Subject: Re: [sacm] IETF 84

From: Michael Hammer <[email-masked]>
Date: Tue, 10 Jul 2012 16:36:27 +0000

David,

I just read the use cases draft and have a general comment.  

My impression of the use cases section is that it reads more like a
functional section.  

As a result, there seems to be a bit of overlap between some of the use
cases.

I normally expect to see something that defines initial state, events
occurring, actions taking place and some end state result.

For example, observed machine needs to use some configuration file.  Checks
signature to see that file was/was not modified.  Logs result.  Proceeds
with process.

Functions implied for Section 4:  process for signing, process for
monitoring, process for logging.

If I read into what is there thus far:

UC1 performs check on static items.

UC2 performs checks on dynamic items (and hence should not duplicate UC1).

UC3 performs self-checks on the dog guarding the hen-house.

UC4 performs anomaly and threat alerts to peer systems.

UC5 logs elements of the above, probably to a separate system, so that
compromise or melt-down can be analyzed.

Also, I understand that the whole point of this is to make the system
automated, but should something said about where the system user, system
administrator, or security administrator fits into the picture?  Or, does
the system just not work (fail-safe) and someone has to dive into logs to
find out why?

Lastly, does the system take any self-healing measures, or is that going out
of scope?

Thanks,

Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Waltermire, David A.
Sent: Thursday, June 28, 2012 12:45 PM
To: [email-masked]; [email-masked];
[email-masked]
Subject: Re: [sacm] IETF 84

I think it would be valuable to have some discussion around the use cases
and some initial concepts for the charter.  Sunday would work for me.

Sincerely,

Dave

From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Thursday, June 28, 2012 12:39 PM
To: [email-masked]; [email-masked]
Subject: Re: [sacm] IETF 84

Thanks for starting the thread, Adam and offering to help Karen!

A few of us have been working to update the use case document that David
Waltermire circulated.  We may need help here as I am not sure if we have
content for each of the use cases yet.  I provided content to update use
case 5.

The hope was to review the use cases in a side meeting and start looking at
a charter in support of the defined use cases.  From there, we can figure
out what work is needed to support the use cases and charter.  This would be
used to set the milestones.

Should we set a meeting for the Sunday again?

Thank you,

Kathleen

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Karen Scarfone
Sent: Thursday, June 28, 2012 12:22 PM
To: [email-masked]
Subject: Re: [sacm] IETF 84

I've gotten out of the loop on this as well. I'm still available to edit any
documents being produced by this effort.

Karen

On Thu, Jun 28, 2012 at 12:03 PM, Adam Montville <[email-masked]>
wrote:

All:

I've been out of this loop for a while, unfortunately.  Hopefully, there
is progress being made on the use cases and other efforts (I.e. content
repository) that were proposed a couple of months ago.

Can anyone tell me whether there is a scheduled meeting (side or
otherwise) for SACM during IETF 84?  If so, do we have any idea when it
will be held?

Regards,

Adam

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

-- 
Karen Scarfone, Principal Consultant, Scarfone Cybersecurity
[email-masked]   (703)401-1018

---

From: Adam Montville <[email-masked]>
Date: Thu, 12 Jul 2012 17:28:26 +0000

Have updated use cases been posted?  If so, I missed it.

From: Michael Hammer <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, July 10, 2012 9:36 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] IETF 84

David,

My impression of the use cases section is that it reads more like a functional section.
As a result, there seems to be a bit of overlap between some of the use cases.
I normally expect to see something that defines initial state, events occurring, actions taking place and some end state result.
For example, observed machine needs to use some configuration file.  Checks signature to see that file was/was not modified.  Logs result.  Proceeds with process.
Functions implied for Section 4:  process for signing, process for monitoring, process for logging.

UC5 logs elements of the above, probably to a separate system, so that compromise or melt-down can be analyzed.

Also, I understand that the whole point of this is to make the system automated, but should something said about where the system user, system administrator, or security administrator fits into the picture?  Or, does the system just not work (fail-safe) and someone has to dive into logs to find out why?

