Subject: [sacm] sacm charter review

From: Sean Turner <[email-masked]>
Date: Mon, 24 Jun 2013 08:43:14 -0400

In case your curious you can watch the IESG comments here:
https://datatracker.ietf.org/doc/charter-ietf-sacm/ballot/

Barry's and Spencer provided some early comments that I think are worth 
while and I thought I'd share them with you:

1) Identify the other SDOs, groups and organizations.  This is really 
for the IAB to know who we'll be dealing with because they're 
responsible for liaisons.  Shot me a couple ;)

2) Avoid some duplication (this is more of an FYI):

OLD:

Automating these routine tasks would free security practitioners to 
focus on high priority tasks, and should improve operators' ability to 
prioritize risk based on timely information about threats and 
vulnerabilities. This working group will define security automation 
protocols and data format standards in support of information security 
processes and practices. These standards will help security 
practitioners to be more effective by automating routine tasks related 
to client and server security, freeing them to focus on more advanced tasks.

NEW:

Automating these routine tasks would allow security practitioners to 
work more effectively, focusing on more advanced and high priority 
tasks, and should improve operators' ability to prioritize risk based on 
timely information about threats and vulnerabilities.  To that end, this 
working group will define security automation protocols and data format 
standards in support of information security processes and practices.

3)

---

From: "David Harrington" <[email-masked]>
Date: Mon, 24 Jun 2013 09:08:51 -0400

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sean
Turner
Sent: Monday, June 24, 2013 8:43 AM
To: [email-masked]
Subject: [sacm] sacm charter review

 [...]
Automating these routine tasks would allow security practitioners to work
more effectively, focusing on more advanced and high priority tasks, and
should improve operators' ability to prioritize risk based on timely
information about threats and vulnerabilities.  To that end, this working
group will define security automation protocols and data format standards in
support of information security processes and practices.

[dbh>] Which information security processes and practices? As I try to edit
the use-cases document, I am not finding much information about which
processes and practices will be considered.

David Harrington
[email-masked]
+1-603-828-1401
_______________________________________________

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Mon, 24 Jun 2013 10:33:26 -0400

The DMTF is a possibility for references to the Common Interface Model.  We will likely have interface points.

Best regards,
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Sean Turner [[email-masked]]
Sent: Monday, June 24, 2013 8:43 AM
To: [email-masked]
Subject: [sacm] sacm charter review

OLD:

NEW:

3)
_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: Stephen Hanna <[email-masked]>
Date: Mon, 24 Jun 2013 14:43:26 +0000

Trusted Computing Group (TCG) has several standards
such as IF-MAP that seem quite useful for SACM.

Thanks,

Steve

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Moriarty, Kathleen
> Sent: Monday, June 24, 2013 10:33 AM
> To: Sean Turner; [email-masked]
> Subject: Re: [sacm] sacm charter review
>

---

From: Adam Montville <[email-masked]>
Date: Mon, 24 Jun 2013 15:52:43 +0000

There are a variety of other SDOs in which we could be interested now or in the future.  The short-story list:

* FIRST (vulnerability scoring)
* DMTF (already mentioned)
* TCG (already mentioned)
* The Open Group (XDAS and others)
* ISO (i.e. TagVault)
* W3C (i.e. obvious things like XML DigSig, and potentially less obvious things like RDF, OWL, SWRL, etc.)
* OASIS (i.e. security assertions, key management, alerting)
* OMG (i.e. Business Process Model Notation and/or Execution Language, etc.)

Please keep in mind the "or in the future" part of the first sentence :-)

Adam

> Stephen Hanna
> Sent: Monday, June 24, 2013 7:44 AM
> To: Moriarty, Kathleen; Sean Turner; [email-masked]
> Trusted Computing Group (TCG) has several standards such as IF-MAP that
> seem quite useful for SACM.
> 
> Thanks,
> 
> Steve
> 
> > From: [email-masked] [mailto:[email-masked]] On Behalf
> > Of Moriarty, Kathleen
> > Barry's and Spencer provided some early comments that I think are
> > worth while and I thought I'd share them with you:
> >
> > tasks, and should improve operators' ability to prioritize risk based
> > on timely information about threats and vulnerabilities.  To that end,
> > this working group will define security automation protocols and data
> > format standards in support of information security processes and
> > practices.
> >
> > 3)
> ...

This message and attachments may contain confidential information.  If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited.  Please notify the sender immediately and permanently delete the message and any attachments.

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 24 Jun 2013 12:47:54 -0400

SDO is an undesirable legacy term.
Pathetically, the old SDO club still
does not regard the IETF as a "SDO!"
http://www.tta.or.kr/English/new/external_relations/gsc17_communique.jsp

Perhaps it is better to simply use
"standards fora."

You should consider including: NIST,
MITRE, and 3GPP - all of which are
well recognized as key standards bodies
currently engaged in SACM related work
with whom you should be interested now.

-t

---

From: Sean Turner <[email-masked]>
Date: Mon, 24 Jun 2013 19:05:39 -0400

> Perhaps it is better to simply use

I'm not against just saying organization too.  I don't want to get in to 
arguments about what's an SDO and what's not.

spt

>> * W3C (i.e. obvious things like XML DigSig, and potentially less
>> obvious things like RDF, OWL, SWRL, etc.)

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 25 Jun 2013 08:07:42 +0000

The proposed text in the charter already says: 

> In accordance with existing IETF processes, the group will communicate with and
invite participation from other relevant standards bodies and regulatory
organizations, and if necessary reuse existing liaison relationships or request
the establishment of new liaison relationships.

'standard bodies and regulatory organizations' are neutral terms enough IMO, as Sean says we should not enter the 'what is an SDO dispute'. We are dealing not only with standards organizations and this is also reflected in the current text. 

Regards,

Dan

> Sean Turner
> Sent: Tuesday, June 25, 2013 2:06 AM
> To: [email-masked]
> Cc: Moriarty, Kathleen; Stephen Hanna; Adam Montville; [email-masked]
> > well recognized as key standards bodies currently engaged in SACM
> > related work with whom you should be interested now.
> >
> > -t
> >
> >> * OMG (i.e. Business Process Model Notation and/or Execution
> >> Language,
> >> etc.)
> >
> >

---

From: "Waltermire, David A." <[email-masked]>
Date: Tue, 25 Jun 2013 07:42:06 -0400

It sounds like there are two items under discussion in this thread.

1) Sean's original question, what  other SDOs, groups and organizations will the IAB need to deal with regarding liaison relationships?

