Subject: Re: [sacm] SACM UC1 And Related Requirements - Next steps

From: "Moriarty, Kathleen" <[email-masked]>
Date: Sun, 13 Jan 2013 19:24:01 -0500

Thank you all for the great discussion on requirements and to Adam for keeping the discussion organized!

Adam, could you take the requirements as they are now and put them into the use case document?  Some IETF folks will want to see these in an actual document and the use case document will work.

The next steps that we agreed to previously was to work on an architecture document.  I think Dave Waltermire had some ideas here, but we wanted to make sure it was first based on requirements.  WOuld it be possible to start that discussion now and have a document before the deadline for the Orlando meeting?  The date for -00 drafts is 2/28/13.

Thank you!
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Gary Gapinski [[email-masked]]
Sent: Friday, December 14, 2012 4:48 PM
To: David Solin
Cc: [email-masked]
Subject: Re: [sacm] SACM UC1 And Related Requirements

On 12/14/2012 03:54 PM, David Solin wrote:
> Your position, then, Gary, is that there should be no such thing as an
> external reference?

No (assuming I understand the nature of "external" references. I presume
external references are those from from one document to another.). I
think there should be as many as desired. I had hoped to express this by
stating "Various consumers of such a policy might wish to say varying
things about it. One common thing is an identifier unique in some domain.".

I expect that creators of security automation content will declare
references amongst all the things they deem worthwhile. I hope they do.

However, if such references are declared within the content itself
(i.e., in a document describing a policy), as opposed to separate and
separately maintained statements of such association, it casts the
reference in a role that is then subject to considerations at least of
revision. Such considerations are manageable if revision enjoys adequate
treatment within SACM.

I must also caution that external references do not imply the ability to
discern anything other than relation.

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 14 Jan 2013 12:46:49 +0000

Hi,

Internet-Draft submission cut-off date is 2/18 and not 2/28! See http://www.ietf.org/meeting/cutoff-dates-2013.html#IETF86. 

For the meeting in Orlando to be efficient we need I believe two things: 
- Internet-Drafts to support the use case, requirements and architectural proposal
- a charter proposal that is focused on the deliverables of the first phase of the future working group

The SACM BOF in Orlando will be a second BOF. According to the IETF procedures we are allowed only two BOF sessions, so failure is not an option. I suggest that we require for Orlando a meeting slot that does not exceed 1.5 hours and that we focus the agenda on the use case, requirements and architecture proposal that will become part of the first round of deliveries of the WG. We also need a revised charter proposal to be submitted to the Area Director before 1/28 which is the cut-off date for BOF proposal requests.  

Regards,

Dan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Moriarty, Kathleen
> Sent: Monday, January 14, 2013 2:24 AM
> To: [email-masked]
> Subject: Re: [sacm] SACM UC1 And Related Requirements - Next steps
> 
> Adam, could you take the requirements as they are now and put them into
> the use case document?  Some IETF folks will want to see these in an
> actual document and the use case document will work.
> 
> The next steps that we agreed to previously was to work on an
> architecture document.  I think Dave Waltermire had some ideas here, but
> we wanted to make sure it was first based on requirements.  WOuld it be
> possible to start that discussion now and have a document before the
> deadline for the Orlando meeting?  The date for -00 drafts is 2/28/13.
> 
> Thank you!
> Kathleen

---

From: "Waltermire, David A." <[email-masked]>
Date: Mon, 14 Jan 2013 08:49:49 -0500

I am happy to help with pulling this together.  Before we get started, I wanted to check that this is the latest charter:

http://www.ietf.org/mail-archive/web/sacm/current/msg00628.html

Please let us know if you have anything more recent.

Thanks,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Romascanu, Dan (Dan)
Sent: Monday, January 14, 2013 7:47 AM
To: Moriarty, Kathleen; [email-masked]
Subject: Re: [sacm] SACM UC1 And Related Requirements - Next steps

Hi,

Regards,

Dan

> From: [email-masked] [mailto:[email-masked]] On Behalf 
> Of Moriarty, Kathleen
> Adam, could you take the requirements as they are now and put them 
> into the use case document?  Some IETF folks will want to see these in 
> an actual document and the use case document will work.
> 
> architecture document.  I think Dave Waltermire had some ideas here, 
> but we wanted to make sure it was first based on requirements.  WOuld 
> it be possible to start that discussion now and have a document before 
> the deadline for the Orlando meeting?  The date for -00 drafts is 2/28/13.
> 
> Thank you!
> Kathleen
> > Your position, then, Gary, is that there should be no such thing as 
> > an external reference?
> 
> No (assuming I understand the nature of "external" references. I 
> presume external references are those from from one document to 
> another.). I think there should be as many as desired. I had hoped to 
> express this by stating "Various consumers of such a policy might wish 
> to say varying things about it. One common thing is an identifier 
> unique in some domain.".
> 
> revision. Such considerations are manageable if revision enjoys 
> adequate treatment within SACM.
> 
> I must also caution that external references do not imply the ability 
> to discern anything other than relation.
>

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 14 Jan 2013 14:04:01 +0000

This is the latest I remember as well. 

