Subject: [sacm] Potential Charter Addition?

From: Adam Montville <[email-masked]>
Date: Mon, 22 Oct 2012 22:34:50 +0000

All:

There has been some discussion lately about the Common Configuration Enumeration (CCE) specification on the CCE list.  In particular, this discussion has centered around some operational concerns with respect to scaling CCE as presently specified.  A proposal has been made to reduce the dataset embodied by a CCE entry, with subsequent ideas coming out of a potential schema change.

I believe we would all agree that what CCE provides – the ability to accurately reference a configuration item – is important to security automation.

What do others think about exploring the possibility of bringing this capability into the proposed SCAM WG as part of our charter?  Yes, our charter is already large, but if the CCE community is actively seeking to improve their schema, it seems a good time to consider inviting that community to join ours in our common automation goals – especially for something that is as foundational as CCE.

Thoughts?

Adam