The ISO/IEC 18180:2013, Information technology -- Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2 was published on June 15, 2013. It is freely available here:

http://standards.iso.org/ittf/PubliclyAvailableStandards/index.html

ISO JTC1 is ready to consider placement of the document in SC27 or transfer to the IETF SACM WG. If we are interested in transitioning this to the IETF we need to start this discussion at the July INCITS EB meeting.  This is something that we need to consider as a WG and is something that the IAB will likely need to work on if we want to bring it here.  Sean, do you have any thoughts/guidance on this item.

2) What organizations would might have work that is relevant to contribute to SACM?

+1 on Dan's point.  The "what is a SDO debate?" is not helpful here.  If an organization outside the IETF is interested in contributing work that supports SACM, we should encourage those contributions per the IETFs rules on IPR. I think the wording in the charter is supportive of this.

Thanks,
Dave

> Romascanu, Dan (Dan)
> Sent: Tuesday, June 25, 2013 4:08 AM
> To: Sean Turner; [email-masked]
> Cc: Adam Montville; Stephen Hanna; Moriarty, Kathleen; [email-masked]
> 'standard bodies and regulatory organizations' are neutral terms enough
> IMO, as Sean says we should not enter the 'what is an SDO dispute'. We are
> dealing not only with standards organizations and this is also reflected in the
> current text.
> 
> Regards,
> 
> Dan
> 
> 
> 
> 
> 
> > Of Sean Turner
> > > Pathetically, the old SDO club still does not regard the IETF as a
> > > "SDO!"
> > >
> http://www.tta.or.kr/English/new/external_relations/gsc17_communique
> > > .j
> > > sp
> > >
> > I'm not against just saying organization too.  I don't want to get in
> > to arguments about what's an SDO and what's not.
> >
> > spt
> >
> > > You should consider including: NIST, MITRE, and 3GPP - all of which
> > > are well recognized as key standards bodies currently engaged in
> > > SACM related work with whom you should be interested now.
> > >
> > > -t
> > >
> > >> There are a variety of other SDOs in which we could be interested
> > >> now or in the future.  The short-story list:
> > >>

---

From: Sean Turner <[email-masked]>
Date: Tue, 25 Jun 2013 08:46:53 -0400

At this point 3 ADs have asked about what other SDOs are involved.  I'm 
not sure if they want names in the charter or if they're just interested 
in knowing.

spt

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 25 Jun 2013 13:17:42 +0000

Hi Sean,

A list of organizations that are involved in the area, as identified in this discussion includes: 

- TCG
- DMTF
- FIRST 
- The Open Group 
- ISO/IEC 
- W3C 
- OASIS 
- OMG
- NIST
- MITRE
- 3GPP

It's up to the IESG to decide if we should list these (or some of them) explicitly, or we should leave to the WG after its formation is approved to initiate communication and invite participation. 

Regards,

Dan

> From: Sean Turner [mailto:[email-masked]]
> Sent: Tuesday, June 25, 2013 3:47 PM
> To: Romascanu, Dan (Dan)
> Cc: [email-masked]; Adam Montville; Stephen Hanna; Moriarty,
> Kathleen; [email-masked]
> > invite participation from other relevant standards bodies and
> > regulatory organizations, and if necessary reuse existing liaison
> > relationships or request the establishment of new liaison
> relationships.
> >
> > 'standard bodies and regulatory organizations' are neutral terms
> enough IMO, as Sean says we should not enter the 'what is an SDO
> dispute'. We are dealing not only with standards organizations and this
> is also reflected in the current text.
> >
> > Regards,
> >
> > Dan
> >
> >
> >
> >
> >

---

From: "David Harrington" <[email-masked]>
Date: Tue, 25 Jun 2013 09:42:52 -0400

Wow! 
I think this is an excellent commentary on the scope of SACM being way too
broad, and poorly scoped for engineering purposes.

David Harrington
[email-masked]
+1-603-828-1401

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Romascanu, Dan (Dan)
Sent: Tuesday, June 25, 2013 9:18 AM
To: Sean Turner
Cc: Moriarty, Kathleen; Stephen Hanna; Adam Montville; [email-masked];
[email-masked]
Subject: Re: [sacm] sacm charter review

Hi Sean,

A list of organizations that are involved in the area, as identified in this
discussion includes: 

- TCG
- DMTF
- FIRST
- The Open Group
- ISO/IEC
- W3C
- OASIS
- OMG
- NIST
- MITRE
- 3GPP

It's up to the IESG to decide if we should list these (or some of them)
explicitly, or we should leave to the WG after its formation is approved to
initiate communication and invite participation. 

Regards,

Dan

> At this point 3 ADs have asked about what other SDOs are involved.  
> I'm not sure if they want names in the charter or if they're just 
> interested in knowing.
> 
> spt
> 
> dispute'. We are dealing not only with standards organizations and 
> this is also reflected in the current text.
> >
> > Regards,
> >
> > Dan
> >
> >
> >
> >
> >
> >> From: [email-masked] [mailto:[email-masked]] On 
> >> Behalf Of Sean Turner
> >>> Perhaps it is better to simply use "standards fora."
> >>
> >> I'm not against just saying organization too.  I don't want to get 
> >> in to arguments about what's an SDO and what's not.
> >>
> >> spt
> >>
> >>> You should consider including: NIST, MITRE, and 3GPP - all of 
> >>> which are well recognized as key standards bodies currently 
> >>> engaged in SACM related work with whom you should be interested now.
> >>>
> >>> -t
> >>>

---

From: Adam Montville <[email-masked]>
Date: Tue, 25 Jun 2013 15:15:04 +0000

Hi David,

I respectfully disagree.  

While this may be a commentary on the potential, eventual reach of SACM, our charter's scope is far reduced from including all of these organizations at the outset.  In other words, our scope is limited by the language in the charter, against which this list really has no bearing other than to satisfy curiosity and, perhaps, lend some vision to the future.

In fact, it might be more properly construed that this list of organizations is a commentary on the ubiquitous nature of assessment - it is a capability that "touches" a lot of different areas, which is precisely why it warrants its own working group, IMO.

Regards,

Adam

________________________________________
From: [email-masked] [[email-masked]] on behalf of David Harrington [[email-masked]]
Sent: Tuesday, June 25, 2013 6:43 AM
To: 'Sean Turner'; [email-masked]
Subject: Re: [sacm] sacm charter review

Wow!

David Harrington
[email-masked]
+1-603-828-1401

-----Original Message-----

Hi Sean,

- TCG
- DMTF
- FIRST
- The Open Group
- ISO/IEC
- W3C
- OASIS
- OMG
- NIST
- MITRE
- 3GPP

Regards,

Dan

...

---

From: <[email-masked]>
Date: Tue, 25 Jun 2013 15:24:12 +0000

Well said Adam. I totally agree with your comments.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Adam Montville <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, June 25, 2013 5:15 PM
To: David Harrington <[email-masked]<mailto:[email-masked]>>, Sean Turner <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] sacm charter review

Hi David,

I respectfully disagree.

Regards,

Adam

________________________________________
From: [email-masked]<mailto:[email-masked]> [[email-masked]<mailto:[email-masked]>] on behalf of David Harrington [[email-masked]<mailto:[email-masked]>]
Sent: Tuesday, June 25, 2013 6:43 AM
To: 'Sean Turner'; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] sacm charter review

Wow!

David Harrington
[email-masked]<mailto:[email-masked]>
+1-603-828-1401

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of
Romascanu, Dan (Dan)
Sent: Tuesday, June 25, 2013 9:18 AM
To: Sean Turner
Cc: Moriarty, Kathleen; Stephen Hanna; Adam Montville; [email-masked]<mailto:[email-masked]>;
[email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] sacm charter review

Hi Sean,

- TCG
- DMTF
- FIRST
- The Open Group
- ISO/IEC
- W3C
- OASIS
- OMG
- NIST
- MITRE
- 3GPP

Regards,

Dan

-----Original Message-----
From: Sean Turner [mailto:[email-masked]]
Sent: Tuesday, June 25, 2013 3:47 PM
To: Romascanu, Dan (Dan)
Cc: [email-masked]<mailto:[email-masked]>; Adam Montville; Stephen Hanna; Moriarty,
Kathleen; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] sacm charter review

spt

relationships.
>> From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On
>> Behalf Of Sean Turner
>> To: [email-masked]<mailto:[email-masked]>
>> Cc: Moriarty, Kathleen; Stephen Hanna; Adam Montville;
>> [email-masked]<mailto:[email-masked]>
>> [email-masked]<mailto:[email-masked]>
> [email-masked]<mailto:[email-masked]>
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

...

This message and attachments may contain confidential information.  If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited.  Please notify the sender immediately and permanently delete the message and any attachments.
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Michael Hammer <[email-masked]>
Date: Tue, 25 Jun 2013 15:40:56 +0000

+1  This just means many groups are interested in the same scope.

Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Tuesday, June 25, 2013 8:24 AM
To: [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: [sacm] sacm charter review

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096 
Mobile: +1.817.637.8026
Web: www.mcafee.com <http://www.mcafee.com/> 

From: Adam Montville <[email-masked]>
Date: Tuesday, June 25, 2013 5:15 PM
To: David Harrington <[email-masked]>, Sean Turner
<[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [sacm] sacm charter review

Hi David,

I respectfully disagree.  

While this may be a commentary on the potential, eventual reach of SACM, our
charter's scope is far reduced from including all of these organizations at
the outset.  In other words, our scope is limited by the language in the
charter, against which this list really has no bearing other than to satisfy
curiosity and, perhaps, lend some vision to the future.

In fact, it might be more properly construed that this list of organizations
is a commentary on the ubiquitous nature of assessment - it is a capability
that "touches" a lot of different areas, which is precisely why it warrants
its own working group, IMO.

Regards,

Adam

From: [email-masked] [[email-masked]] on behalf of David
Harrington [[email-masked]]

Wow!

David Harrington

[email-masked]

+1-603-828-1401

-----Original Message-----

Romascanu, Dan (Dan)

To: Sean Turner

[email-masked]

Hi Sean,

discussion includes:

- TCG

- DMTF

- FIRST

- The Open Group

- ISO/IEC

- W3C

- OASIS

- OMG

- NIST

- MITRE

- 3GPP

Regards,

Dan

 

-----Original Message-----

To: Romascanu, Dan (Dan)

Kathleen; [email-masked]

interested in knowing.

spt

>> In accordance with existing IETF processes, the group will

>> communicate with and

relationships.

>>> http://www.tta.or.kr/English/new/external_relations/gsc17_communiq

>>> ue

sacm mailing list

[email-masked]

sacm mailing list

[email-masked]

...

This message and attachments may contain confidential information.  If it
appears that this message was sent to you by mistake, any retention,
dissemination, distribution or copying of this message and attachments is
strictly prohibited.  Please notify the sender immediately and permanently
delete the message and any attachments.

sacm mailing list

[email-masked]

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 26 Jun 2013 08:33:37 +0000

Yes. The fact that other organizations are interested in the scope of SACM does not mean that they do the same work, and certainly the future WG must avoid duplication. Maybe we should make this explicit. For example:

OLD:

The working group will create an overview of related standards work
Internet-Draft which will document existing work in the IETF or in other SDOs
which can be used as-is or as a starting point for developing solutions to the
SACM requirements. The working group may decide to make of this document an
Informational RFC, but this is not a mandatory deliverable.

NEW:

The working group will create an overview of related standards work
Internet-Draft which will document existing work in the IETF or in other SDOs
which can be used as-is or as a starting point for developing solutions to the
SACM requirements. The working group may decide to refer or document these in
An Informational RFC, but this is not a mandatory deliverable. The working group
will not duplicate work already done or in progress in other places.

Regards,

Dan

From: [email-masked] [mailto:[email-masked]] On Behalf Of Michael Hammer
Sent: Tuesday, June 25, 2013 6:41 PM
To: [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] sacm charter review

Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Tuesday, June 25, 2013 8:24 AM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] sacm charter review

Kent Landfield

Hi David,

I respectfully disagree.

Regards,

Adam

Wow!

David Harrington

-----Original Message-----

Hi Sean,

- TCG
- DMTF
- FIRST
- The Open Group
- ISO/IEC
- W3C
- OASIS
- OMG
- NIST
- MITRE
- 3GPP

Regards,

Dan

-----Original Message-----
From: Sean Turner [mailto:[email-masked]]
Sent: Tuesday, June 25, 2013 3:47 PM
To: Romascanu, Dan (Dan)
Cc: [email-masked]<mailto:[email-masked]>; Adam Montville; Stephen Hanna; Moriarty,

spt

relationships.

...

---

From: Sean Turner <[email-masked]>
Date: Wed, 26 Jun 2013 07:56:41 -0400

It looks like Joel wants to know now some of the organizations (i.e., 
there's block on the charter).  Can we whittle this list down to just 
orgs we're going to be dealing with at the initial stages?  For asset 
identification it's possibly going to be ISO+NIST+?, for endpoint 
elements to assess it's ?, for comparison it's ?, for interacting with 
repositories it's NEA.

More inline.

On 6/26/13 4:33 AM, Romascanu, Dan (Dan) wrote:
> Yes. The fact that other organizations are interested in the scope of
> SACM does not mean that they do the same work, and certainly the future
> WG must avoid duplication. Maybe we should make this explicit. For example:
>
> OLD:
>

We were on the same wavelength.  I'm not sure we need to repeated the we 
won't duplicate work because there's already a blurb about reuse.  What 
I proposed to Barry/Joel/Spencer:

OLD:

The working group will create an overview of related standards work 
Internet-Draft which will document existing work in the IETF or in other 
SDOs which can be used as-is or as a starting point for developing 
solutions to the SACM requirements.

NEW:

The working group will create an Internet-Draft documenting the existing 
work in the IETF and in other organizations that might
be used as-is or as a starting point for developing solutions to
the SACM requirements.

OLD:

In accordance with existing IETF processes, the group will communicate 
with and invite participation from other relevant standards bodies and 
regulatory organizations, and if necessary reuse existing liaison 
relationships or request the establishment of new liaison relationships.

NEW:

In accordance with existing IETF processes, the working group will 
communicate with and invite participation from other relevant groups and 
regulatory organizations, and if necessary reuse existing liaison 
relationships or request the establishment of new liaison relationships.

> Regards,
>
> Dan
>
> *From:[email-masked] [mailto:[email-masked]] *On Behalf
> Of *Michael Hammer
> *Sent:* Tuesday, June 25, 2013 6:41 PM
> *To:* [email-masked]; [email-masked];
> [email-masked]; [email-masked]; [email-masked]
> *Subject:* Re: [sacm] sacm charter review
>
> *From:[email-masked] <mailto:[email-masked]>
> [mailto:[email-masked]] *On Behalf Of [email-masked]
> <mailto:[email-masked]>
> *Sent:* Tuesday, June 25, 2013 8:24 AM
> *To:* [email-masked]
> <mailto:[email-masked]>; [email-masked]
> <mailto:[email-masked]>; [email-masked]
> <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> *Subject:* Re: [sacm] sacm charter review
>
> *Kent Landfield*
> *McAfee | An Intel Company*
> Direct: +1.972.963.7096
> Mobile: +1.817.637.8026
> *Web: *www.mcafee.com <http://www.mcafee.com/>
>
> *From: *Adam Montville <[email-masked]
> <mailto:[email-masked]>>
> *Date: *Tuesday, June 25, 2013 5:15 PM
> *To: *David Harrington <[email-masked]
> <mailto:[email-masked]>>, Sean Turner <[email-masked]
> <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>"
> <[email-masked] <mailto:[email-masked]>>
> *Subject: *Re: [sacm] sacm charter review
>
>     Hi David,
>
>     I respectfully disagree.
>
>     While this may be a commentary on the potential, eventual reach of
>     SACM, our charter's scope is far reduced from including all of these
>     organizations at the outset.  In other words, our scope is limited
>     by the language in the charter, against which this list really has
>     no bearing other than to satisfy curiosity and, perhaps, lend some
>     vision to the future.
>
>     In fact, it might be more properly construed that this list of
>     organizations is a commentary on the ubiquitous nature of assessment
>     - it is a capability that "touches" a lot of different areas, which
>     is precisely why it warrants its own working group, IMO.
>
>     Regards,
>
>     Adam
>
>     From: [email-masked] <mailto:[email-masked]>
>     [[email-masked] <mailto:[email-masked]>] on behalf of
>     David Harrington [[email-masked]
>     <mailto:[email-masked]>]
>
>     To: 'Sean Turner'; [email-masked] <mailto:[email-masked]>
>
>     [email-masked] <mailto:[email-masked]>
>
>     +1-603-828-1401
>
>     From: [email-masked] <mailto:[email-masked]>
>     [mailto:[email-masked]] On Behalf Of
>
>     Romascanu, Dan (Dan)
>
>     <mailto:[email-masked]>;
>     [email-masked] <mailto:[email-masked]>
>
>         Cc: [email-masked] <mailto:[email-masked]>; Adam
>         Montville; Stephen Hanna; Moriarty,
>
>         Kathleen; [email-masked] <mailto:[email-masked]>
>
>         >> From:[email-masked] <mailto:[email-masked]>
>         [mailto:[email-masked]] On
>
>         >> Behalf Of Sean Turner
>
>         >> To:[email-masked] <mailto:[email-masked]>
>
>         >>[email-masked] <mailto:[email-masked]>
>
>         >>[email-masked] <mailto:[email-masked]>
>
>         >[email-masked] <mailto:[email-masked]>
>
>     [email-masked] <mailto:[email-masked]>
>
>     [email-masked] <mailto:[email-masked]>
>
>     This message and attachments may contain confidential
>     information.  If it appears that this message was sent to you by
>     mistake, any retention, dissemination, distribution or copying of
>     this message and attachments is strictly prohibited.  Please notify
>     the sender immediately and permanently delete the message and any
>     attachments.
>
>     [email-masked] <mailto:[email-masked]>
>

---

From: <[email-masked]>
Date: Wed, 26 Jun 2013 12:10:37 +0000

>From my perspective the initial organizations we will be dealing with are

     - ISO/IEC
     - NIST
     - MITRE

Kent Landfield

From: Sean Turner <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, June 26, 2013 1:56 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] sacm charter review

More inline.

OLD:

SDOs

which can be used as-is or as a starting point for developing solutions
to the

NEW:

SDOs

which can be used as-is or as a starting point for developing solutions
to the

SACM requirements. The working group may decide to refer or document
these in

An Informational RFC, but this is not a mandatory deliverable. The
working group

OLD:

NEW:

OLD:

NEW:

Regards,

Dan

*From:[email-masked]<mailto:[email-masked]> [mailto:[email-masked]] *On Behalf
Of *Michael Hammer
*Sent:* Tuesday, June 25, 2013 6:41 PM
*To:* [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>;
[email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
*Subject:* Re: [sacm] sacm charter review

Mike

*From:[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>
[mailto:[email-masked]] *On Behalf Of [email-masked]<mailto:[email-masked]>
<mailto:[email-masked]>
*Sent:* Tuesday, June 25, 2013 8:24 AM
*To:* [email-masked]<mailto:[email-masked]>
<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>
*Subject:* Re: [sacm] sacm charter review

*Kent Landfield*

*From: *Adam Montville <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]>>
*Date: *Tuesday, June 25, 2013 5:15 PM
*To: *David Harrington <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]>>, Sean Turner <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>"
<[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>>
*Subject: *Re: [sacm] sacm charter review

     Hi David,

     I respectfully disagree.

     Regards,

     Adam

     From: [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>
     [[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>] on behalf of
     David Harrington [[email-masked]<mailto:[email-masked]>
     <mailto:[email-masked]>]

     To: 'Sean Turner'; [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

     Wow!

     I think this is an excellent commentary on the scope of SACM being
     way too

     David Harrington

     [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

     +1-603-828-1401

     -----Original Message-----

     From: [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>
     [mailto:[email-masked]] On Behalf Of

     Romascanu, Dan (Dan)

     To: Sean Turner

     Cc: Moriarty, Kathleen; Stephen Hanna; Adam Montville; [email-masked]<mailto:[email-masked]>
     <mailto:[email-masked]>;

     [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

     Hi Sean,

     A list of organizations that are involved in the area, as identified
     in this

     discussion includes:

     - TCG

     - DMTF

     - FIRST

     - The Open Group

     - ISO/IEC

     - W3C

     - OASIS

     - OMG

     - NIST

     - MITRE

     - 3GPP

     explicitly, or we should leave to the WG after its formation is
     approved to

     Regards,

     Dan

         -----Original Message-----

         To: Romascanu, Dan (Dan)

         Cc: [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>; Adam
         Montville; Stephen Hanna; Moriarty,

         Kathleen; [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

         interested in knowing.

         spt

         relationships.

         >> From:[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

         >> To:[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

         >>[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

         >>[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

         >[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

     sacm mailing list

     [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

     sacm mailing list

     [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

     ...

     sacm mailing list

     [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

---

From: <[email-masked]>
Date: Wed, 26 Jun 2013 12:18:58 +0000

It should also be noted that NIST and MITRE have been participating in the SACM side meetings and BoFs and have expressed interest in participating in SACM once the working group is formed.

Kent Landfield

From: <Landfield>, Kent Landfield <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, June 26, 2013 2:10 PM
To: Sean Turner <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] sacm charter review

     - ISO/IEC
     - NIST
     - MITRE

Kent Landfield

More inline.

OLD:

NEW:

OLD:

NEW:

OLD:

NEW:

Regards,

Dan

Mike

*Kent Landfield*

     Hi David,

     I respectfully disagree.

     Regards,

     Adam

     Wow!

     David Harrington

     +1-603-828-1401

     -----Original Message-----

     Romascanu, Dan (Dan)

     To: Sean Turner

     Hi Sean,

     discussion includes:

     - TCG

     - DMTF

     - FIRST

     - The Open Group

     - ISO/IEC

     - W3C

     - OASIS

     - OMG

     - NIST

     - MITRE

     - 3GPP

     Regards,

     Dan

         -----Original Message-----

         To: Romascanu, Dan (Dan)

         interested in knowing.

         spt

         relationships.

     sacm mailing list

     sacm mailing list

     ...

     sacm mailing list

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 26 Jun 2013 08:23:07 -0400

We may want to bring in updates of the existing NEA protocols and/or new work created within the TCG.  We may also want to consider O-ACEML from the OpenGroup. These have been discussed as options on the list and during the BoFs.

Dave

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, June 26, 2013 8:11 AM
To: [email-masked]; [email-masked]
Subject: Re: [sacm] sacm charter review

     - ISO/IEC
     - NIST
     - MITRE

Kent Landfield

More inline.

OLD:

NEW:

OLD:

NEW:

OLD:

NEW:

Regards,

Dan

Mike

*Kent Landfield*

*From: *Adam Montville <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]><mailto:[email-masked]%3e>>
*Date: *Tuesday, June 25, 2013 5:15 PM
*To: *David Harrington <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]><mailto:[email-masked]%3e>>, Sean Turner <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]><mailto:[email-masked]%3e>>, "[email-masked]<mailto:[email-masked]> <mailto:[email-masked]><mailto:[email-masked]%3e>"
<[email-masked]<mailto:[email-masked]> <mailto:[email-masked]><mailto:[email-masked]%3e>>
*Subject: *Re: [sacm] sacm charter review

     Hi David,

     I respectfully disagree.

     Regards,

     Adam

     From: [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>
     [[email-masked]<mailto:[email-masked]> <mailto:[email-masked]><mailto:[email-masked]%3e>] on behalf of
     David Harrington [[email-masked]<mailto:[email-masked]>
     <mailto:[email-masked]><mailto:[email-masked]%3e>]

     Wow!

     David Harrington

     +1-603-828-1401

     -----Original Message-----

     Romascanu, Dan (Dan)

     To: Sean Turner

     Hi Sean,

     discussion includes:

     - TCG

     - DMTF

     - FIRST

     - The Open Group

     - ISO/IEC

     - W3C

     - OASIS

     - OMG

     - NIST

     - MITRE

     - 3GPP

     Regards,

     Dan

         -----Original Message-----

         To: Romascanu, Dan (Dan)

         interested in knowing.

         spt

         relationships.

     sacm mailing list

     sacm mailing list

     ...

     sacm mailing list

---

From: <[email-masked]>
Date: Wed, 26 Jun 2013 12:44:41 +0000

Hi Dave,

I assumed that MILE and NEA were already identified from charter references and was looking at only organizations external to the IETF. Individuals from the organizations I listed either are or have had active discussions to contribute to the proposed WG.  I am not sure initially we are talking about TCG related work. Yes, it could be possible but that is up to the TCG to contribute their work into the group as a proposal. Same for O-ACEML. Those proposals need to fit the proposed charter and be made to the working group itself.  If they are making proposals for work items to the SACM WG then they would be following the IETF IPR rules for documents contributed. The key here is that the work would be done in SACM and should not be duplicating work elsewhere.

I guess I need clarity from Sean.  I was looking at what organizations would be directly working with the SACM initially. Liaison or otherwise. I fully expect we would invite others to participate in SACM.  I personally plan on trying to assure all are aware of the SACM efforts and goals.  Developing a list of who to invite is different from the perspective I responded with.

Kent Landfield

From: <Waltermire>, David Waltermire <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, June 26, 2013 2:23 PM
To: Kent Landfield <[email-masked]<mailto:[email-masked]>>, Sean Turner <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: [sacm] sacm charter review

Dave

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, June 26, 2013 8:11 AM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] sacm charter review

     - ISO/IEC
     - NIST
     - MITRE

Kent Landfield

More inline.

OLD:

NEW:

OLD:

NEW:

OLD:

NEW:

Regards,

Dan

Mike

*Kent Landfield*

     Hi David,

     I respectfully disagree.

     Regards,

     Adam

     Wow!

     David Harrington

     +1-603-828-1401

     -----Original Message-----

     Romascanu, Dan (Dan)

     To: Sean Turner

     Hi Sean,

     discussion includes:

     - TCG

     - DMTF

     - FIRST

     - The Open Group

     - ISO/IEC

     - W3C

     - OASIS

     - OMG

     - NIST

     - MITRE

     - 3GPP

     Regards,

     Dan

         -----Original Message-----

         To: Romascanu, Dan (Dan)

         interested in knowing.

         spt

         relationships.

     sacm mailing list

     sacm mailing list

     ...

     sacm mailing list

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 26 Jun 2013 09:02:06 -0400

I mentioned this work because it does align with some of the tentative requirements and use cases that have been floated.  There is a potential for liaison with these orgs. Even for the NIST and MITRE work, we have options to reference it in place or bring the work in.  You could say the same thing for TCG and OpenGroup efforts.  It is too early to decide one way or another right now as we still have work to do on the use cases, requirements, and architecture documents. The determining factor will be if changes need to be made to the existing work and if the orgs are willing to make a contribution. If it is referenced, this will drive the liaison decision. If the work needs to brought in, then all of what you said about IPR would apply.

