Subject: [sacm] SACM Use Cases Updated

From: "Waltermire, David A." <[email-masked]>
Date: Mon, 16 Jul 2012 17:43:34 -0400

I just posted an updated SACM use cases document based on all the contributions and comments to date.  Thanks for all the input!  Links to the updated document are below.  I'd appreciate any feedback.

Sincerely,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Monday, July 16, 2012 5:38 PM
To: Waltermire, David A.
Subject: New Version Notification for draft-waltermire-sacm-use-cases-01.txt

A new version of I-D, draft-waltermire-sacm-use-cases-01.txt
has been successfully submitted by David Waltermire and posted to the IETF repository.

Filename:	 draft-waltermire-sacm-use-cases
Revision:	 01
Title:		 Analysis of Security Automation and Continuous Monitoring (SACM) Use Cases
Creation date:	 2012-07-16
WG ID:		 Individual Submission
Number of pages: 13
URL:             http://www.ietf.org/internet-drafts/draft-waltermire-sacm-use-cases-01.txt
Status:          http://datatracker.ietf.org/doc/draft-waltermire-sacm-use-cases
Htmlized:        http://tools.ietf.org/html/draft-waltermire-sacm-use-cases-01
Diff:            http://tools.ietf.org/rfcdiff?url2=draft-waltermire-sacm-use-cases-01

Abstract:
   This document identifies foundational use cases, derived functional
   capabilities and requirements, architectural components, and the
   supporting standards needed to define an interoperable, automation
   infrastructure required to support timely, accurate and actionable
   situational awareness over an organization's IT systems.  Automation
   tools implementing a continuous monitoring approach will utilize this
   infrastructure together with existing and emerging event, incident
   and network management standards to provide visibility into the state
   of assets, user activities and network behavior.  Stakeholders will
   be able to use these tools to aggregate and analyze relevant security
   and operational data to understand the organizations security
   posture, quantify business risk, and make informed decisions that
   support organizational objectives while protecting critical
   information.  Organizations will be able to use these tools to
   augment and automate information sharing activities to collaborate
   with partners to identify and mitigate threats.  Other automation
   tools will be able to integrate with these capabilities to enforce
   policies based on human decisions to harden systems, prevent misuse
   and reduce the overall attack surface.

The IETF Secretariat

---

From: Adam Montville <[email-masked]>
Date: Tue, 17 Jul 2012 15:30:59 +0000

Dave,

Thanks for posting.  And, thanks to everyone who contributed.

Regards,

Adam

On 7/16/12 2:43 PM, "Waltermire, David A." <[email-masked]>
wrote:

>I just posted an updated SACM use cases document based on all the
>contributions and comments to date.  Thanks for all the input!  Links to
>the updated document are below.  I'd appreciate any feedback.
>
>Sincerely,
>Dave
>
>
>URL:             
>http://www.ietf.org/internet-drafts/draft-waltermire-sacm-use-cases-01.txt
>Status:          
>http://datatracker.ietf.org/doc/draft-waltermire-sacm-use-cases
>Htmlized:        
>http://tools.ietf.org/html/draft-waltermire-sacm-use-cases-01
>Diff:            
>http://tools.ietf.org/rfcdiff?url2=draft-waltermire-sacm-use-cases-01
>
>Abstract:
>_______________________________________________
>sacm mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/sacm
>

---

From: "Schmidt, Charles M." <[email-masked]>
Date: Wed, 18 Jul 2012 15:44:31 +0000

Hi Dave,

Thanks for all your effort getting this together. I was noting the multiple
references to TCG's TNC protocols (both the IETF NEA work which mirrors some
of the exchanges, and the reference to MAP, which does not have a
corresponding IETF effort that I am aware of). I was curious as to how
closely bundled you see SACM being with TNC. Was your thought just to
utilize the defined network protocols or were you envisioning that other
aspects of the TNC and/or NEA architecture would be part of the solution?

Also, in my reading of the use cases, you have identified lots of existing
efforts for network exchange of information. Are you seeing this effort as
largely re-using existing wire protocols, possibly with different payloads,
or do you feel that wire-protocol development would be part of a SACM
charter. Right now, as far as my understanding goes, it seems like the wire
protocols, and many of the data model references utilize existing work and
that the needed development would be in designing a composition (i.e., what
I would call an architecture, although I'm probably not using that word
correctly in a formal sense) of these existing works. Is this correct?
Certainly this effort would want to make use of existing work rather than
duplicating development with other efforts - I'm just trying to get a better
sense of what SACM might consider "covered-ground" vs. what it considers to
be in need of development/management/refinement.

I don't know if these questions are relevant for a use case doc, but I
imagine any charter discussions would need some level of answers on these.

Thanks,
Charles

>From: [email-masked] [mailto:[email-masked]] On Behalf Of
>Waltermire, David A.
>Sent: Monday, July 16, 2012 4:44 PM
>To: [email-masked]
>Subject: [sacm] SACM Use Cases Updated
>
the
>updated document are below.  I'd appreciate any feedback.
>
>Sincerely,
>Dave
>
>
http://www.ietf.org/internet-drafts/draft-waltermire-sacm-use-
>cases-01.txt
>Diff:
http://tools.ietf.org/rfcdiff?url2=draft-waltermire-sacm-use-cases-
>01

---

From: "Omar Santos (osantos)" <[email-masked]>
Date: Mon, 23 Jul 2012 01:02:38 +0000

Hi Dave/team,

My apologies for the delay. The following are a minor suggestion/feedback
for the SACM Use Cases (draft-waltermire-sacm-use-cases).

Under 3.4.  UC4: Secure Exchange of Risk and Compliance Information

Perhaps we can add "new reports of potential zero-day vulnerabilities to
vendors."

I know that we have the following:

   o  Potential sharing of risk and/or threat behavioral information
      with partners as well as reference data and content like USGCB,
      NVD, IAVM, and machine-readable US-CERT alerts

However, it may be a good use case expand on the notification to vendors
of potential zero-day vulnerabilities and also the coordination/exchange
of information of potential industry-wide vulnerabilities (i.e., protocol
vulnerabilities; or any other issue that may affect multiple vendors).

We can also include some language about the aforementioned under "3.5.
UC5: Automated Forensics Investigation"

Regards,

Omar Santos
Incident Manager, PSIRT
Security Research and Operations
Cisco Systems, Inc.
Email: [email-masked]
Phone: +1 919 392 8635
PGP Key: 0x3AF27EDC

Cisco.com - http://www.cisco.com <http://www.cisco.com/>
Cisco Security Advisories and Notices - http://www.cisco.com/go/psirt

---

From: <[email-masked]>
Date: Mon, 23 Jul 2012 10:14:56 -0400

Thanks, Omar!  

Those are good suggestions.  I agree some will go to UC5, where some of the work (drafts to support the use cases) is handled in MILE and SACM will have relationships with the work in MILE (we may need SACM to have drafts supporting these relationships).  Some of this updated version of UC4 will get handled through MILE as well, I suspect.  It is good to build out the bigger picture in this document though, thanks!

Best regards,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Omar Santos (osantos)
Sent: Sunday, July 22, 2012 9:03 PM
To: Waltermire, David A.; [email-masked]
Subject: Re: [sacm] SACM Use Cases Updated

Hi Dave/team,

Regards,

Omar Santos
Incident Manager, PSIRT