Regards,

Dan

> From: Waltermire, David A. [mailto:[email-masked]]
> Sent: Monday, January 14, 2013 3:50 PM
> To: Romascanu, Dan (Dan); Moriarty, Kathleen; [email-masked]
> Subject: RE: [sacm] SACM UC1 And Related Requirements - Next steps
> 
> I am happy to help with pulling this together.  Before we get started, I
> wanted to check that this is the latest charter:
> 
> Romascanu, Dan (Dan)
> Internet-Draft submission cut-off date is 2/18 and not 2/28! See
> http://www.ietf.org/meeting/cutoff-dates-2013.html#IETF86.
> 
> The SACM BOF in Orlando will be a second BOF. According to the IETF
> procedures we are allowed only two BOF sessions, so failure is not an
> option. I suggest that we require for Orlando a meeting slot that does
> not exceed 1.5 hours and that we focus the agenda on the use case,
> requirements and architecture proposal that will become part of the
> first round of deliveries of the WG. We also need a revised charter
> proposal to be submitted to the Area Director before 1/28 which is the
> cut-off date for BOF proposal requests.
> 
> Regards,
> 
> Dan
> 
> 
>

---

From: Adam Montville <[email-masked]>
Date: Mon, 14 Jan 2013 15:04:09 +0000

Kathleen,

I can put the requirements in the UC document. I may not be able to complete that until February however - I'll be out of pocket for about the next two weeks.

Adam

On Jan 13, 2013, at 4:24 PM, "Moriarty, Kathleen" <[email-masked]<mailto:[email-masked]>> wrote:

Thank you!
Kathleen
________________________________________
From: [email-masked]<mailto:[email-masked]> [[email-masked]<mailto:[email-masked]>] On Behalf Of Gary Gapinski [[email-masked]<mailto:[email-masked]>]
Sent: Friday, December 14, 2012 4:48 PM
To: David Solin
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] SACM UC1 And Related Requirements

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

Adam W. Montville | Security and Compliance Architect

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | CONFIDENCE: SECURED
www.tripwire.com<http://www.tripwire.com/>

---

From: "Waltermire, David A." <[email-masked]>
Date: Mon, 14 Jan 2013 10:52:59 -0500

I'd be happy to help with this in the short-run, since Adam will be out of pocket.
Dave

From: [email-masked] [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Monday, January 14, 2013 10:04 AM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [sacm] SACM UC1 And Related Requirements - Next steps

Kathleen,

Adam

Thank you!
Kathleen

Direct: 503 276-7661
Mobile: 360 471-7815

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Mon, 14 Jan 2013 11:30:23 -0500

Thank you, both!

Sent from my iPhone

On Jan 14, 2013, at 10:54 AM, "Waltermire, David A." <[email-masked]<mailto:[email-masked]>> wrote:

I’d be happy to help with this in the short-run, since Adam will be out of pocket.
Dave

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Monday, January 14, 2013 10:04 AM
To: Moriarty, Kathleen
Cc: <mailto:[email-masked]> [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] SACM UC1 And Related Requirements - Next steps

Kathleen,

Adam

On Jan 13, 2013, at 4:24 PM, "Moriarty, Kathleen" <<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>> wrote:

Thank you!
Kathleen
________________________________________
From: <mailto:[email-masked]> [email-masked]<mailto:[email-masked]> [<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>] On Behalf Of Gary Gapinski [<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>]
Sent: Friday, December 14, 2012 4:48 PM
To: David Solin
Cc: <mailto:[email-masked]> [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] SACM UC1 And Related Requirements

_______________________________________________
sacm mailing list
<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>
<https://www.ietf.org/mailman/listinfo/sacm>https://www.ietf.org/mailman/listinfo/sacm

_______________________________________________
sacm mailing list
<mailto:[email-masked]>[email-masked]<mailto:[email-masked]>
<https://www.ietf.org/mailman/listinfo/sacm>https://www.ietf.org/mailman/listinfo/sacm

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | CONFIDENCE: SECURED
<http://www.tripwire.com/>www.tripwire.com<http://www.tripwire.com>

---

From: Stephen Hanna <[email-masked]>
Date: Tue, 15 Jan 2013 21:42:48 +0000

Thanks to Dave for taking on the revision of the SACM use cases
and requirements document with a deadline of February 18.

I hear that we also need to supply a revised charter proposal
to our Area Director by January 28. That deadline is even sooner
so we should get moving on that!