Dave

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, June 26, 2013 8:45 AM
To: Waltermire, David A.; [email-masked]; [email-masked]
Subject: Re: [sacm] sacm charter review

Hi Dave,

Kent Landfield

Dave

     - ISO/IEC
     - NIST
     - MITRE

Kent Landfield

More inline.

OLD:

NEW:

OLD:

NEW:

OLD:

NEW:

Regards,

Dan

Mike

*Kent Landfield*

     Hi David,

     I respectfully disagree.

     Regards,

     Adam

     Wow!

     David Harrington

     +1-603-828-1401

     -----Original Message-----

     Romascanu, Dan (Dan)

     To: Sean Turner

     Hi Sean,

     discussion includes:

     - TCG

     - DMTF

     - FIRST

     - The Open Group

     - ISO/IEC

     - W3C

     - OASIS

     - OMG

     - NIST

     - MITRE

     - 3GPP

     Regards,

     Dan

         -----Original Message-----

         To: Romascanu, Dan (Dan)

         interested in knowing.

         spt

         relationships.

     sacm mailing list

     sacm mailing list

     ...

     sacm mailing list

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 26 Jun 2013 09:10:51 -0400

The list is getting back to the one Dan provided.  I think DMTF will be necessary to reference the Common Information Model (CIM) as well.

Best regards,
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Waltermire, David A. [[email-masked]]
Sent: Wednesday, June 26, 2013 9:02 AM
To: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] sacm charter review

Dave

Hi Dave,

Kent Landfield

Dave

     - ISO/IEC
     - NIST
     - MITRE

Kent Landfield

More inline.

OLD:

NEW:

OLD:

NEW:

OLD:

NEW:

Regards,

Dan

Mike

*Kent Landfield*

     Hi David,

     I respectfully disagree.

     Regards,

     Adam

     Wow!

     David Harrington

     +1-603-828-1401

     -----Original Message-----

     Romascanu, Dan (Dan)

     To: Sean Turner

     Hi Sean,

     discussion includes:

     - TCG

     - DMTF

     - FIRST

     - The Open Group

     - ISO/IEC

     - W3C

     - OASIS

     - OMG

     - NIST

     - MITRE

     - 3GPP

     Regards,

     Dan

         -----Original Message-----

         To: Romascanu, Dan (Dan)

         interested in knowing.

         spt

         relationships.

     sacm mailing list

     sacm mailing list

     ...

     sacm mailing list

---

From: Sean Turner <[email-masked]>
Date: Wed, 26 Jun 2013 09:19:05 -0400

I'm shooting for some examples of folks we'll be dealing with to do the 
work as currently scoped.  I'll see if I can't propose some words for 
the ADs.

spt

On 6/26/13 8:44 AM, [email-masked] wrote:
> Hi Dave,
>
> I assumed that MILE and NEA were already identified from charter
> references and was looking at only organizations external to the IETF.
> Individuals from the organizations I listed either are or have had
> active discussions to contribute to the proposed WG.  I am not sure
> initially we are talking about TCG related work. Yes, it could be
> possible but that is up to the TCG to contribute their work into the
> group as a proposal. Same for O-ACEML. Those proposals need to fit the
> proposed charter and be made to the working group itself.  If they are
> making proposals for work items to the SACM WG then they would be
> following the IETF IPR rules for documents contributed. The key here is
> that the work would be done in SACM and should not be duplicating work
> elsewhere.
>
> I guess I need clarity from Sean.  I was looking at what organizations
> would be directly working with the SACM initially. Liaison or otherwise.
> I fully expect we would invite others to participate in SACM.  I
> personally plan on trying to assure all are aware of the SACM efforts
> and goals.  Developing a list of who to invite is different from the
> perspective I responded with.
>
> *Kent Landfield*
>
> To: Kent Landfield <[email-masked]
> <mailto:[email-masked]>>, Sean Turner <[email-masked]
>     We may want to bring in updates of the existing NEA protocols and/or
>     new work created within the TCG.  We may also want to consider
>     O-ACEML from the OpenGroup. These have been discussed as options on
>     the list and during the BoFs.
>
>     Dave
>
>     [mailto:[email-masked]] *On Behalf Of
>     [email-masked] <mailto:[email-masked]>
>     *Sent:* Wednesday, June 26, 2013 8:11 AM
>     *To:* [email-masked] <mailto:[email-masked]>; [email-masked]
>     <mailto:[email-masked]>
>     *From: *Sean Turner <[email-masked] <mailto:[email-masked]>>
>     *Date: *Wednesday, June 26, 2013 1:56 PM
>     *To: *"[email-masked] <mailto:[email-masked]>" <[email-masked]
>     <mailto:[email-masked]>>
>         communicate
>             *From:[email-masked] <mailto:[email-masked]>
>             [mailto:[email-masked]] *On Behalf
>
>             Of *Michael Hammer
>
>             *To:* [email-masked]
>             <mailto:[email-masked]>;
>             [email-masked]
>             <mailto:[email-masked]>;
>
>             [email-masked] <mailto:[email-masked]>;
>             [email-masked] <mailto:[email-masked]>; [email-masked]
>             <mailto:[email-masked]>
>
>             *From:[email-masked] <mailto:[email-masked]>
>             <mailto:[email-masked]>
>
>             [mailto:[email-masked]] *On Behalf Of
>             [email-masked] <mailto:[email-masked]>
>
>             <mailto:[email-masked]>
>
>             <mailto:[email-masked]>;
>             <mailto:[email-masked]>
>
>             <mailto:[email-masked]>; [email-masked]
>             <mailto:[email-masked]> <mailto:[email-masked]>
>
>             <mailto:[email-masked]>
>
>             <mailto:[email-masked]>
>             <mailto:[email-masked]%3e>>
>
>             <mailto:[email-masked]>
>
>             <mailto:[email-masked]>
>             <mailto:[email-masked]%3e>>, Sean Turner
>             <[email-masked] <mailto:[email-masked]>
>
>             <mailto:[email-masked]> <mailto:[email-masked]%3e>>,
>             "[email-masked] <mailto:[email-masked]> <mailto:[email-masked]>
>             <mailto:[email-masked]%3e>"
>
>             <[email-masked] <mailto:[email-masked]> <mailto:[email-masked]>
>             <mailto:[email-masked]%3e>>
>
>                   From: [email-masked]
>             <mailto:[email-masked]> <mailto:[email-masked]>
>
>                   [[email-masked] <mailto:[email-masked]>
>             <mailto:[email-masked]>
>             <mailto:[email-masked]%3e>] on behalf of
>
>             <mailto:[email-masked]>
>
>             <mailto:[email-masked]> <mailto:[email-masked]>
>
>             <mailto:[email-masked]>
>
>                   +1-603-828-1401
>
>                   From: [email-masked]
>             <mailto:[email-masked]> <mailto:[email-masked]>
>
>             <mailto:[email-masked]>
>
>                       Cc: [email-masked] <mailto:[email-masked]>
>             <mailto:[email-masked]>; Adam
>
>             <mailto:[email-masked]>
>                       >> From:[email-masked]
>             <mailto:[email-masked]> <mailto:[email-masked]>
>
>                       >> To:[email-masked]
>             <mailto:[email-masked]> <mailto:[email-masked]>
>
>             <mailto:[email-masked]>
>             <mailto:[email-masked]>
>             <mailto:[email-masked]>
>             [email-masked] <mailto:[email-masked]> <mailto:[email-masked]>
>
>             [email-masked] <mailto:[email-masked]> <mailto:[email-masked]>
>
>             [email-masked] <mailto:[email-masked]> <mailto:[email-masked]>
>

