Subject: [sacm] Use Cases

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 3 May 2012 12:42:52 -0400

Before we move on, I'd like to make one last call for feedback on the use cases before moving forward.  Even statements that you are happy with what is there would be welcome.  I'd like to allow a few more days for feedback.  I have attached the last revision I posted a couple weeks back for convenience.  Please send your feedback by CoB 5/7/2012.  The next step will be to find volunteers to work on fleshing out the use cases.

Anyone interested?

Sincerely,
Dave

---

From: Adam Montville <[email-masked]>
Date: Thu, 3 May 2012 18:58:19 +0000

Once we get some more feedback, I'm interested in helping out with this effort.

Adam

From: <Waltermire>, "David A." <[email-masked]<mailto:[email-masked]>>
Date: Thursday, May 3, 2012 9:42 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [sacm] Use Cases

Before we move on, I’d like to make one last call for feedback on the use cases before moving forward.  Even statements that you are happy with what is there would be welcome.  I’d like to allow a few more days for feedback.  I have attached the last revision I posted a couple weeks back for convenience.  Please send your feedback by CoB 5/7/2012.  The next step will be to find volunteers to work on fleshing out the use cases.

Anyone interested?

Sincerely,
Dave

---

From: "Schmidt, Charles M." <[email-masked]>
Date: Thu, 3 May 2012 20:12:00 +0000

Hello,

A small nit in UC1 and UC2:

3.1.  UC1: Assessment and Enforcement of Acceptable State

   Controlling access to networks and services based on the assessment
   and analysis of host and/or network state based on machine
   processable content.

3.2.  UC2: Behavioral Monitoring and Enforcement

   Controlling access to networks and services based on the detection
   and analysis of host and/or user behavior using automatable
   information from various sources.

Both of these imply to me that SACM standards are used to control networks
and services. This seems outside the scope of the current set of standards,
although there may be interest in creating device control standards. If not,
maybe the use cases could be reworded as follows:

3.1.  UC1: Assessment and Enforcement of Acceptable State

   Assessment and analysis of host and/or network state based on machine
processable content, which can be used in access control decisions for
networks and services.
	
3.2.  UC2: Behavioral Monitoring and Enforcement

   Detection and analysis of host and/or user behavior using automatable
information from various sources, which can be used in access control
decisions for networks and services.

The original version implies, to me, that SACM contains standards for
controlling access to resources. The latter version implies that SACM
standards collect data, which can then be used (possibly by mechanisms
outside the scope of SACM) to control access to resources.

Charles
	
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf Of
>Waltermire, David A.
>Sent: Thursday, May 03, 2012 11:43 AM
>To: [email-masked]
>Before we move on, I'd like to make one last call for feedback on the use
>cases before moving forward.  Even statements that you are happy with what
>is there would be welcome.  I'd like to allow a few more days for feedback.
I
>have attached the last revision I posted a couple weeks back for
convenience.
>Please send your feedback by CoB 5/7/2012.  The next step will be to find
>volunteers to work on fleshing out the use cases.
>
>
>
>Anyone interested?
>
>
>
>Sincerely,
>
>Dave
>
>

---

From: Luis Nunez <[email-masked]>
Date: Thu, 3 May 2012 16:26:55 -0400

Some thoughts and connections with SACM and other working groups.

3.1.  UC1: Assessment and Enforcement of Acceptable State -  can be related to Network Endpoint Assessment (nea) working group.

3.2.  UC2: Behavioral Monitoring and Enforcement - could potentially be related to the IP Flow Information Export (ipfix) working group. Basically leveraging Netflow to detect network behavior.  This information could be received from what the MILE WG is doing with incident response. 

-ln

On May 3, 2012, at 4:12 PM, Schmidt, Charles M. wrote:

> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: Sean Turner <[email-masked]>
Date: Thu, 03 May 2012 17:32:34 -0400

Any reason to not just submit this and then add/remove authors later?

spt

On 5/3/12 12:42 PM, Waltermire, David A. wrote:
> Before we move on, I’d like to make one last call for feedback on the
> use cases before moving forward. Even statements that you are happy with
> what is there would be welcome. I’d like to allow a few more days for
> feedback. I have attached the last revision I posted a couple weeks back
> for convenience. Please send your feedback by CoB 5/7/2012. The next
> step will be to find volunteers to work on fleshing out the use cases.
>
> Anyone interested?
>
> Sincerely,
>
> Dave
>
>
>

---

From: "Panos Kampanakis" <[email-masked]>
Date: Thu, 3 May 2012 18:28:26 -0400

Looking good.

