection to this proposed list of components. As such, this brings us back to the second version of the sequence diagram that some of us were working with not too long ago (see attached PDF vector diagram).

Given that set of components, we can now start talking about the expected communications between them in an ideal case through the system. Remember that the VDI (vulnerability information) is assumed to have been transformed and placed into the VDD (vulnerability detection) Repository. I've numbered the flows in the attached sequence diagram to show the proposed order and so that we can talk about each flow by that number.

Does this flow feel right to everyone on the list? What needs to be different? What alternate flows may exist for the basic case of checking inventory against a new vulnerability?

Kind regards,

Adam

On Tue, Apr 18, 2017 at 8:03 AM Adam Montville <[email-masked]> wrote:

Hi All:

We've got a list of components we think we care about for our vulnerability assessment scenario (focusing on the narrowest "ideal case" through the scenario for the time being.

These are:

For reference, see our wiki [1] and/or the slides from IETF 98 [2] and/or the minutes from IETF 98 [3]

Please opine within the next few days (say by end of your day on Thursday, wherever you may be), so that we can generate some momentum on this effort.

Kind regards,

Adam

[1] https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario
[2] https://www.ietf.org/proceedings/98/slides/slides-98-sacm-vulnerability-scenario-discussion-00.pdf
[3] https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00.txt

---

From: Adam Montville <[email-masked]>
Date: Wed, 03 May 2017 20:45:52 +0000

That seems like it could be a reasonable optimization, provide the VDI had
enough information and structure. I'm not sure they always do and I would
suspect that some organizations just take a look at what's been defined in,
say, the OVAL repository (a VDD source) and work optimizations from there.

Other thoughts?

On Wed, May 3, 2017 at 2:06 AM Jerome Athias <[email-masked]>
wrote:

> Hi,
>
> For now what is unclear for me is when/where it is determined that a
> VDI/VDD is interesting for me (applies to my endpoints).
>
> For example:
> Option 1: (apparently the current one) each new CVE/VDI is transformed and
> inserted in the VDD repository, which will trigger the flow. So for each
> and every CVE, I would enter the flow, and it will get/evaluate if I have
> endpoints that need to be evaluated before the assessment. - not optimized
> because they are more vulnerabilities released -not- affecting my endpoints
> than applicable ones
>
> Option 2: (the one I'm using) each new CVE/VDI is evaluated by my Endpoint
> Manager (assets inventory/portfolio/cmdb) and ONLY IF it is relevant, it
> will be transformed and inserted in the VDD repository, which will trigger
> the flow. - more optimized, I will just assess what is relevant
>

---

From: "Haynes, Dan" <[email-masked]>
Date: Wed, 17 May 2017 15:35:03 +0000

Maybe this should be noted in the wiki somewhere?

Thanks,

Danny

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Wednesday, May 03, 2017 4:46 PM
To: Jerome Athias <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

That seems like it could be a reasonable optimization, provide the VDI had enough information and structure. I'm not sure they always do and I would suspect that some organizations just take a look at what's been defined in, say, the OVAL repository (a VDD source) and work optimizations from there.

Other thoughts?

On Wed, May 3, 2017 at 2:06 AM Jerome Athias <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

For example:

Would this make sense?

Best regards

-------- Original Message --------
Subject: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)
Local Time: May 3, 2017 12:42 AM
UTC Time: May 2, 2017 9:42 PM
From: [email-masked]<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>

Thanks for your time.

Adam

On Fri, Apr 21, 2017 at 8:00 AM Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:
Hello Everyone,

Kind regards,

Adam

On Tue, Apr 18, 2017 at 8:03 AM Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:
Hi All:

These are:

Kind regards,

Adam

---

From: Adam Montville <[email-masked]>
Date: Wed, 17 May 2017 20:20:40 +0000

Yes, I think so. Any chance you can update?
On Wed, May 17, 2017 at 10:35 AM Haynes, Dan <[email-masked]> wrote:

> *From:* sacm [mailto:[email-masked]] *On Behalf Of *Adam Montville
> *Sent:* Wednesday, May 03, 2017 4:46 PM
> *To:* Jerome Athias <[email-masked]>
> *Cc:* [email-masked]
> *Subject:* Re: [sacm] Component Communication Sequence (Was - Re:
> Components for Vulnerability Assessment)
>
>
>
> Please opine within the next few days (say by end of your day on Thursday,
> wherever you may be), so that we can generate some momentum on this effort.
>
>
>
> Kind regards,
>
>
>
> Adam
>
>
>
> [1]

---

From: "Haynes, Dan" <[email-masked]>
Date: Fri, 19 May 2017 13:07:00 +0000

Yeah, I can update it next week.

