Subject: [sacm] Text for SACM Use Cases

From: Stephen Hanna <[email-masked]>
Date: Thu, 12 Jul 2012 17:32:30 -0400

Here's some text to be added to UC1, UC2, and UC3 in
draft-waltermire-sacm-use-cases-00.txt. These should
help explain how the use cases relate to NEA and some
other relevant specifications and to each other.

Thanks,

Steve

--------

UC1:

Replace "Possible other things to address" and the following
two bullets with this text:

The Network Endpoint Assessment (NEA) protocols ([PA-TNC],
[PB-TNC], [PT-TLS], and [PT-EAP]) may be used to query and
transport the things to be measured, as well as providing
for manual or automated remediation and mitigation. SCAP
content ([XCCDF], [OVAL], [OCIL], etc.) may be transported
over the NEA protocols to indicate which things are to be
measured and send the results of the measurements. And
enforcement may be implemented with [RADIUS] or [DIAMETER].

UC2:

Insert this text before "Possible other things to address"
and remove the first bullet after "Possible other things":

The Trusted Computing Group's [IF-MAP] protocol provides
a standard way to rapidly share events and updates related
to user/device behavior and network events, enabling logging
or swift response such as reduced or terminated access.

UC3:

Insert this text before "Possible other things to address"
and remove the first bullet after "Possible other things":

This use case extends UC1 to ensure that changes to the
things measured in UC1 are rapidly detected, reported,
and optionally responded to with manual or automated
remediation and mitigation.