Subject: [sacm] Warren Kumari's Yes on draft-ietf-sacm-requirements-16: (with COMMENT)

From: Warren Kumari <[email-masked]>
Date: Wed, 21 Jun 2017 09:32:50 -0700

Warren Kumari has entered the following ballot position for
draft-ietf-sacm-requirements-16: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sacm-requirements/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I spent a while trying to figure out how to ballot on this - I personally see
value in requirements, use-cases and similar (informational) documents - they
help newcomers to the technology understand how and why it is shaped as it is.
This document is also (kind of) mentioned in the charter ("A document or
documents describing the SACM Architecture. This will include protocol
requirements and their associated use cases as well as a description ..." , and
so I've decided on Yes

However, there are still some comments / nits which should be addressed,
including:

Abstract:
"The requirements and scope are based on the agreed upon use cases." -- what
use cases / agreed upon by whom? (Missing ref).

1. Introduction
"Today’s environment of rapidly-evolving security threats highlights the need
to automate the sharing of security information (such as posture information)
while protecting user information as well as the systems that store, process,
and transmit this information." - "... user information as well as the systems"
-> "user information and the systems" ? Not sure if this is better....

2.  Requirements
I got somewhat lost in "A SACM transport protocol is one that runs on top of L3
protocols such as TCP/IP or L4 protocols such as HTTP, carries operations
(requests / responses), and moves data." - perhaps "A SACM transport protocol
is one that runs on top of L3 protocols (such as TCP/IP) or L4 protocols (such
as HTTP), carries operations (requests / responses), and moves data."

3: "With the information model defining assets and attributes to facilitate the
guidance, collection, and assessment of posture, these are some of the tasks
that should be considered:" - the "With" and "these" feel unrelated. I'm not
really sure how they are supposed to tie together, so I cannot suggest text.

G-001
"2.  The query language MUST allow for general inquiries, as well as expression
of specific attributes or relationships between attributes to follow; the
retrieval of specific information ..." -- I don't really understand the "to
follow"; can it be struck?

G-002
"Interoperability: The data models, protocols, and transports  must be
specified with enough details to ensure interoperability." -- I really don't
understand the point of saying this - are you expecting that if you *didn't*
say this that people would intentionally create models without enough detail?
Is this just a "motherhood and apple pie" statement?

 G-006
"Mechanisms for this protection are unspecified but should include industry
best practices such as encrypted storage, encrypted transports, data checksums,
etc. " -- the list of best practices seems harmful;  if you provide a list
people will implicitly assume it is exhaustive, and industry best practices
change over time. Also, what is a "data checksum"? I'm assuming you mean
something "cryptographic checksums" or "secure hash" - a data checksum implies
something like a simple CRC. I'd suggest just dropping the "such as..." list.

IM-004
"Data Model Identification: The information model MUST provide a means to
uniquely identify each data model uniquely." - you really really want this to
be unique, don't you :-P

5.2.  Privacy Considerations
"In addition to identity and SACM capabilities information disclosure, the use
of time stamps or other attributes that can be used as identifiers especially
as they are coupled with an identity can be further used to determine a target
endpoint or user’s behavioral patterns." -- this sentence could use some work.
I agree with what it is trying to say, but it is long and confusing. Perhaps:
"In addition to identity and SACM capabilities information disclosure, the use
of time stamps (or other attributes that can be used as identifiers) could be
further used to determine a target endpoint or user’s behavioral patterns." --
I *think* that that maintains the meaning, but is clearer.

"Data confidentiality can provide some level of privacy but may fall short
where unecessary data is still transmitted." - "unnecessary" (typo)

---

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Sun, 25 Jun 2017 23:45:36 +0000

Thanks for the review and comments.  Please see further comments below:

On 6/21/17, 9:32 AM, "Warren Kumari" <[email-masked]> wrote:

    

    
    Abstract:
    "The requirements and scope are based on the agreed upon use cases." -- what
    use cases / agreed upon by whom? (Missing ref).
[NCW] The use cases are now in RFC 7632 and its reference has been added.
    
    1. Introduction
[NCW] Yes, it helps and I’ve made the change in the next revision.
    
    2.  Requirements
[NCW] I’ve change L3 and L4 to be “transport layer” and “Internet layer” as suggested by Carsten.
    
    3: "With the information model defining assets and attributes to facilitate the
    guidance, collection, and assessment of posture, these are some of the tasks
    that should be considered:" - the "With" and "these" feel unrelated. I'm not
    really sure how they are supposed to tie together, so I cannot suggest text.
[NCW] I’ve changed “these are some of the tasks that should be considered” to read
“tasks that should be considered include”.  Hopefully it ties them as tasks to facilitate the 
workflow for “collection”, “guidance” etc…

    G-001
[NCW] Yes, thanks for catching it….
    
    G-002
    "Interoperability: The data models, protocols, and transports  must be
    specified with enough details to ensure interoperability." -- I really don't
    understand the point of saying this - are you expecting that if you *didn't*
    say this that people would intentionally create models without enough detail?
    Is this just a "motherhood and apple pie" statement?
[NCW] Yes!  There were a couple of proposals that didn’t provide enough specificity
so the WG asked for this requirement to be included.
    
     G-006
[NCW] Done.
    
    IM-004
    "Data Model Identification: The information model MUST provide a means to
    uniquely identify each data model uniquely." - you really really want this to
    be unique, don't you :-P
[NCW] LoL….2nd uniquely is removed
    
[NCW] Yes, thanks for the improvement.
    
[NCW] Fixed.

---

From: Warren Kumari <[email-masked]>
Date: Mon, 26 Jun 2017 06:02:06 +0000

Excellent, thank you.

W

On Mon, Jun 26, 2017 at 1:45 AM Nancy Cam-Winget (ncamwing) <
[email-masked]> wrote:

>     Please refer to
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> --
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf