Subject: [sacm] sacm participation and scope

From: "David Harrington" <[email-masked]>
Date: Mon, 3 Jun 2013 13:20:25 -0400

Hi,

There appear to be about 6 people active on the ML: 2 authors discussing
their drafts, 2 chairs acting administratively (but not much technical
discussion), one contributor who chairs a related WG, and myself. 

That wouldn't pass my AD test that there needs to be a significant community
that believes there is a problem that needs solving.
Where are the representatives from the Security area? Where are the IPsec
and  TLS and SSH and Kerberos and PKI WG experts?
Where are the representatives from the Security products industry? Where are
the firewall and IDS and DPI vendor experts?
Where are the representatives from the OPS(NM) area? Where are the Netconf,
ipfix, syslog, snmp guys? (well, I guess you can count me but that's not
many).
Where are the representatives from the AAA community? Radius? Diameter?
Where are the representatives from the config automation community? DHCP,
NACP, homenet, 
Where are the representatives from the OPS(OPS) area? Where are the
operators, and the enterprise/ISP security admins? Opsec? V6ops?
Where are the representatives from the OPS(OPS) area? Where are the websec
and https guys? Where are the server guys?

I am concerned that the work being done so far is 30,000-foot stuff, with no
details. 
I don't know from the charter just what security we plan to automate.
I see discussions of the need for protocols and data models, but almost no
details of what specific information needs to be modeled, or the properties
of the protocols needed to transport that data, or what's going to be done
with the data.
I think our discussions are so high-level that people from other WGs cannot
tell if there is anything relevant to them in this proposed WG.

I don't think we're ready for a WG.
I think we need a much more narrow and clearly-defined scope in the charter.

My $.02

David Harrington
[email-masked]
+1-603-828-1401

---

From: Adam Montville <[email-masked]>
Date: Mon, 3 Jun 2013 19:05:28 +0000

David, I think you're asking some good, pointed questions.  And, I've been out of the loop until recently with respect to the narrowing of our scope (but I believe we're down to "basic" configuration assessment.

IIRC, the immediate purpose of this working group is to make things work between tools/implementations.  Many of the data formats that would be needed for this already exist, but, as far as automated configuration assessment is concerned for the security domain, there is little-to-no support for transporting these data formats from place to place.

I expect more of the details (i.e. will we use XCCDF in some way or point to OVAL or use SWID or leverage NEA, and so on) to be provided in our first four deliverables (use cases, requirements, architecture, and related work respectively).

During one of our BoF sessions (was it the first one?) we had a good, representative showing of people from other areas - many of those which you've mentioned.  The second BoF seemed to have the same.  I believe 16 vendors have voiced support for continuing security automation and continuous monitoring work in the IETF.  I can't speak for which other IETF WGs were represented at our BoF sessions, but I do know that there were many unfamiliar faces - a good thing.

Still, I agree with your assessment that the SACM list has not been well-traveled lately.

I don't believe I've said anything out of turn or that doesn't have some basis in truth.  I'm sure someone can put me in my place if that's the case.

Adam

________________________________________
From: [email-masked] [[email-masked]] on behalf of David Harrington [[email-masked]]
Sent: Monday, June 03, 2013 10:25 AM
To: [email-masked]
Subject: [sacm] sacm participation and scope

Hi,

My $.02

David Harrington
[email-masked]
+1-603-828-1401

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

...

This message and attachments may contain confidential information.  If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited.  Please notify the sender immediately and permanently delete the message and any attachments.

---

From: "Whitlock, Stephen" <[email-masked]>
Date: Mon, 3 Jun 2013 19:46:28 +0000

David,

While I can't answer most of your questions, I can respond a bit to the first one - as to whether or not there's a problem that needs solving.

I'm from a large organization that has a pretty complex IT infrastructure. This is complicated by an extensive supply chain that interacts via the internet.

I don't' see any way to balance this complexity and scale against an ever evolving set of threats without some form of standardization and automation that will respond in real time. Ideally deviations from standard configurations (whether by accident or intent) would result in a notification and ultimately an automatic remediation. And ultimately I would like to see this work between enterprises.

I don't think SACM is scoped to provide this whole life cycle (nor should it be) but it looks like it will provide an important piece that is missing. At this point it's a little hard for me to tell how much - and I agree with some of your comments below - but maintaining a standard configuration using vendor neutral tools & protocols is an important first step.

While I could get some of this capability from specific vendors, I work in an industry with small numbers of very large customers, a few very large suppliers, and thousands of very small suppliers. This means that there is no leverage to dictate specific IT or security products with these customers or the larger suppliers. Which means that any specific vendor products need to be connected with standard protocols and use standard data formats.

I'm not a developer and only represent one organization but I have to believe that this issue is not unique to either my industry or company. I have had some conversation with peer companies that indicate some interest although they aren't involved with the IETF - but by itself that isn't helpful when making the case for a working group.

Steve Whitlock
The Boeing Company 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of David Harrington
Sent: Monday, June 03, 2013 10:20 AM
To: [email-masked]
Subject: [sacm] sacm participation and scope

Hi,

There appear to be about 6 people active on the ML: 2 authors discussing their drafts, 2 chairs acting administratively (but not much technical discussion), one contributor who chairs a related WG, and myself. 

That wouldn't pass my AD test that there needs to be a significant community that believes there is a problem that needs solving.
Where are the representatives from the Security area? Where are the IPsec and  TLS and SSH and Kerberos and PKI WG experts?
Where are the representatives from the Security products industry? Where are the firewall and IDS and DPI vendor experts?
Where are the representatives from the OPS(NM) area? Where are the Netconf, ipfix, syslog, snmp guys? (well, I guess you can count me but that's not many).
Where are the representatives from the AAA community? Radius? Diameter?
Where are the representatives from the config automation community? DHCP, NACP, homenet, Where are the representatives from the OPS(OPS) area? Where are the operators, and the enterprise/ISP security admins? Opsec? V6ops?
Where are the representatives from the OPS(OPS) area? Where are the websec and https guys? Where are the server guys?

I am concerned that the work being done so far is 30,000-foot stuff, with no details. 
I don't know from the charter just what security we plan to automate.
I see discussions of the need for protocols and data models, but almost no details of what specific information needs to be modeled, or the properties of the protocols needed to transport that data, or what's going to be done with the data.
I think our discussions are so high-level that people from other WGs cannot tell if there is anything relevant to them in this proposed WG.

My $.02

David Harrington
[email-masked]
+1-603-828-1401

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 4 Jun 2013 08:47:29 +0000

Hi David,

See in-line. 

Regards,

Dan

> Sent: Monday, June 03, 2013 8:20 PM
> To: [email-masked]
> That wouldn't pass my AD test that there needs to be a significant
> community that believes there is a problem that needs solving.

I would say that the participation in the charter discussions is not the only indicator about the willingness of the community to participate in this work. 

At the second SACM BOF at IETF-86 we explicitly asked: 

------------
B. Indicate your intent to actively contribute
   to this work in IETF. (yes, no, no opinion)

Dan asked for a show of hands on this, explaining
that he means to include writing documents,
writing code, participating in prototyping,
proof of concept, interoperability testing,
providing comments and reviews that will help
progress the documents, and any combination
of those.

There were 12 hands for yes and 1 in Jabber.
--------------

I would also note that part of the participants in SACM are new to the IETF, and less experienced with the IETF process and use of the mail list.

> Where are the representatives from the Security area? Where are the
> IPsec and  TLS and SSH and Kerberos and PKI WG experts?
> Where are the representatives from the Security products industry? Where
> are the firewall and IDS and DPI vendor experts?
> Where are the representatives from the OPS(NM) area? Where are the
> Netconf, ipfix, syslog, snmp guys? (well, I guess you can count me but
> that's not many).
> Where are the representatives from the config automation community?
> DHCP, NACP, homenet, Where are the representatives from the OPS(OPS)
> area? Where are the operators, and the enterprise/ISP security admins?
> Opsec? V6ops?
> websec and https guys? Where are the server guys?
> 
[[DR]] Some of the config automation community are present and authored I-Ds. There is some participation from the OPS area if we count the two of us. A few operators attended the BOF meetings. Concerning specific WGs - RADIUS, Diameter, OPSEC, v6OPS, homenet, etc - do we need their participation? Or coordination later, if and when the WG is formed. 
 
> I see discussions of the need for protocols and data models, but almost
> no details of what specific information needs to be modeled, or the
> properties of the protocols needed to transport that data, or what's
> going to be done with the data.
> I think our discussions are so high-level that people from other WGs
> cannot tell if there is anything relevant to them in this proposed WG.
> 
[[DR]] better focus is always welcome - do you have proposals?