Subject: Re: [sacm] Charter Revised to Focus on UC1

From: [email-masked]
Date: Thu, 17 Jan 2013 07:23:20 -0600 (CST)

Steve:

First of all, thanks for taking on this challenge.

I like the 1-16-2013, simplified version.

David

On 01/16/13, Stephen Hanna<[email-masked]> wrote:

As agreed, I have edited the draft SACM charter to
remove discussion of enforcement, event management,
and continuous assessment. The revised charter is
below and also attached. I have also attached a
copy of the previous charter for easy comparison.
If anyone has concerns with these edits, please
speak up.

Thanks,

Steve

--------------

Proposed Working Group Charter

Name: Security Automation and Continuous Monitoring (SACM)
AREA: Security

Chairs:
TBD
TBD

Security Area Directors:
Stephen Farrell <stephen.farrell at cs.tcd.ie>
Sean Turner <turners at ieca.com>

Security Area Advisor:
Sean Turner <turners at ieca.com>

Mailing Lists:
General Discussion: sacm at ietf.org
To Subscribe: http://www.ietf.org/mailman/listinfo/sacm
Archive: http://www.ietf.org/mail-archive/web/sacm

Description of Working Group

Securing information and the systems that store, process, and transmit
that information has become a challenging task for organizations of
all sizes, and we find that security practitioners spend most of their
time on manual processes relegating them to ineffectiveness. Security
automation to verify system configurations with the ability to
prioritize risk based on increased situational awareness from shared
intelligence is the key to escaping this rut. This working group will
develop security automation protocols and data format standards in
support of information security processes and practices where
practical. These standards will help security practitioners to be
better utilized within their organizations by automating routine tasks
related to endpoint and server security so that practitioners can
focus on more advanced tasks. The initial focus of this work is to
address enterprise use cases.

The working group will achieve this by enabling the exchange of shared
intelligence and continuing the security automation work already
performed by various organizations around the world. The initial work
has been fruitful, and the data formats previously published are ready
for expansion on the international stage. Of particular interest to
this working group are the security automation specifications
supporting asset, change, configuration, and vulnerability
management.

By undertaking this work, we recognize that there are multiple
categories of problems in the security automation domain: enabling
interoperable data exchanges through standardized protocols, defining
expressions for particular domain concepts (i.e. data formats),
establishing a standards-based foundation supporting the curation and
exchange of security automation content collections in content
repositories, and enabling interoperability through the development
and use of standard interfaces and communications protocols. Content
based on rich data standards and protocols will provide the
authoritative instructions needed by data-driven tools to enable the
automated collection and exchange of configuration and vulnerability
data pertaining to enterprise assets. Information produced by these
tools will provide accurate and timely situational awareness in
support of organizational decision making.

The data exchange protocols will need to meet several exchange types
including those between and within organizations for sharing
intelligence data to increase situational awareness, report exchanges
both internal and external to an enterprise, and those between
enterprise servers and end points for assessments.

This working group will provide solutions to these categories of
problems and the main areas of focus for this working group are
described as follows:

1. Define, either by normative reference, adoption, or creation, a set
of standards to enable the exchange of data to increase situational
awareness or gain access to shared content to improve the security
posture of an enterprise. This area of focus provides for the
integration of interoperable protocols to access shared data
repositories between organizations to increase situational awareness
and reduce risks to an enterprise. In support of accessing shared
intelligence for expected system state and related risks, define,
either by normative reference, adoption, or creation, a set of
standards that can be used for the purpose of assessing and
aggregating device states and comparing these device states against
expected values, and reporting on those results in a predefined or ad
hoc manner. This area of focus provides for necessary language and
data format specifications.

2. Define, either by normative reference, adoption, or creation, a set
of standards that can be used to assess the state of systems, composed
of many different types of devices and networks, operated by varying
personnel, to ensure security process effectiveness in a pre-defined
or ad-hoc manner. This area of focus provides for integration protocols
supporting plug and play system assessment within an enterprise.

This working group will achieve the following milestones:

- A Standards Track document to define a protocol for interacting
with content repositories
- Standards Track documents specifying communication protocols and
data formats used for security assessment of systems
- A Standards Track document specifying asset description format
- A Standards Track document specifying asset identification
[- A Standards Track document specifying platform naming
- A Standards Track document specifying platform matching
- A Standards Track document specifying platform applicability]

After this work is completed, complementary deliverables
may be defined.

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Thu, 17 Jan 2013 10:25:21 -0500

Steve,

Thank you very much for editing the charter, I also agree and like the updated version.

Thank you!
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of [email-masked] [[email-masked]]
Sent: Thursday, January 17, 2013 8:23 AM
To: [email-masked]
Subject: Re: [sacm] Charter Revised to Focus on UC1

Steve:

David

Thanks,

Steve

--------------

Chairs:
TBD
TBD

Security Area Directors:

Security Area Advisor:

Mailing Lists:

________________________________

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm