Subject: [sacm] Tighter Focus for SACM Charter

From: Stephen Hanna <[email-masked]>
Date: Wed, 16 Jan 2013 23:27:24 +0000

I would like to propose some additional changes
to the proposed SACM charter to remove more text
that I believe is not relevant to our work on UC1.

First, I propose that we merge the description of
our two "areas of focus" so that one is about
assessing the security of systems and the other is
about interacting with content repositories. Those
seem to be the two things we're going to work on
first. They're the only things listed in our
deliverables so they should be our areas of focus.

Second, I think we should consider removing the
exchange of information across organizational
boundaries from our charter. We have plenty of
work to do just within a single organization.
Can't we focus on that and leave the problems of
exchanging information across organizational
boundaries to other groups (like MILE) or to
later efforts in SACM after we finish our work
on UC1? 

Agree? Disagree? Speak up now!

Thanks,

Steve

---

From: <[email-masked]>
Date: Wed, 16 Jan 2013 23:35:59 +0000

Steve,

I agree with your perspective, ideas and approach.

Thanks.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Stephen Hanna <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, January 16, 2013 5:27 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [sacm] Tighter Focus for SACM Charter

Thanks,

Steve

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Randal Taylor <[email-masked]>
Date: Wed, 16 Jan 2013 18:46:30 -0500

Steve,

I too agree that this approach makes sense.

Randy

On 1/16/2013 6:27 PM, Stephen Hanna wrote:
> [email-masked]

---

From: Gary Gapinski <[email-masked]>
Date: Wed, 16 Jan 2013 19:51:00 -0500

> deliverables so they should be our areas of focus.

I think they do not merge well. Let the definition of the nature of
places of repose and access thereto be handled separately and not conflated.

That which reposes in such places is most important. How it is obtained,
revised, and so forth is less important.

Perhaps I misunderstand. Will there be two areas of focus, or one
consisting of a mélange? I think they are separable, and the concept of
a repository appears to carry unexplicated requirements which constrain
the other. Is there any reason they are not separable? Content
management seems already conquered, at least in a general sense.
Security content is, in the end, just documents.

> later efforts in SACM after we finish our work

I agree, with the caveat that information exchange regarding the
security posture of things can and should occur, which demands a
definite manner of expression thereof. I think that such expression is
an essential task of SACM. If done well, it is a lingua franca suitable
for exchange. Is the "organizational boundary" simply one of demarcation
between potentially disparate concepts of assets? If it is (as I think
it is), perhaps this is something which has already been mastered and
should simply be adopted. The alternative is to say things about how
things should be secured in a way that is suitable for general adoption
regardless of the objects of interest. Anything more is an attempt to
circumscribe the universe of discourse, and I suspect adoption of some
extant scheme is preferable to inventing a novel one.

After preparing this response and getting ready to hit send, I notice
that Gunnar has already expressed this quite a bit more precisely, so
please pay attention to him rather than the above. ff that is not
possible, please at a minimum regard repositories as just such, and not
essential. So, if you read this far, you read too far.

---

From: Stephen Hanna <[email-masked]>
Date: Thu, 17 Jan 2013 06:11:05 +0000

Gary Gapinski wrote:
> Let the definition of the nature of places of repose 
> and access thereto be handled separately and not
> conflated.
> 
> That which reposes in such places is most important.
> How it is obtained, revised, and so forth is less
> important.
>
> [...]
>
> Content management seems already conquered, at least
> in a general sense.

In a December 12 email to this list, I wrote:

> 2) Do we really need protocols for accessing a content
>    repository for UC1? Why?

An avalanche of responses followed, with arguments
that we need to have a standard protocol for accessing
content that's stored in a repository and probably also
a protocol for "curating" content in a repository.
In deference to the apparent consensus of the group,
I'm inclined to leave such protocols in scope for
the SACM charter.

Maybe we'll be able to reference an existing repository
protocol instead of inventing a new one. There are so
many already!

Thanks,

Steve