Lastly, does the system take any self-healing measures, or is that going out of scope?

Thanks,
Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Waltermire, David A.
Sent: Thursday, June 28, 2012 12:45 PM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] IETF 84

I think it would be valuable to have some discussion around the use cases and some initial concepts for the charter.  Sunday would work for me.

Sincerely,
Dave

From:[email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Thursday, June 28, 2012 12:39 PM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] IETF 84

A few of us have been working to update the use case document that David Waltermire circulated.  We may need help here as I am not sure if we have content for each of the use cases yet.  I provided content to update use case 5.

The hope was to review the use cases in a side meeting and start looking at a charter in support of the defined use cases.  From there, we can figure out what work is needed to support the use cases and charter.  This would be used to set the milestones.

Thank you,
Kathleen

From:[email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Karen Scarfone
Sent: Thursday, June 28, 2012 12:22 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] IETF 84

I've gotten out of the loop on this as well. I'm still available to edit any documents being produced by this effort.

Karen
On Thu, Jun 28, 2012 at 12:03 PM, Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:
All:

Regards,

Adam

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

--
Karen Scarfone, Principal Consultant, Scarfone Cybersecurity
[email-masked]<mailto:[email-masked]>   (703)401-1018

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 12 Jul 2012 14:00:42 -0400

No.  You didn't miss anything.  Kathleen has been the only contributor to date.

Dave

----- Original Message -----
From: Adam Montville <[email-masked]>
To: Michael Hammer <[email-masked]>; Waltermire, David A.; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Sent: Thu Jul 12 13:28:26 2012
Subject: Re: [sacm] IETF 84

David,

Thanks,
Mike

Sincerely,
Dave

Thank you,
Kathleen

Karen

Regards,

Adam

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 12 Jul 2012 14:05:12 -0400

I hit send too soon...

If you have contributions, I would be happy to incorporate them into the draft.  I think the deadline has passed to update it, but I would be happy to send an updated draft to the list before the meeting.

Thanks,
Dave

----- Original Message -----
From: [email-masked] <[email-masked]>
To: [email-masked]' <[email-masked]>; [email-masked]' <[email-masked]>; [email-masked]' <[email-masked]>; [email-masked]' <[email-masked]>; [email-masked]' <[email-masked]>
Sent: Thu Jul 12 14:00:42 2012
Subject: Re: [sacm] IETF 84

Dave

----- Original Message -----
From: Adam Montville <[email-masked]>
To: Michael Hammer <[email-masked]>; Waltermire, David A.; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Sent: Thu Jul 12 13:28:26 2012
Subject: Re: [sacm] IETF 84

David,

Thanks,
Mike

Sincerely,
Dave

Thank you,
Kathleen

Karen

Regards,

Adam

---

From: Jerome Athias <[email-masked]>
Date: Thu, 12 Jul 2012 20:09:18 +0200

Hi list,

I would like to introduce the fact of having a collaborative platform 
for meetings and sharing ideas and documents.
I just have one open for demo here: http://visio.mediatux.com/
if some are interested, tests and feedbacks are welcome.

Regards
Jerome

---

From: <[email-masked]>
Date: Thu, 12 Jul 2012 14:18:33 -0400

Hi Dave, 

We have until Monday 17:00PT to post a -01 version.  It would be great if we can pull together and get that out.

Thanks,
Kathleen 

Sent from my iPhone

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 12 Jul 2012 14:34:46 -0400

That's good.  I am happy to support the effort by editing any contributions together.  Kathleen, I have your text for UC 5.  Does anyone else have any text to contribute?

Thanks,
Dave

----- Original Message -----
From: [email-masked] <[email-masked]>
To: Waltermire, David A.
Cc: [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Sent: Thu Jul 12 14:18:33 2012
Subject: Re: [sacm] IETF 84

Hi Dave, 

Thanks,
Kathleen 

Sent from my iPhone