Could MILE's work also apply to Section 3.4? 
A suggestion: Should 3.4 incorporate Incident/Security Event Exchange? Or is
it including it anyway already?

Panos

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Luis
Nunez
Sent: Thursday, May 03, 2012 4:27 PM
To: Schmidt, Charles M.
Cc: Waltermire, David A.; [email-masked]
Subject: Re: [sacm] Use Cases

3.1.  UC1: Assessment and Enforcement of Acceptable State -  can be related
to Network Endpoint Assessment (nea) working group.

3.2.  UC2: Behavioral Monitoring and Enforcement - could potentially be
related to the IP Flow Information Export (ipfix) working group. Basically
leveraging Netflow to detect network behavior.  This information could be
received from what the MILE WG is doing with incident response. 

-ln

On May 3, 2012, at 4:12 PM, Schmidt, Charles M. wrote:

> Both of these imply to me that SACM standards are used to control 
> networks and services. This seems outside the scope of the current set 
> of standards, although there may be interest in creating device 
> control standards. If not, maybe the use cases could be reworded as
follows:
>   Assessment and analysis of host and/or network state based on 
> machine processable content, which can be used in access control 
>   Detection and analysis of host and/or user behavior using 
> automatable information from various sources, which can be used in 
> access control decisions for networks and services.
> 
>> From: [email-masked] [mailto:[email-masked]] On Behalf 
>> Of Waltermire, David A.
>> Before we move on, I'd like to make one last call for feedback on the 
>> use cases before moving forward.  Even statements that you are happy 
>> with what is there would be welcome.  I'd like to allow a few more days
for feedback.
>> Please send your feedback by CoB 5/7/2012.  The next step will be to 
>> find volunteers to work on fleshing out the use cases.
>> 
>> 
>> 
>> Anyone interested?
>> 
>> 
>> 
>> Sincerely,
>> 
>> Dave
>> 
>> 
>

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 4 May 2012 10:09:25 -0400

Thanks Adam.
Dave

-----Original Message-----
From: Adam Montville [mailto:[email-masked]] 
Sent: Thursday, May 03, 2012 2:58 PM
To: Waltermire, David A.; [email-masked]
Subject: Re: [sacm] Use Cases

Adam

Anyone interested?

Sincerely,
Dave

---

From: <[email-masked]>
Date: Fri, 4 May 2012 11:06:48 -0400

I agree with all of the associations listed from other reviewers.  Thank you for shaping up the use case document, Dave!

Should 3.4 also include the methods to combine data sets to generate reports that would be shared between parties so that we have this use case reference the MILE work for GRC-Exchange, but establish the use cases for the exchange and additional work that may be needed to tie these pieces together?

Also, in addition to calling out the specific IETF work, I think it would be helpful to reference any Security Automation work so that we start to understand the possible relationships.  This will help us to identify what is needed for SACM to be successful.  We may also be able to determine which of the specifications we need can be normatively referenced and possibly pulled into the IETF and where we may run into trouble.  This should help us determine any protocol or guidance documentation we will need to generate to support the described use cases.  Maybe this is already intended for section 5?

I am also happy to assist in further development of the use cases.

Thank you very much for your work on this Dave!

Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Panos Kampanakis
Sent: Thursday, May 03, 2012 6:28 PM
To: Waltermire, David A.
Cc: [email-masked]
Subject: Re: [sacm] Use Cases

Looking good.

Panos

-----Original Message-----

-ln

for feedback.

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 4 May 2012 12:33:18 -0400

The associations look good.  I will note them in the document.  Thanks for also pointing out the GRC-Exchange work.  To reiterate your point, I see that internet draft providing the generalized data flow and envelope that can be used to exchange many different types of information related to the use case in section 3.4.

We do need to capture the relationships; that is the plan for section 5.  I will note relationships as we discuss them in that section to be fleshed out later.

Sincerely,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, May 04, 2012 11:07 AM
To: [email-masked]; Waltermire, David A.
Cc: [email-masked]
Subject: RE: [sacm] Use Cases

Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Panos Kampanakis
Sent: Thursday, May 03, 2012 6:28 PM
To: Waltermire, David A.
Cc: [email-masked]
Subject: Re: [sacm] Use Cases

Looking good.

Could MILE's work also apply to Section 3.4? 
A suggestion: Should 3.4 incorporate Incident/Security Event Exchange? Or is it including it anyway already?

Panos

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Luis Nunez
Sent: Thursday, May 03, 2012 4:27 PM
To: Schmidt, Charles M.
Cc: Waltermire, David A.; [email-masked]
Subject: Re: [sacm] Use Cases

-ln

for feedback.