---

From: Sean Turner <[email-masked]>
Date: Wed, 26 Jun 2013 09:30:27 -0400

Dave,

I gotta admit that I loathe the idea of shipping liaison around to NIST ;)

spt

On 6/26/13 9:02 AM, Waltermire, David A. wrote:
> I mentioned this work because it does align with some of the tentative
> requirements and use cases that have been floated.  There is a potential
> for liaison with these orgs. Even for the NIST and MITRE work, we have
> options to reference it in place or bring the work in.  You could say
> the same thing for TCG and OpenGroup efforts.  It is too early to decide
> one way or another right now as we still have work to do on the use
> cases, requirements, and architecture documents. The determining factor
> will be if changes need to be made to the existing work and if the orgs
> are willing to make a contribution. If it is referenced, this will drive
> the liaison decision. If the work needs to brought in, then all of what
> you said about IPR would apply.
>
> Dave
>
> Of [email-masked]
> *Sent:* Wednesday, June 26, 2013 8:45 AM
> *To:* Waltermire, David A.; [email-masked]; [email-masked]
> *From: *<Waltermire>, David Waltermire <[email-masked]
> <mailto:[email-masked]>>
> *Date: *Wednesday, June 26, 2013 2:23 PM
> *To: *Kent Landfield <[email-masked]
> *Subject: *RE: [sacm] sacm charter review
>
>             <mailto:[email-masked]%3e>]
>

---

From: Stephen Hanna <[email-masked]>
Date: Wed, 26 Jun 2013 13:53:15 +0000

TCG has eight years of experience developing widely deployed endpoint assessment protocols and a proven track record of contributing our protocols to IETF under the IETF's standard terms. For example, we contributed the TNC client-server protocols to IETF as Internet-Drafts. They have been adopted by the NEA working group, revised, and published as Proposed Standard RFCs. The TCG standards are very relevant to the SACM work, even beyond the NEA specs. For example, IF-MAP is an excellent protocol for gathering endpoint assessment results across a variety of endpoint assessment technologies. Also, TCG has been represented in the SACM work since the very start.

I believe that TCG should stand on equal footing with NIST and MITRE in this matter.

Thanks,

Steve

From: [email-masked] [mailto:[email-masked]] On Behalf Of Waltermire, David A.
Sent: Wednesday, June 26, 2013 9:02 AM
To: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] sacm charter review

Dave

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, June 26, 2013 8:45 AM
To: Waltermire, David A.; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] sacm charter review

Hi Dave,

Kent Landfield

Dave

     - ISO/IEC
     - NIST
     - MITRE

Kent Landfield

More inline.

OLD:

NEW:

OLD:

NEW:

OLD:

NEW:

Regards,

Dan

Mike

*Kent Landfield*

     Hi David,

     I respectfully disagree.

     Regards,

     Adam

     Wow!

     David Harrington

     +1-603-828-1401

     -----Original Message-----

     Romascanu, Dan (Dan)

     To: Sean Turner

     Hi Sean,

     discussion includes:

     - TCG

     - DMTF

     - FIRST

     - The Open Group

     - ISO/IEC

     - W3C

     - OASIS

     - OMG

     - NIST

     - MITRE

     - 3GPP

     Regards,

     Dan

         -----Original Message-----

         To: Romascanu, Dan (Dan)

         interested in knowing.

         spt

         relationships.

     sacm mailing list

     sacm mailing list

     ...

     sacm mailing list

---

From: Sean Turner <[email-masked]>
Date: Wed, 26 Jun 2013 10:23:09 -0400

Everybody is going to be on equal footing when we start.  We're going to 
do use cases, requirements, and architecture and then figure out what 
makes sense to use, modify, or develop.

spt

On 6/26/13 9:53 AM, Stephen Hanna wrote:
> TCG has eight years of experience developing widely deployed endpoint
> assessment protocols and a proven track record of contributing our
> protocols to IETF under the IETF’s standard terms. For example, we
> contributed the TNC client-server protocols to IETF as Internet-Drafts.
> They have been adopted by the NEA working group, revised, and published
> as Proposed Standard RFCs. The TCG standards are very relevant to the
> SACM work, even beyond the NEA specs. For example, IF-MAP is an
> excellent protocol for gathering endpoint assessment results across a
> variety of endpoint assessment technologies. Also, TCG has been
> represented in the SACM work since the very start.
>
> Of *Waltermire, David A.
> *Sent:* Wednesday, June 26, 2013 9:02 AM
> *To:* [email-masked]; [email-masked]; [email-masked]
> *To:* Waltermire, David A.; [email-masked] <mailto:[email-masked]>;

---

From: Adam Montville <[email-masked]>
Date: Wed, 26 Jun 2013 15:14:09 +0000

Has the original ask from Sean been addressed (whittle down the list)?  

Here's the way I see it...which could be off the wall.

The sole focus of the WG, if established, would be to focus on the narrowed cases we've previously discussed, which is essentially how do we cart around data formats that already exist and how do we improve those data formats.

The data formats come from few places, really: NIST, MITRE, FIRST.  Novel work in the area of protocols for carting data formats around will come from the established WG and other IETF work (i.e. MILE, NEA).

To me, this is the primary area of focus - we need to solve these "base cases" before we can reasonably consider doing anything more advanced.

