Subject: Re: [sacm] FW: SACM BoF Request

From: [email-masked]
Date: Wed, 12 Sep 2012 11:17:19 -0500 (CDT)

David:

I would like to take on ASR (I pressume you are talking about IR 7848 for future SCAP/SACM versions).

Which in fact, brings up a question.

In terms of maturity, how do you know which Interagency Reports will be part of future SACM/SCAP versions?

David Oliva

On 09/12/12, Waltermire, David A.<[email-masked]> wrote:

I sent in a request to hold a SACM BoF at the IETF 85 meeting in Atlanta, GA.  The details are below for anyone interested.  At this point we need to complete preparations for the BoF.  To be successful, we will need your participation in the BoF and your help getting ready.

Here are meeting details if you are interested in making travel arrangements:

http://www.ietf.org/meeting/85/index.html

At this point we need additional drafts to be submitted to augment the agenda and support the BoF.  I’d be happy to work with anyone interested in preparing drafts for any of the existing specifications in this area (e.g. CPE, Asset Identification, ARF, ASR, etc.)  We should probably do a direct conversion of existing specifications for -00 versions before making any changes.  The -00 deadline for the IETF 85 meeting is 10/15 with any updated drafts due a week later on 10/22.  Any volunteers?

We will also need speakers to present drafts.  Please let me or Kathleen know if you are interested in making a short presentation.

We also need to continue to refine the charter (included below) and use case documents. Any additional comments/changes would be appreciated.

Sincerely,

Dave

From: Waltermire, David A.
Sent: Monday, September 10, 2012 6:45 PM
To: [email-masked]'; [email-masked]'; 'Moriarty, Kathleen'
Subject: SACM BoF Request

Please find the our request for a WG formation BoF below.  I have also included a draft charter that we have been developing with feedback from the SACM list.  Please let me know if you have any questions or if you would like any additional details.

Sincerely,

Dave Waltermire

--

BOF full name: Security Automation and Continuous Monitoring [SACM]

AREA: Security

BOF Chairs: Kathleen Moriarty ([email-masked])

David Waltermire ([email-masked])

Agenda:

* Review the draft charter

* Review draft-waltermire-sacm-use-cases-02

* Review drafts submitted in support of the charter

- draft-waltermire-content-repository-00

- More expected before -00 deadline

Full Description of BOF: The SACM BoF is intended to progress the work from the SACM mailing list to solidify discussions on a proposed charter, use cases and milestones in support of moving to an IETF working group.

CONFLICTS to avoid: SAAG, MILE

Expected Attendance: 40, not sure what the previous attendance was?

Special Requests: Meetecho support

Number of sessions: 1

Length of session: 2 hours

Draft Charter:

Proposed Working Group Charter

Chairs:

TBD

TBD

Security Area Directors:

Stephen Farrell <[email-masked]>

Sean Turner <[email-masked]>

Security Area Advisor:

Sean Turner <[email-masked]>

Mailing Lists:

General Discussion: [email-masked]

To Subscribe:       http://www.ietf.org/mailman/listinfo/sacm

Archive:            http://www.ietf.org/mail-archive/web/sacm

Description of Working Group

Securing information and the systems that store, process, and transmit that information has become a challenging task for organizations of all sizes, and we find that security practitioners spend most of their time on manual processes relegating them to ineffectiveness. Security automation to verify system configurations with the ability to prioritize risk based on increased situational awareness from shared intelligence is the key to escaping this rut. This working group will develop security automation standards in support of information security processes and practices where practical. These standards will help security practitioners to be better utilized within their organizations by automating routine tasks related to endpoint and server security so that practitioners can focus on more advanced tasks. The initial focus of this work is to address enterprise use cases.

The working group will achieve this by consuming shared intelligence and continuing (with cooperation) the security automation work already performed by various organizations around the world.  The initial work has been fruitful, and the data formats previously published are ready for expansion on the international stage. Of particular interest to this working group are the security automation specifications supporting asset, change, configuration, and vulnerability management. Of additional interest to this working group are the emerging security automation interfaces and data formats relating to event management and continuous assessment.  The continuous assessment capabilities enable organizational situational awareness through frequent snapshots of the operating state of their environment, with risk prioritized based on consumed information provided by shared intelligence (vulnerabilities, threats, etc.).