---

From: Anton Chuvakin <[email-masked]>
Date: Fri, 4 May 2012 09:45:45 -0700

> is there would be welcome.  I’d like to allow a few more days for feedback.

I think these is a mix of monitoring (activity, behavior, events) and
assessment (controls, settings, configurations) use cases, is this
intentional?

-- 
Dr. Anton Chuvakin
Site: http://www.chuvakin.org
Twitter: @anton_chuvakin
Work: http://www.linkedin.com/in/chuvakin

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 4 May 2012 13:07:58 -0400

Yes.  To some extent there is a compositional relationship between the use cases.  UC 1 & 2 provide data collection (assessment) that can be used for UC 3 and UC 5 which focus on monitoring.  UC 4 provides reporting capabilities based on UC 3 and 5.

Sincerely,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Anton Chuvakin
Sent: Friday, May 04, 2012 12:46 PM
To: Waltermire, David A.
Cc: [email-masked]
Subject: Re: [sacm] Use Cases

> cases before moving forward.  Even statements that you are happy with 
> what is there would be welcome.  I'd like to allow a few more days for feedback.

I think these is a mix of monitoring (activity, behavior, events) and assessment (controls, settings, configurations) use cases, is this intentional?

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 4 May 2012 13:17:09 -0400

Sean,

I would like to submit the document at regular milestones, essentially once we are able to complete each section.  Will this work for you?

Sincerely,
Dave

-----Original Message-----
From: Sean Turner [mailto:[email-masked]] 
Sent: Thursday, May 03, 2012 5:33 PM
To: Waltermire, David A.
Cc: [email-masked]
Subject: Re: [sacm] Use Cases

spt

On 5/3/12 12:42 PM, Waltermire, David A. wrote:
> for feedback. I have attached the last revision I posted a couple 
> weeks back for convenience. Please send your feedback by CoB 5/7/2012. 
> The next step will be to find volunteers to work on fleshing out the use cases.
>
> Anyone interested?
>
> Sincerely,
>
> Dave
>
>
>

---

From: Sean Turner <[email-masked]>
Date: Fri, 04 May 2012 13:26:47 -0400

Dave,

That sounds like a plan, but by submit I mean get it in to the 
datatracker so we can use the tools to see what's changed and 
publication announcements will be sent to the appropriate places.  Use 
this page to submit drafts:

https://datatracker.ietf.org/submit/

Thanks,

spt

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 4 May 2012 13:44:37 -0400

That is also what I intended to do. ;-)

Sincerely,
Dave

-----Original Message-----
From: Sean Turner [mailto:[email-masked]] 
Sent: Friday, May 04, 2012 1:27 PM
To: Waltermire, David A.
Cc: [email-masked]
Subject: Re: [sacm] Use Cases

Dave,

That sounds like a plan, but by submit I mean get it in to the datatracker so we can use the tools to see what's changed and publication announcements will be sent to the appropriate places.  Use this page to submit drafts:

Thanks,

spt

On 5/4/12 1:17 PM, Waltermire, David A. wrote:
>> with what is there would be welcome. I'd like to allow a few more 
>> days for feedback. I have attached the last revision I posted a 
>> couple weeks back for convenience. Please send your feedback by CoB 5/7/2012.

---

From: Anton Chuvakin <[email-masked]>
Date: Fri, 4 May 2012 10:47:40 -0700

> Yes.  To some extent there is a compositional relationship between the use cases.  UC 1 & 2 provide data collection (assessment) that can be used for UC 3 and UC 5 which focus on monitoring.  UC 4…

That makes sense - in general, I'd feel  more comfortable is
state/control/configuration/assessment/non-timed data is more
logically separated from activity/event/behavior/logs/timed data.

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 11 May 2012 12:24:13 -0400

I am currently working to update the use cases document based on the feedback.  You had mentioned below that you would like to see timed and non-timed data logically separated.  Are you talking about real-time vs. periodic data?  If so, would it be adequate to identify where data with different temporal characteristics is used in each use case?

Sincerely,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Anton Chuvakin
Sent: Friday, May 04, 2012 1:48 PM
To: Waltermire, David A.
Cc: [email-masked]
Subject: Re: [sacm] Use Cases

> Yes.  To some extent there is a compositional relationship between the use cases.  UC 1 & 2 provide data collection (assessment) that can be used for UC 3 and UC 5 which focus on monitoring.  UC 4…

That makes sense - in general, I'd feel  more comfortable is state/control/configuration/assessment/non-timed data is more logically separated from activity/event/behavior/logs/timed data.