Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

From: Adam Montville <[email-masked]>
Date: Thu, 24 Mar 2016 11:09:02 -0500

Did anyone see this original note?

> On Mar 9, 2016, at 2:06 PM, Adam Montville <[email-masked]> wrote:
> 
> All:
> 
> This messages serves as a consensus call to adopt the SACM Vulnerability Assessment Scenario draft: https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/ <https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/>
> 
> Please opine no later than 23:59 UTC on March 16.
> 
> Kind regards,
> 
> Adam

---

From: Adam Montville <[email-masked]>
Date: Thu, 24 Mar 2016 12:58:39 -0500

Because the original message didn’t seem to make it to the list, let’s set this up again and hope it takes.  

Please opine no later than 23:59 UTC on March 31.

> On Mar 24, 2016, at 11:09 AM, Adam Montville <[email-masked]> wrote:
> 
>> On Mar 9, 2016, at 2:06 PM, Adam Montville <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> All:
>>

---

From: Adam Montville <[email-masked]>
Date: Mon, 28 Mar 2016 16:43:25 -0500

REMINDER

If you believe that the vulnerability assessment scenario is a worthwhile draft for this WG to adopt, please respond to this adoption call.  If you do not believe as such, please respond with explanation.  

We cannot work on this draft without first adopting it as a working group.

As contributor: I would like to see the WG adopt this draft.

As an aside: We have had positive discussions about adopting this draft in more than one WG meeting, so I am surprised to see this lack of response.  If anyone has responded and has not seen their response come across the archive (https://mailarchive.ietf.org/arch/search/?email_list=sacm <https://mailarchive.ietf.org/arch/search/?email_list=sacm>) please reach out to me directly.

Kind regards,

Adam

> On Mar 24, 2016, at 12:58 PM, Adam Montville <[email-masked]> wrote:
> 
>> On Mar 24, 2016, at 11:09 AM, Adam Montville <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: "Booth, Harold (Fed)" <[email-masked]>
Date: Mon, 28 Mar 2016 22:07:26 +0000

I would like to see the vulnerability assessment scenario to be adopted in the working group. I see the data contained within the National Vulnerability Database (NVD), for which I am the project lead, as eventual input into the assessment scenario once a suitable vulnerability description model has been developed.

-Harold

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Monday, March 28, 2016 5:43 PM
To: <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

As an aside: We have had positive discussions about adopting this draft in more than one WG meeting, so I am surprised to see this lack of response.  If anyone has responded and has not seen their response come across the archive (https://mailarchive.ietf.org/arch/search/?email_list=sacm) please reach out to me directly.

Kind regards,

Adam

On Mar 24, 2016, at 12:58 PM, Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:

On Mar 24, 2016, at 11:09 AM, Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:

On Mar 9, 2016, at 2:06 PM, Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:

All:

This messages serves as a consensus call to adopt the SACM Vulnerability Assessment Scenario draft: https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/

Kind regards,

Adam

---

From: "Landfield, Kent B" <[email-masked]>
Date: Mon, 28 Mar 2016 22:14:51 +0000

I would like to see the working group accept this draft as a WG document.
---
Kent Landfield
+1.817.637.8026

From: sacm <[email-masked]<mailto:[email-masked]>> on behalf of Adam Montville <[email-masked]<mailto:[email-masked]>>
Date: Monday, March 28, 2016 at 4:43 PM
To: "<[email-masked]<mailto:[email-masked]>>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

Kind regards,

Adam

All:

Kind regards,

Adam

---

From: Gunnar Engelbach <[email-masked]>
Date: Mon, 28 Mar 2016 18:38:01 -0400

Why yes, adopt this fella.

On 3/24/2016 1:58 PM, Adam Montville wrote:
>> On Mar 24, 2016, at 11:09 AM, Adam Montville 
>> <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>> On Mar 9, 2016, at 2:06 PM, Adam Montville 
>>> <[email-masked] <mailto:[email-masked]>> wrote:
>>>
>>> All:
>>>
>>> This messages serves as a consensus call to adopt the SACM 
>>> Vulnerability Assessment Scenario draft: 
>>> https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
>>>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 28 Mar 2016 16:13:26 -0700

I am agnostic as I do not believe I would have any significant input for this draft.

Jim

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Monday, March 28, 2016 2:43 PM
To: <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

Kind regards,

Adam

On Mar 24, 2016, at 12:58 PM, Adam Montville <[email-masked] <mailto:[email-masked]> > wrote:

 

On Mar 24, 2016, at 11:09 AM, Adam Montville <[email-masked] <mailto:[email-masked]> > wrote:

On Mar 9, 2016, at 2:06 PM, Adam Montville <[email-masked] <mailto:[email-masked]> > wrote:

All:

Kind regards,

Adam

---

From: Steve Klos <[email-masked]>
Date: Mon, 28 Mar 2016 23:29:55 +0000

I would like to see this WG adopt this draft.

