Subject: [sacm] Proposed SACM Charter

From: <[email-masked]>
Date: Tue, 31 Jul 2012 17:12:16 -0500

Hi all,

Here is an initial cut at the proposed SACM Working Group charter.  The intent of this is to be a starting point for the conversation. Comments are expected, encouraged and welcomed.

--------
Security Automation Continuous Monitoring (SACM)

Proposed Working Group Charter

Chairs:
TBD
TBD

Security Area Directors:
     Stephen Farrell <[email-masked]<mailto:[email-masked]>>
     Sean Turner <[email-masked]<mailto:[email-masked]>>

Security Area Advisor:
     Sean Turner <[email-masked]<mailto:[email-masked]>>

Mailing Lists:
     General Discussion: [email-masked]<mailto:[email-masked]>
     To Subscribe: http://www.ietf.org/mailman/listinfo/sacm
     Archive:         http://www.ietf.org/mail-archive/web/sacm

Description of Working Group

Securing information and the systems that store, process, and transmit that information has become a challenging task for organizations of all sizes, and we find that security practitioners spend most of their time on manual processes relegating them to ineffectiveness. Security automation is the key to escaping this rut. This working group will enable security automation standards in support of information security processes and practices where practical, such that security practitioners can be better utilized within their organizations and we can meet the more advanced needs of the security community (e.g. information sharing, continuous monitoring, result aggregation and analysis). The initial focus of this work is toaddress enterprise and SOHO use cases. The working group will achieve this by consuming and continuing (with cooperation) the security automation work already performed by various organizations around the world.

The initial work has been fruitful, and the specifications previously published are ready for expansion on the international stage. Of particular interest to this working group are the security automation specifications supporting asset, change, configuration, and vulnerability management. Of secondary interest to this working group are the emerging security automation specifications relating to event management and continuous monitoring.

By undertaking this work, we recognize that there are multiple categories of problems in the security automation domain: defining expressions for particular domain concepts (i.e. specifications), curating domain concept instance collections in content repositories (i.e. operations), and enabling interoperability through the development and use of interfaces and communications protocols. It is one thing to define an expression for vulnerabilities and configuration items, but it is quite another to maintain an authoritative point of reference upon which tools (and their users) can rely and support the automated exchange of vulnerability and configuration information.

This working group will provide solutions to these categories of problems and the main areas of focus for this working group are described as follows:

1. Define, either by normative reference, adoption, or creation, a set of standards that can be used for the purpose of assessing, aggregating and comparing device states against expected values,and reporting on those results in a predefined or ad hoc manner.

2. Define, either by normative reference, adoption, or creation, a set of standards that can be used to continuously monitor and report on systems’ state and security process effectiveness in a pre-defined or ad-hoc manner.

3. Create relationships between existing operations management standards to enable a comprehensive view of security automation, leveraging existing work and implementations.

This working group will produce the following:

* An Informational document providing an overview of security automation and continuous monitoring to include a reference model
* A Standards Track document specifying benchmark configuration representation
* An Informational document stating guidelines / requirements for specifying checking languages
* Standards Track documents specifying device state checking languages
* A Standards Track document specifying an interrogative checking language
* A Standards Track document specifying platform naming, matching and applicability
* A Standards Track document specifying asset identification and reporting information
* A Standards Track document specifying interfaces and communication protocols used for security automation and continuous monitoring
* A Standards Track document describing the messages and network protocols for distributing Security Automation Content
* A Standards Track document describing integrating security automation and Network Endpoint Assessment capabilities
* A Standards Track document describing protocols and data formats for securely sharing dynamic network state information among security systems

Goals and Milestones

Needs to be developed.

-------

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>