Apparently, this September 23, 2012 email has the latest version
of the proposed charter:

What a blast from the past! That charter includes lots of items
that are now out of scope for our initial work:

* enforcement
* event management
* continuous assessment

Can we agree to take those out of the deliverables in the charter?
If we want to get this airplane to fly, we must jettison as much
stuff as possible. Focus, focus, focus!

And do we have someone who is leading the effort to get a revised
SACM charter ready by January 28? I'm willing to do this but also
willing to step aside if the chairs want someone else to do it.
I just want to point out that time is getting short so we need
someone to take responsibility for getting it done. Right now,
I don't see much progress being made on the charter yet.

Thanks,

Steve

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 16 Jan 2013 12:37:05 +0000

Hi Steve, 

Indeed, getting an updated charter sent to the AD is high priority and needs to be done by 1/28, desirably earlier as Sean may have his own comments and we should leave time for at least one iteration. 

Thanks for volunteering, and I am fine with you holding the pen on this. 

Regards,

Dan

> Stephen Hanna
> Sent: Tuesday, January 15, 2013 11:43 PM
> To: [email-masked]
> Subject: [sacm] Revising the SACM Charter
> 
> Thanks to Dave for taking on the revision of the SACM use cases and
> requirements document with a deadline of February 18.
> 
> I hear that we also need to supply a revised charter proposal to our
> Area Director by January 28. That deadline is even sooner so we should
> get moving on that!
> 
> Apparently, this September 23, 2012 email has the latest version of the
> proposed charter:
> 
> What a blast from the past! That charter includes lots of items that are
> now out of scope for our initial work:
> 
> * enforcement
> * event management
> * continuous assessment
> 
> If we want to get this airplane to fly, we must jettison as much stuff
> as possible. Focus, focus, focus!
> 
> And do we have someone who is leading the effort to get a revised SACM
> charter ready by January 28? I'm willing to do this but also willing to
> step aside if the chairs want someone else to do it.
> I just want to point out that time is getting short so we need someone
> to take responsibility for getting it done. Right now, I don't see much
> progress being made on the charter yet.
> 
> Thanks,
> 
> Steve
> 
>

---

From: Stephen Hanna <[email-masked]>
Date: Wed, 16 Jan 2013 17:00:42 +0000

Thanks, Dan. I'll start on this now.

First, let me ask if there is any objection to removing the
following things that I believe are now out of scope for our
initial work, since we agreed to focus on UC1:

* enforcement
* event management
* continuous assessment

Unless I see objections in the next few hours, I'll remove
these and send a revised charter to the list later today,
along with a list of other suggested changes.

Thanks,

Steve

> From: Romascanu, Dan (Dan) [mailto:[email-masked]]
> Sent: Wednesday, January 16, 2013 7:37 AM
> To: Stephen Hanna; [email-masked]
> Subject: RE: Revising the SACM Charter
> 
> Hi Steve,
> 
> Indeed, getting an updated charter sent to the AD is high priority and
> needs to be done by 1/28, desirably earlier as Sean may have his own
> comments and we should leave time for at least one iteration.
> 
> Of
> SACM
> someone

---

From: Gunnar Engelbach <[email-masked]>
Date: Wed, 16 Jan 2013 12:08:19 -0500

Steve, no objection.  Go for it.

--gun

---

From: <[email-masked]>
Date: Wed, 16 Jan 2013 17:17:34 +0000

Steve,

First, thanks for taking this on.  I totally agree we need to focus on UC1 at present and for the first round of deliverables.  At the same time I am concerned that we could make the charter too narrow and preclude our ability to have a second round of deliverables that could address these items.  I understand the need to get a very succinct charter developed and approved but I hope we can leave some door open for us to address these areas if the working group feels the need in the future without having to create a totally new working group.

I understand I am jumping the gun here a bit but I wanted to voice my concern.  I do feel that if there is a way to do this, you are the one to get it right.

Thanks much.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Stephen Hanna <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, January 16, 2013 11:00 AM
To: "Romascanu, Dan (Dan)" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Revising the SACM Charter

* enforcement
* event management
* continuous assessment

Thanks,

Steve

-----Original Message-----
From: Romascanu, Dan (Dan) [mailto:[email-masked]]
Sent: Wednesday, January 16, 2013 7:37 AM
To: Stephen Hanna; [email-masked]<mailto:[email-masked]>
Subject: RE: Revising the SACM Charter
Hi Steve,
Indeed, getting an updated charter sent to the AD is high priority and
needs to be done by 1/28, desirably earlier as Sean may have his own
comments and we should leave time for at least one iteration.
Thanks for volunteering, and I am fine with you holding the pen on
this.
Regards,
Dan
> From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf
Of
> To: [email-masked]<mailto:[email-masked]>
stuff
SACM
someone