Subject: [sacm] SACM Vancouver Side Meeting Agenda

From: <[email-masked]>
Date: Tue, 17 Jul 2012 18:45:28 -0500

All,

The Security Automation and Continuous Monitoring effort is going to have a Side meeting at the IETF 84 meeting in Vancouver later this month.  What follows is a draft agenda for the meeting.  I encourage all to send suggestions for additional discussion items to the list so we can get them added to the agenda as needed.

SACM Side Meeting IETF 84

Security Automation and Continuous Monitoring – SACM (pronounced as Sack-em)

Side Meeting Chairs: David Waltermire, Kent Landfield

Description: A side meeting to continue the discussions around security automation and continuous monitoring working group development efforts. In this meeting we will be reviewing the Use Case document and then focusing on a draft charter for the potential working group.

Here are the meeting specifics:

Date: Thursday, August 2, 2012
Time: 18:30 – 20:00 PDT
Room: Plaza C

We will be requesting MeetEcho support. When we know more we will update the list.

Agenda:
            * Agenda Bashing
            * Status of work since last IETF meeting
            * Internet Draft Discussions to:
                  - support the charter/use cases
                  - other potential future drafts
            * Discuss draft WG Charter

Current Drafts:
 - http://www.ietf.org/id/draft-waltermire-sacm-use-cases-01.txt - draft-waltermire-sacm-use-cases-01 - Analysis of Security Automation and Continuous Monitoring (SACM) Use Cases
 - http://www.ietf.org/id/draft-waltermire-content-repository-00.txt - draft-waltermire-content-repository-00 - Automated XML Content Data Exchange and Management

We encourage you to submit other topics you would like to see added to the agenda.

Thanks.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

---

From: <[email-masked]>
Date: Wed, 18 Jul 2012 17:29:19 -0500

The purpose of the use case document was to assist in trying to capture higher level areas that may drive charter discussions.  It is also a means to describe other related efforts  occurring in the IETF. This is not a conops. We do want to include other areas such as cloud, networks and mobile devices.  The focus is really on security automation use cases and what areas can drive those sorts of standards efforts.

FYI, these are very much in a draft and incomplete state.  They need input and expansion so if you have text or suggestions, please don't hesitate to send them to the list.

Thanks.

Kent Landfield

From: <Wolfkiel>, "Joseph L CIV (US)" <[email-masked]<mailto:[email-masked]>>
Reply-To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, July 18, 2012 5:13 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [emerging-specs] SACM Vancouver Side Meeting Agenda

What level of specificity is expected?  The use cases talk at a high level about things like: "configuration" that could mean network config; hardware config; installed software, patches, and drivers; OS and application setting config; and Installed AV, HIPS, and DLP versions and policies + .dat files among others.  Do you want supporting details so a user could understand specifically what each entails, or is the intent to keep it at a high-level general description?

Do you also want the specific workflow-specific use cases, such as ensuring all the correct protective and assessment sensors and tasks are in place, that correct reporting is occurring, etc?

Are the use cases intended to extend to "cloud" environments, networks, and mobile devices?

**** Please note new e-mail address ****

Joseph L. Wolfkiel
Engineering Group Lead
DISA PEO MA/IA52
(301) 225-8820
[email-masked]<mailto:[email-masked]>

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, July 18, 2012 5:34 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [emerging-specs] SACM Vancouver Side Meeting Agenda

The current drafts for both the repository and the use cases are available at the links below.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com <http://www.mcafee.com/>

From: <Wolfkiel>, "Joseph L CIV (US)" <[email-masked]<mailto:[email-masked]>>
Reply-To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, July 18, 2012 1:07 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [emerging-specs] SACM Vancouver Side Meeting Agenda

Where is the current use cases document?

**** Please note new e-mail address ****

Joseph L. Wolfkiel
Engineering Group Lead
DISA PEO MA/IA52
(301) 225-8820
[email-masked]<mailto:[email-masked]>

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, July 18, 2012 12:05 PM
To: [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: [emerging-specs] SACM Vancouver Side Meeting Agenda

All,

Security Automation and Continuous Monitoring - SACM (pronounced as Sack-em)

Time: 18:30 - 20:00 PDT

Room: Plaza C

Agenda:

            * Agenda Bashing

Current Drafts:

Thanks.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com <http://www.mcafee.com/>