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Wednesday, May 17, 2017 4:21 PM
To: Haynes, Dan <[email-masked]>; Jerome Athias <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

Yes, I think so. Any chance you can update?
On Wed, May 17, 2017 at 10:35 AM Haynes, Dan <[email-masked]<mailto:[email-masked]>> wrote:
Maybe this should be noted in the wiki somewhere?

Thanks,

Danny

From: sacm [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Adam Montville
Sent: Wednesday, May 03, 2017 4:46 PM
To: Jerome Athias <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

Other thoughts?

For example:

Would this make sense?

Best regards

-------- Original Message --------
Subject: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)
Local Time: May 3, 2017 12:42 AM
UTC Time: May 2, 2017 9:42 PM
From: [email-masked]<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>

Thanks for your time.

Adam

Kind regards,

Adam

These are:

Kind regards,

Adam

---

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 22 May 2017 17:24:40 +0000

I just updated the “Vulnerability Description Information” section in the Vulnerability Assessment Scenario wiki [1] to include the following statement.

“The enterprise is responsible for determining the sources of vulnerability description information as well as which vulnerability description information is converted into vulnerability detection data.”

Jerome, I think this should address your comment about giving the enterprise the flexibility to determine which of the vulnerability description information is converted into vulnerability detection data. Let me know if it is missing anything or if there is anything that could be improved.

Thanks,

Danny

From: sacm [mailto:[email-masked]] On Behalf Of Haynes, Dan
Sent: Friday, May 19, 2017 9:07 AM
To: Adam Montville <[email-masked]>; Jerome Athias <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

Thanks,

Danny

To: Haynes, Dan <[email-masked]<mailto:[email-masked]>>; Jerome Athias <[email-masked]<mailto:[email-masked]>>

Thanks,

Danny

Other thoughts?

For example:

Would this make sense?

Best regards

-------- Original Message --------
Subject: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)
Local Time: May 3, 2017 12:42 AM
UTC Time: May 2, 2017 9:42 PM
From: [email-masked]<mailto:[email-masked]>
To: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>

Thanks for your time.

Adam

Kind regards,

Adam

These are:

Kind regards,

Adam

---

From: Jerome Athias <[email-masked]>
Date: Mon, 22 May 2017 13:35:31 -0400

That looks like reasonable to me.

Thank you

-------- Original Message --------
Subject: Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)
Local Time: May 22, 2017 8:24 PM
UTC Time: May 22, 2017 5:24 PM
From: [email-masked]
To: "Haynes, Dan" <[email-masked]>, Adam Montville <[email-masked]>, Jerome Athias <[email-masked]>
[email-masked] <[email-masked]>

Thanks,

Danny

---

From: Adam Montville <[email-masked]>
Date: Mon, 22 May 2017 18:30:26 +0000

Great, thanks!

On Mon, May 22, 2017 at 12:35 PM Jerome Athias <[email-masked]>
wrote:

> To: "Haynes, Dan" <[email-masked]>, Adam Montville <
> [email-masked]>, Jerome Athias <[email-masked]>
> I just updated the “Vulnerability Description Information” section in the
> Vulnerability Assessment Scenario wiki [1] to include the following
> statement.
>
>
>
> “The enterprise is responsible for determining the sources of
> vulnerability description information as well as which vulnerability
> description information is converted into vulnerability detection data.”
>
>
>
> Jerome, I think this should address your comment about giving the
> enterprise the flexibility to determine which of the vulnerability
> description information is converted into vulnerability detection data. Let
> me know if it is missing anything or if there is anything that could be
> improved.
>
>
>
> Thanks,
>
> Danny
>
>
>
> [1]