Subject: Re: [sacm] I-D Action: draft-booth-sacm-vuln-model-01.txt

From: Sean Turner <[email-masked]>
Date: Mon, 28 Jan 2013 22:20:36 -0500

Hi list,

Here's some comments on this draft:

The 800lb gorilla in this document is CVSS ;)  It's in a NIST IR so we 
can just adopt it (right?), but everybody does understand that it might 
end up getting changed before it gets published?  Assuming that's 
accepted, what's up with v3 that's under development by FIRST?  I would 
have thought that what's in this draft would be v3.  And if we're making 
a different version, then why not use an IANA namespace for the new 
version?  Then, you'd say what's in this document was based on CVSSv2, 
we can thank the authors and NIST/DHS/FIRST/MITRE/etc. in an 
acknowledgements section, and you can move the CVSSv2 reference to an 
informative reference.

s1.1/1.2: r/report/document or specification

s4: same questions about CPE as I noted in my email on 
draft-montville-sacm-asset-identification.

s5: Not sure we need the section.

s.7.2: I guess the data model looks fine, but I'm wondering if anybody 
else has provided any comments on it?

s7.2.1.2: Don't we need a registry for vulnerabilityIdType.

s7.2.1.4: Must we pick en-US as the default lang?

Appendices: Please indicate whether they are normative or informative. C 
is clearly normative, but not sure about the others.

Scoring: Somewhere you're going to have to address who does the scoring.

Cheers,

spt