Subject: [sacm] IETF 97 Follow-Up: Using the Vulnerability Assessment Scenario to Make Progress on the Architecture and IM

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 19 Dec 2016 18:54:48 +0000

Hi Everyone,

In an effort to address the roadblocks associated with the architecture and scope of the information model, it was suggested at IETF 97 that the WG go through the Vulnerability Assessment Scenario and define the minimum set of interfaces, operations, and information elements necessary execute the scenario. Focusing on the Vulnerability Assessment Scenario will help keep the discussions concrete and very focused. The end result of this work will inform decisions on the architecture and information model that will allow the WG to move forward with a basic set of capabilities and build out additional capabilities as needed. The following is a first pass at what this work might look like and how we might want to approach it as a WG. Ideally, several members of the WG would drive this effort forward.

Objectives

*         Identify the tasks that are necessary to execute the Vulnerability Assessment Scenario and define their inputs and outputs

*         Identify the interactions between components in the Vulnerability Assessment Scenario and define the interfaces and operations required to support those interactions

*         Identify the information elements necessary to facilitate the communication of security automation data between components in the Vulnerability Assessment Scenario

*         Validate tasks, interfaces, operations, and information elements by exercising the Vulnerability Assessment Scenario using multiple CVEs

Approach

To ensure the WG can make quick progress, this work should be broken up into multiple phases that gradually build on the previous phase.

Phase 1

*         Assume components are configured to communicate with each other (i.e. ignore discovery for now)

*         Create a diagram that shows the components and their interactions with each other. Highlight which interactions are required and which interactions are optional.

*         Identify where different tasks occur in the diagram

Phase 2

*         For each component, identify the information elements needed to carry out the required interactions. For each interaction, define the necessary interfaces and operations.

*         Validate using CVEs

Phase 3

*         Identify the information elements needed to carry out the optional interactions. Define the necessary interfaces and operations for those interactions.

*         Validate using CVEs

Phase 4

*         Add support for discovery of components and capabilities by other components

*         Validate using CVEs

Deliverables

*         Updated IM that contains the minimum set of IEs necessary for the Vulnerability Assessment Scenario

*         Updated Architecture that defines the interfaces and operations required for the Vulnerability Assessment Scenario

*         Multiple examples that use CVEs to validate the Vulnerability Assessment Scenario

Does this seem like a reasonable summary of this work? Are there things that are missing or should be removed from this work?

Please let me know if you have any questions.

Thanks,

Danny