Subject: [sacm] Charter Including Sean's Changes

From: Stephen Hanna <[email-masked]>
Date: Thu, 24 Jan 2013 18:00:54 +0000

Here (below and attached) is a charter that includes
the changes suggested by Sean Turner. At least, this
is my interpretation of Sean's suggestions. 

Comments most welcome!

Thanks,

Steve

----------

Proposed Working Group Charter

Name: Security Automation and Continuous Monitoring (SACM)
AREA: Security

Chairs:
TBD
TBD

Security Area Directors:
     Stephen Farrell <stephen.farrell at cs.tcd.ie>
     Sean Turner <turners at ieca.com>

Security Area Advisor:
     Sean Turner <turners at ieca.com>

Mailing Lists:
     General Discussion: sacm at ietf.org
     To Subscribe:       http://www.ietf.org/mailman/listinfo/sacm
     Archive:            http://www.ietf.org/mail-archive/web/sacm

Description of Working Group

Securing information and the systems that store, process, and transmit
that information is a challenging task for organizations of all sizes,
and many security practitioners spend most of their time on manual
processes relegating them to ineffectiveness. The key to escaping this
rut is security automation to collect, verify, and update system
configurations with the ability to prioritize risk based on timely
information about threats. This working group will develop security
automation protocols and data format standards in support of
information security processes and practices. These standards will
help security practitioners to be more effective by automating routine
tasks related to client and server security freeing them to focus on
more advanced tasks. The initial focus of this work is to address
enterprise use cases pertaining to the assessment of endpoint posture
(using the definitions of Endpoint and Posture from RFC 5209).

The working group will, whenever reasonable and possible, reuse
existing protocols and mechanisms. Of particular interest to this
working group are the security automation specifications supporting
asset, change, configuration, and vulnerability management.

There are multiple categories of problems in the security automation
realm: enabling interoperable data exchanges through standardized
protocols, defining expressions for particular domain concepts
(i.e. data formats), establishing a standards-based foundation
supporting the curation and exchange of security automation content
collections in content repositories, and enabling interoperability
through the development and use of standard interfaces and
communication protocols. Content based on rich and extensible data
standards and protocols will provide the authoritative instructions
needed by data-driven tools to enable the automated collection of
configuration and vulnerability data pertaining to enterprise
assets. Information produced by these tools will provide accurate and
timely situational awareness in support of organizational decision
making.

The data exchange protocols will need to support several exchange
types including requesting assessments and reporting on assessment
results. Exchanging information across organizational boundaries will
not be within scope for this effort at this time.

This working group will provide solutions to these categories of
problems and the main areas of focus for this working group are
described as follows:

1. A set of standards to enable assessment of endpoint posture.
   This area of focus provides for necessary language and data
   format specifications.

2. A set of standards for interacting with repositories of content
   related to assessment of endpoint posture.

This working group will achieve the following milestones:

- An Informational document on Use Cases and Requirements
- An Informational document on SACM Architecture
- A Standards Track document to define a protocol for interacting
  with content repositories
- Standards Track documents specifying communication protocols and
  data formats used for assessment of endpoint posture

After these work items have been submitted to and approved by
the IESG, the WG will recharter or close.

---

From: Sean Turner <[email-masked]>
Date: Fri, 25 Jan 2013 14:50:31 -0500

My plan is to post a link to this charter on the BOF wiki page sometime 
before 2013-01-28 24:00 UTC unless I get another revised charter before 
then.  Regardless of what version get posted for the IESG and IAB to 
review, the charter discuss can continue.  In a nut shell, I have to put 
something up for the IESG and IAB to read.

spt

On 1/24/13 1:00 PM, Stephen Hanna wrote:
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Sean Turner <[email-masked]>
Date: Mon, 28 Jan 2013 09:28:17 -0500

BOF request posted:
http://trac.tools.ietf.org/bof/trac/wiki/WikiStart

spt

---

From: "Waltermire, David A." <[email-masked]>
Date: Mon, 28 Jan 2013 10:50:14 -0500

Thanks Sean!

Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sean Turner
Sent: Monday, January 28, 2013 9:28 AM
To: [email-masked]
Subject: Re: [sacm] Charter Including Sean's Changes

BOF request posted:

spt

On 1/25/13 2:50 PM, Sean Turner wrote:
> My plan is to post a link to this charter on the BOF wiki page 
> sometime before 2013-01-28 24:00 UTC unless I get another revised 
> charter before then.  Regardless of what version get posted for the 
> IESG and IAB to review, the charter discuss can continue.  In a nut 
> shell, I have to put something up for the IESG and IAB to read.
>
> spt
>
>> Here (below and attached) is a charter that includes the changes 
>> suggested by Sean Turner. At least, this is my interpretation of 
>> Sean's suggestions.
>>
>> Comments most welcome!
>>
>> Thanks,
>>
>> Steve
>>
>> ----------
>>
>> Securing information and the systems that store, process, and 
>> transmit that information is a challenging task for organizations of 
>> all sizes, and many security practitioners spend most of their time 
>> on manual processes relegating them to ineffectiveness. The key to 
>> escaping this rut is security automation to collect, verify, and 
>> update system configurations with the ability to prioritize risk 
>> based on timely information about threats. This working group will 
>> develop security automation protocols and data format standards in 
>> support of information security processes and practices. These 
>> standards will help security practitioners to be more effective by 
>> automating routine tasks related to client and server security 
>> freeing them to focus on more advanced tasks. The initial focus of 
>> this work is to address enterprise use cases pertaining to the 
>> assessment of endpoint posture (using the definitions of Endpoint and Posture from RFC 5209).
>>
>> protocols, defining expressions for particular domain concepts (i.e. 
>> data formats), establishing a standards-based foundation supporting 
>> the curation and exchange of security automation content collections 
>> in content repositories, and enabling interoperability through the 
>> development and use of standard interfaces and communication 
>> protocols. Content based on rich and extensible data standards and 
>> protocols will provide the authoritative instructions needed by 
>> data-driven tools to enable the automated collection of configuration 
>> and vulnerability data pertaining to enterprise assets. Information 
>> produced by these tools will provide accurate and timely situational 
>> awareness in support of organizational decision making.
>>
>> After these work items have been submitted to and approved by the 
>> IESG, the WG will recharter or close.
>>
>>
>>

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 28 Jan 2013 15:58:34 +0000

Thanks, Sean! Looks good, let us know if you need more information or supporting material. 

Regards,

Dan

> Sent: Monday, January 28, 2013 4:28 PM
> To: [email-masked]