Subject: [sacm] DMTF VMAN work as a model for SACM "Unified Method"?

From: "Natale, Bob" <[email-masked]>
Date: Fri, 28 Jun 2013 04:29:03 +0000

Concerning Kathleen's "use case", maybe something _analogous_ to the DMTF's VMAN, VMI, and OVF work...?  See http://dmtf.org/standards/vman.

Takes a bit of thought to see the parallels but, if the concept were accepted, then this DMTF work could provide a useful model for the "uniform method to set, monitor and enforce security controls across platforms and vendors" that Kathleen proposes...?

Avanti,
BobN

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Thursday, June 27, 2013 12:38 PM
To: ietfdbh
Cc: Romascanu, Dan (Dan); Sean Turner; Adam Montville; [email-masked]
Subject: Re: [sacm] Fwd: Benoit Claise's Block on charter-ietf-sacm-00-06: (with BLOCK and COMMENT)

Hi,

As for a use case and how the work is scoped down, here is an example.

Currently, security teams need to follow hardening guides and lock down system and applications on each system (or device), an image of that system, or through a vendor provided management system specific to that vendor.  The compliance and audit teams have to assess those controls, often through some manual tasks on a regular basis for all different regulations or just reporting cycles.

We would like a uniform method to set, monitor and enforce security controls across platforms and vendors.  The regulatory controls and high-level control frameworks have already been defined.  We also have guidance on what needs to be locked down on systems to meet a desired assurance level.  We have methods to configure devices (numerous ones).  We need a common way to map between these existing protocols with a common language to enable consistent monitoring and management.  We need to aggregate this data and assess the overall security state of a system as well as the network.  That's where the protocols come in to play for repositories, etc.  if we can provide the consistent capability, then vendors and security professionals can help with the per-product mappings to get us away from the manual hardening, assessment and reporting.  

I am sure there are other use cases, but thought this might be a helpful explanation.

Thanks,
Kathleen 

Sent from my iPhone

On Jun 27, 2013, at 12:17 PM, "ietfdbh" <[email-masked]> wrote:

> Hi,
> 
> I have found it difficult to suss out just what this WG plans to standardize
> for information.
> "Security automation" covers a huge scope, and despite pressing for more
> details, including to document in the use-cases document, I have been unable
> to get much of anything that better scopes the information involved.
> In my requests for use cases, I keep getting emails that say "you should
> look at the work being done in <pick their favorite> organization."
> Few have actually contributed proposals for IETF consideration, or provided
> details useable for use cases.
> 
> The information model is a major area of discussion yet to be discussed, and
> it could be contentious.
> I think the information model should be a separate document from the
> architecture.
> That helps keep each effort manageable.
> 
> David Harrington
> [email-masked]
> +1-603-828-1401
> 
> 
> 
> 
_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm