Subject: [sacm] Endpoint ID Design Team 2015-01-16 Notes

From: "Adam W. Montville" <[email-masked]>
Date: Fri, 16 Jan 2015 11:20:15 -0600

SACM Endpoint ID Design Team Notes
2015-01-16
==================================

Agenda:

	* Reminder: 
		- WebEx Chat and SACM Jabber Room
		- Recording will be (is) enabled
	* Note takers?
	* Craft Endpoint ID Example
	* Next Steps

Attendees:

	Adam Montville
	Carolin Latze
	Danny Haynes
	David Waltermire
	Jarrett Lu
	Jim Bieda
	Matt Hansbury
	Ron Colvin (Call-in User_5, then Call-in User_8)
	Lisa Lorenzin (Call-in User_6)
	Jessica Fitzgerald-McKay (??) (Call-in User_9)

Notes:

We were working to craft a definition for endpoint attribute assertion, with an identity assertion begin a subset thereof.

Scenarios:

	- Software on an endpoint is asserting posture attributes relating to the endpoint's software inventory and configuration (e.g., bootstrap, inventory delta)

Endpoint Identity Assertion
===========================

Attribute/value pairs (including an optional time interval value)
-----------------------------------------------------------------

	Identity Attributes:
		- Certificate(s) (e.g., device, user, drive, other hardware)
			- Device as common denominator
			- Others if available as associated with the session
		- Hostname(s) + FQDN(s), if available
		- Interface(s) - comprehensive if endpoint is reporting; limited if provided by a remote tool
			- MAC Address(es)
			- IP Address(es)
		- Other cryptographic information (e.g., IPSec Key)
		- Tool-specific identifier

	Other posture attributes:
		- Configuration data
		- Software inventory data

Temporal Data
--------------

	A timestamp indicating when the observation is made (producer)

	A timestamp indicating when the assertion was received - consumer (e.g., collector, broker, repo)
		- Think about compositional model of assertions - Asserting additional details related to another assertion

Provenance Data
---------------

	The SACM component that made the assertion
		- An assertion of the identity of the software used (e.g., vendor, product, version, etc.)
		- The instance of the software (e.g., the device the software was run on, the installation of the software) - could be an endpoint identity assertion as well - may be the same as the endpoint or different if external to the endpoint
			- Reuse the identity information from the authentication to establish the identity of the reporter.
		- Cryptographic ifnormation that can be used to authenticate the provenance assertion
		- (FOR CONTINUED DISCUSSION) Some questions on the call about if providing provenance information is required in all cases; self-reported - may/should; other-reported - must
	
	The endpoint attribute assertions (if any) on which the assertion is based
	
	Information about the method used to derive the assertion