Subject: [sacm] Hackathon Questions

From: Bill Munyan <[email-masked]>
Date: Tue, 27 Jun 2017 17:21:01 -0400

Hello fellow hackathon-ers,

I am starting to dig a little deeper into those interfaces I am looking to
implement for the hackathon, specifically developing a ROLIE client (to
grab new vulnerability description data) and a StrongTNC client (to grab
information from the endpoint repository).

Investigating the diagram is bringing up a few questions, mostly around the
formats of the data that will be returned to me.

- What formats can I expect to be able to query from a ROLIE feed?  In
other words, ROLIE will link me to a resource.  Will that resource be XML
or JSON?  Will the VDD take the form of OVAL definitions?  If not OVAL,
what format should I expect that will both provide information about WHAT
needs to be collected from the endpoint repository, and what the expected
state of that information should be.

- Same question, really, for querying the StrongTNC server/database.  What
sort of information format should I expect.  Using the REST interface would
be predictable in some JSON format, it seems.

- Finally, will some information be made available either from ROLIE or
StrongTNC indicating to a collector/assessor that it needs further
information from the endpoint itself?  For example, if a SWID tag isn't
retrievable from StrongTNC, is there some indicator that the collector
should try to obtain that information itself?

If I know what information I get from ROLIE, I can try to figure out how to
transform that information into a StrongTNC query, and use returned
information to compare against an expected state.

Thanks in advance for any feedback!
Cheers,
-Bill M.

---

From: Jerome Athias <[email-masked]>
Date: Wed, 28 Jun 2017 07:51:49 -0400

Hi,
#Scenario1 (the simple one)
If you take the example provided by Andreas [1]
https://github.com/sacmwg/vulnerability-scenario/blob/master/ietf_99_hackathon/strongTNC_REST_API.txt
Assuming that the Endpoints/Devices/Assets Repository is uptodate (reflecting current state), you have in the SQL database a Endpoint-SWIDID(s) mapping.
Now if you have a new vulnerability (CVE) published, i.e: CVE-2017-3732
VDI (XML or JSON)=
NVD Description
Ref. https://nvd.nist.gov/vuln/detail/CVE-2017-3732
VDD? (XML or JSON)=
List of CPEs affected
=> Expected state= openssl 1.0.2 > 1.0.2k
If you query [1] the Endpoint Repository (directly the database, or using the API), you can identify the Endpoints/Devices affected.
i.e.: device "1" is affected, because
Ubuntu_16.04-x86_64-openssl-1.0.2g-1ubuntu4.8 <[cpe:2.3:a:openssl:openssl:1.0.2](https://nvd.nist.gov/products/cpe/search/results?keyword=cpe%3a2.3%3aa%3aopenssl%3aopenssl%3a1.0.2i%3a*%3a*%3a*%3a*%3a*%3a*%3a*&status=FINAL,DEPRECATED&orderBy=CPEURI&namingFormat=2.3)k

> -------- Original Message --------
> Subject: [sacm] Hackathon Questions
> Local Time: June 28, 2017 12:21 AM
> UTC Time: June 27, 2017 9:21 PM
> From: [email-masked]
> To: [email-masked]
>
> I am starting to dig a little deeper into those interfaces I am looking to implement for the hackathon, specifically developing a ROLIE client (to grab new vulnerability description data) and a StrongTNC client (to grab information from the endpoint repository).
> Investigating the diagram is bringing up a few questions, mostly around the formats of the data that will be returned to me.
> - What formats can I expect to be able to query from a ROLIE feed? In other words, ROLIE will link me to a resource. Will that resource be XML or JSON? Will the VDD take the form of OVAL definitions? If not OVAL, what format should I expect that will both provide information about WHAT needs to be collected from the endpoint repository, and what the expected state of that information should be.
> - Same question, really, for querying the StrongTNC server/database. What sort of information format should I expect. Using the REST interface would be predictable in some JSON format, it seems.
> - Finally, will some information be made available either from ROLIE or StrongTNC indicating to a collector/assessor that it needs further information from the endpoint itself? For example, if a SWID tag isn't retrievable from StrongTNC, is there some indicator that the collector should try to obtain that information itself?
> If I know what information I get from ROLIE, I can try to figure out how to transform that information into a StrongTNC query, and use returned information to compare against an expected state.