Regards,

Steve Klos

From: Adam Montville [mailto:[email-masked]]
Sent: Monday, March 28, 2016 2:43 PM
To: <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

Kind regards,

Adam

All:

Kind regards,

Adam

---

From: Michael Godsey <[email-masked]>
Date: Mon, 28 Mar 2016 23:59:11 +0000

I too would like to see this WG adopt this draft.

-        Mike Godsey

From: sacm [mailto:[email-masked]] On Behalf Of Steve Klos
Sent: Monday, March 28, 2016 4:30 PM
To: <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

Regards,

Steve Klos

From: Adam Montville [mailto:[email-masked]]
Sent: Monday, March 28, 2016 2:43 PM
To: <[email-masked]<mailto:[email-masked]>> <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

Kind regards,

Adam

All:

Kind regards,

Adam

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 29 Mar 2016 09:35:46 +0000

I support adoption of this I-D as WG item.

(sorry if this is a duplicate)

Regards,

Dan

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Tuesday, March 29, 2016 12:43 AM
To: <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

As an aside: We have had positive discussions about adopting this draft in more than one WG meeting, so I am surprised to see this lack of response.  If anyone has responded and has not seen their response come across the archive (https://mailarchive.ietf.org/arch/search/?email_list=sacm<https://urldefense.proofpoint.com/v2/url?u=https-3A__mailarchive.ietf.org_arch_search_-3Femail-5Flist-3Dsacm&d=BQMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=1YgIcVufuf44a_yM2_VC-dnDr5593uXp61b52C9Vvqg&s=GwqSSFCrzBZlCIEXtxfVbExS76VBkgbBlIOBSYBUOIU&e=>) please reach out to me directly.

Kind regards,

Adam

All:

This messages serves as a consensus call to adopt the SACM Vulnerability Assessment Scenario draft: https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dcoffin-2Dsacm-2Dvuln-2Dscenario_&d=BQMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=1YgIcVufuf44a_yM2_VC-dnDr5593uXp61b52C9Vvqg&s=qBGFB8QFNOV_iekRdDihTPVFvu8i2prGeczVq84qJjc&e=>

Kind regards,

Adam

---

From: Lisa Lorenzin <[email-masked]>
Date: Tue, 29 Mar 2016 13:20:45 +0000

+1

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Landfield, Kent B
Sent: Monday, March 28, 2016 6:15 PM
To: Adam Montville <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

Kind regards,

Adam

All:

Kind regards,

Adam

---

From: "Stevens, Josh (Cyber Security)" <[email-masked]>
Date: Tue, 29 Mar 2016 14:41:17 +0000

Josh Stevens

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Lisa Lorenzin
Sent: Tuesday, March 29, 2016 8:21 AM
To: <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

+1

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Landfield, Kent B
Sent: Monday, March 28, 2016 6:15 PM
To: Adam Montville <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

Kind regards,

Adam

All:

Kind regards,

Adam

---

From: "Richard P. Adams" <[email-masked]>
Date: Tue, 29 Mar 2016 10:58:24 -0400

Although I haven’t been very vocal on this list since it started up, I would like to see this adopted.  +1

Thanks.

Richee

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: March-28-16 5:43 PM
To: <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

Kind regards,

Adam

 

All:

Kind regards,

Adam

---

From: Ira McDonald <[email-masked]>
Date: Tue, 29 Mar 2016 11:38:09 -0400

Hi,

+1

Cheers,
- Ira

On Thu, Mar 24, 2016 at 12:09 PM, Adam Montville <[email-masked]
> wrote:

> This messages serves as a consensus call to adopt the SACM Vulnerability
> Assessment Scenario draft:

---

From: "Jim Bieda (jbieda)" <[email-masked]>
Date: Tue, 29 Mar 2016 16:38:36 +0000

I’m OK with adoption.  One question:  There is a ***TODO …*** in Section 8.  Security Considerations.  Should that get fixed prior to adoption?

Thanks, Jim

From: sacm <[email-masked]<mailto:[email-masked]>> on behalf of Adam Montville <[email-masked]<mailto:[email-masked]>>
Date: Monday, March 28, 2016 at 2:43 PM
To: "<[email-masked]<mailto:[email-masked]>>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER

Kind regards,

Adam

All:

Kind regards,

Adam

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 29 Mar 2016 18:01:39 +0000

Hi Jim,

After a quick review of that section, that text was added based on mailing list feedback.  Specifically, the feedback stated we should mention that the vulnerability description data contains very sensitive information and should be protected.  Given that we addressed the feedback in the revised text, I think we can just remove the “TODO” in the next revision of the document.

   This document provides a core narrative that walks through an
   automated enterprise vulnerability assessment scenario and is aligned
   with SACM "Endpoint Security Posture Assessment: Enterprise Use
   Cases" [RFC7632].  As a result, the security considerations for
   [RFC7632] apply to this document.  Furthermore, the vulnerability
   description data may provide attackers with useful information such
   as what software an enterprise is running on their endpoints.  As a
   result, organizations should properly protect the vulnerability
   description data it ingests.***TODO IS THIS COVERED BY RFC7632???***

Sorry for missing that.

Thanks,

Danny

From: sacm [mailto:[email-masked]] On Behalf Of Jim Bieda (jbieda)
Sent: Tuesday, March 29, 2016 12:39 PM
To: Adam Montville <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

Thanks, Jim

REMINDER

Kind regards,

Adam

All:

Kind regards,

Adam

---

From: Lisa Lorenzin <[email-masked]>
Date: Tue, 29 Mar 2016 18:27:18 +0000

Hi Jim,

My personal understanding - which is limited, since this is the only WG in which I've been an active participant! - is that WG adoption simply means we will continue to develop the draft as a formal WG draft, rather than an individual submission, and that there is no requirement that all TODO be addressed before WG adoption.  (For example, the architecture draft was adopted as a WG draft with significant TODO items.)

I'm sure someone with more IETF experience will correct me if I'm wrong here!

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Jim Bieda (jbieda)
Sent: Tuesday, March 29, 2016 12:39 PM
To: Adam Montville <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

Thanks, Jim

From: sacm <[email-masked] <mailto:[email-masked]> > on behalf of Adam Montville <[email-masked] <mailto:[email-masked]> >
Date: Monday, March 28, 2016 at 2:43 PM
To: "<[email-masked] <mailto:[email-masked]> >" <[email-masked] <mailto:[email-masked]> >
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

REMINDER 

Kind regards,

Adam

			All: 

			Kind regards,

			Adam

---

From: "Jim Bieda (jbieda)" <[email-masked]>
Date: Tue, 29 Mar 2016 19:23:22 +0000

Hi Danny,

Yeah, it looked purely cosmetic to me – not a reflection on the substance of the section.

Thanks!
Jim

From: "Haynes, Dan" <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 29, 2016 at 11:01 AM
To: jbieda <[email-masked]<mailto:[email-masked]>>, Adam Montville <[email-masked]<mailto:[email-masked]>>, "<[email-masked]<mailto:[email-masked]>>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

Hi Jim,

Sorry for missing that.

Thanks,

Danny

From: sacm [mailto:[email-masked]] On Behalf Of Jim Bieda (jbieda)
Sent: Tuesday, March 29, 2016 12:39 PM
To: Adam Montville <[email-masked]<mailto:[email-masked]>>; <[email-masked]<mailto:[email-masked]>> <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

Thanks, Jim

REMINDER

Kind regards,

Adam

All:

Kind regards,

Adam

---

From: Michael Hammer <[email-masked]>
Date: Tue, 29 Mar 2016 23:06:14 +0000

Lisa,

The main things I have noted in other IETF WGs:
- Individual drafts start with draft-name-... while WG drafts are draft-ietf-...
- Individual drafts may be modified however the individual want, rip and replace away.
- there may be several competing individual drafts competing in the same area to start
- but once an ID is adopted, the individuals tend to drop off and the group focuses on the WG draft
- and the editor(s) of that draft start to make changes based on consensus of the group.
- don't ever recall any specific rules about the content other than following the IETF formats.

Hope that helps.

________________________________
Michael Hammer
[email-masked]
+1 408 202 9291

© 2016 Yaana Technologies, LLC. All Rights Reserved. Email confidentiality notice. This message is private and confidential. If you have received this message in error, please notify us and remove it from your system.

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Lisa Lorenzin
Sent: Tuesday, March 29, 2016 2:27 PM
To: Jim Bieda (jbieda) <[email-masked]>; Adam Montville <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

Hi Jim,

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Jim Bieda (jbieda)
Sent: Tuesday, March 29, 2016 12:39 PM
To: Adam Montville <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Call for Adoption of SACM Vulnerability Assessment Scenario

Thanks, Jim

REMINDER 

Kind regards,

Adam

			All: 

			Kind regards,

			Adam