So, to address what might be the blocking concern, can we agree on an initial, non-IETF list of: NIST, MITRE, and FIRST?  This with the understanding that most, if not all, of that work can be referenced and/or brought into the established WG "free and clear" of IPR issues.  For example, I imagine Asset Identification can be brought in without liaison relationships being required.

I know that this can be an uncomfortable discussion, but it's one that seems required to get the WG established.  The fact that we're blocked right now doesn't concern me as much given the nature of the blocking comment, which indicates that a real-time discussion is needed during the 6/27 call.  Looking at this effort from the outside, I would probably want that as well.

Adam

________________________________________
From: [email-masked] [[email-masked]] on behalf of Sean Turner [[email-masked]]
Sent: Wednesday, June 26, 2013 7:23 AM
To: Stephen Hanna
Cc: Waltermire, David A.; [email-masked]; [email-masked]
Subject: Re: [sacm] sacm charter review

spt

...

---

From: Stephen Hanna <[email-masked]>
Date: Thu, 27 Jun 2013 06:07:08 +0000

Coming up with a short list of people from whom we expect
to receive proposals smacks of favoritism and is contrary
to the IETF's tradition of selecting the best technology
for the job. Fortunately, Sean has assured us that this
approach will not be used. We'll decide on our use cases,
requirements, and architecture. Only then will we move on
to identifying the best solutions.

Thanks,

Steve

> From: Adam Montville [mailto:[email-masked]]
> Sent: Wednesday, June 26, 2013 11:14 AM
> To: Sean Turner; Stephen Hanna
> The sole focus of the WG, if established, would be to focus on the
> narrowed cases we've previously discussed, which is essentially how do
> we cart around data formats that already exist and how do we improve
> those data formats.
> 
> The data formats come from few places, really: NIST, MITRE, FIRST.
> Novel work in the area of protocols for carting data formats around
> will come from the established WG and other IETF work (i.e. MILE, NEA).
> 
> To me, this is the primary area of focus - we need to solve these "base
> cases" before we can reasonably consider doing anything more advanced.
> 
> So, to address what might be the blocking concern, can we agree on an
> initial, non-IETF list of: NIST, MITRE, and FIRST?  This with the
> understanding that most, if not all, of that work can be referenced
> and/or brought into the established WG "free and clear" of IPR issues.
> For example, I imagine Asset Identification can be brought in without
> liaison relationships being required.
> 
> I know that this can be an uncomfortable discussion, but it's one that
> seems required to get the WG established.  The fact that we're blocked
> right now doesn't concern me as much given the nature of the blocking
> comment, which indicates that a real-time discussion is needed during
> the 6/27 call.  Looking at this effort from the outside, I would
> probably want that as well.
> 
> Adam
> 
> 
> > protocols to IETF under the IETF's standard terms. For example, we
> > I believe that TCG should stand on equal footing with NIST and MITRE
> in
> > this matter.
> >
> > Thanks,
> >
> > Steve
> >
> >         It looks like Joel wants to know now some of the
> organizations
> >         (i.e.,
> >
> >         there's block on the charter).  Can we whittle this list down
> to
> >         just
> >
> >         orgs we're going to be dealing with at the initial stages?
> For
> >         asset
> >
> >             Yes. The fact that other organizations are interested in
> the
> >             scope of
> >
> >             SACM does not mean that they do the same work, and
> certainly
> >             the future
> >
> >             Internet-Draft which will document existing work in the
> IETF
> >             or in other
> >
> >             SDOs
> >
> >             SACM requirements. The working group may decide to make
> of
> >             this document an
> >
> >             Internet-Draft which will document existing work in the
> IETF
> >             or in other
> >
> >             SDOs
> >
> >             SACM requirements. The working group may decide to refer
> or
> >             document
> >
> >             these in
> >
> >             will not duplicate work already done or in progress in
> other
> >             places.
> >
> >         Internet-Draft which will document existing work in the IETF
> or
> >         in other
> >
> >         The working group will create an Internet-Draft documenting
> the
> >         existing
> >
> <mailto:[email-masked]>;
> >             +1  This just means many groups are interested in the
> same
> >             scope.
> >
> >             Mike
> >
> >                   In fact, it might be more properly construed that
> this
> >             list of
> >
> >                   organizations is a commentary on the ubiquitous
> nature
> >             of assessment
> >
> >                   - it is a capability that "touches" a lot of
> different
> >             areas, which
> >
> >                   I think this is an excellent commentary on the
> scope
> >             of SACM being
> >
> >                   way too
> >
> >                   A list of organizations that are involved in the
> area,
> >             as identified
> >
> >                   in this
> >
> >                   discussion includes:
> >
> >                   - TCG
> >
> >                   - DMTF
> >
> >                   - FIRST
> >
> >                   - The Open Group
> >
> >                   - ISO/IEC
> >
> >                   - W3C
> >
> >                   - OASIS
> >
> >                   - OMG
> >
> >                   - NIST
> >
> >                   - MITRE
> >
> >                   - 3GPP
> >
> >                   It's up to the IESG to decide if we should list
> these
> >             (or some of them)
> >
> >                       I'm not sure if they want names in the charter
> or
> >             if they're just
> >
> >                       interested in knowing.
> >
> >                       spt
> >
> >                       >> In accordance with existing IETF processes,
> the
> >             group will
> >
> >                       >> communicate with and
> >
> >                       > regulatory organizations, and if necessary
> reuse
> >             existing liaison
> >
> >                       > 'standard bodies and regulatory
> organizations'
> >             are neutral terms
> >
> >                       enough IMO, as Sean says we should not enter
> the
> >             'what is an SDO
> >
> >                       dispute'. We are dealing not only with
> standards
> >             organizations and
> >
> >                       >>> Pathetically, the old SDO club still does
> not
> >             regard the IETF as a
> >
> >                       >>> "SDO!"
> >
> >
> >
> "standards
> >             fora."
> >                       >>>> There are a variety of other SDOs in which
> we
> >             could be interested
> >
> >                       >>>> * W3C (i.e. obvious things like XML
> DigSig,
> >             and potentially less
> >
> >                       >>>> * OMG (i.e. Business Process Model
> Notation
> >             and/or Execution
> >
> >                       >>>> Language,
> >
> >                       >>>> etc.)
> >
> >                       >>>
> >
> >                       >>>
> >
> >                       >>
> >                   information.  If it appears that this message was
> sent
> >             to you by
> >
> >                   mistake, any retention, dissemination, distribution
> or
> >             copying of
> >
> This message and attachments may contain confidential information.  If
> it appears that this message was sent to you by mistake, any retention,
> dissemination, distribution or copying of this message and attachments
> is strictly prohibited.  Please notify the sender immediately and
> permanently delete the message and any attachments.
>