By undertaking this work, we recognize that there are multiple categories of problems in the security automation domain: defining expressions for particular domain concepts (i.e. data formats), establishing a standards-based foundation supporting the curation and exchange of security automation content collections in content repositories, and enabling interoperability through the development and use of standard interfaces and communications protocols. Content based on rich data standards and protocols will provide the authoritative instructions needed by data-driven tools to enable the automated collection and exchange of configuration and vulnerability data pertaining to enterprise assets. Information produced by these tools will provide accurate and timely situational awareness in support of organizational decision making.

This working group will provide solutions to these categories of problems and the main areas of focus for this working group are described as follows:

1. Define, either by normative reference, adoption, or creation, a set of standards that can be used for the purpose of assessing and aggregating device states and comparing these device states against expected values, and reporting on those results in a predefined or ad hoc manner.  This area of focus provides for necessary language and data format specifications.

2. Define, either by normative reference, adoption, or creation, a set of standards that can be used to continuously assess and report on the state of systems, composed of many different types of devices and networks, operated by varying personnel, to ensure security process effectiveness in a pre-defined or ad-hoc manner.  This area of focus provides for integration protocols supporting plug and play continuous assessment and security automation networking.

This working group will achieve the following milestones in two phases:

Phase One

- A Standards Track document specifying asset description format

- A Standards Track document specifying asset identification

- A Standards Track document specifying platform naming

- A Standards Track document specifying platform matching

- A Standards Track document specifying platform applicability

- A Standards Track document specifying a control framework representation format.

- A Standards Track document specifying benchmark configuration representation

- An Informational document stating guidelines / requirements for specifying checking languages

- Standards Track documents specifying device state checking languages

- A Standards Track document specifying an interrogative checking language

- A Standards Track document specifying asset reporting information

- Standards Track document describing how to use the languages and other content defined in this group with the NEA protocols

Phase Two

- Standards Track document specifying security automation/continuous assessment interfaces

- A Standards Track document specifying communication protocols used for security automation and continuous assessment

- A Standards Track document describing the messages and network protocols for distributing security automation content  (content repository)

- A Standards Track document describing protocols and data formats for securely sharing dynamic network state information among security systems

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Davidson II, Mark S" <[email-masked]>
Date: Wed, 12 Sep 2012 19:57:59 +0000

My apologies for the late response, I didn’t get to this email until just now.

As an original author for the ASR spec, I’d like to participate in bringing ASR to the IETF. Is that a possibility?

Thank you.
-Mark Davidson

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, September 12, 2012 12:17 PM
To: [email-masked]; [email-masked]
Subject: Re: [sacm] FW: SACM BoF Request

 David:

David Oliva

Sincerely,
Dave

From: Waltermire, David A.
Sent: Monday, September 10, 2012 6:45 PM
To: [email-masked]<mailto:[email-masked]>'; [email-masked]<mailto:[email-masked]>'; 'Moriarty, Kathleen'
Subject: SACM BoF Request

Sincerely,
Dave Waltermire

--

BOF full name: Security Automation and Continuous Monitoring [SACM]
AREA: Security
BOF Chairs: Kathleen Moriarty ([email-masked]<mailto:[email-masked]>)
            David Waltermire ([email-masked]<mailto:[email-masked]>)
Agenda:

Draft Charter:

Chairs:
TBD
TBD

Security Area Directors:
     Stephen Farrell <[email-masked]<mailto:[email-masked]>>
     Sean Turner <[email-masked]<mailto:[email-masked]>>

Security Area Advisor:
     Sean Turner <[email-masked]<mailto:[email-masked]>>

Mailing Lists:
     General Discussion: [email-masked]<mailto:[email-masked]>
     To Subscribe:       http://www.ietf.org/mailman/listinfo/sacm
     Archive:            http://www.ietf.org/mail-archive/web/sacm

Phase One

Phase Two

________________________________

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Adam Montville <[email-masked]>
Date: Wed, 12 Sep 2012 22:32:42 +0000

Mark,

We can have multiple authors on a single document.  That said, if there's something else David would be interested in bringing in (there's more than just ASR to work on), then I would recommend that you bring in ASR and that David work on a different document, such as ARF.  I am, of course, assuming that we all have limited time.  It would be entirely acceptable for you and David to work on ASR and for either or both of you to work on others in addition.

Regards,

Adam

From: "<Davidson II>", Mark S <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, September 12, 2012 12:57 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] FW: SACM BoF Request

Thank you.
-Mark Davidson

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Wednesday, September 12, 2012 12:17 PM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] FW: SACM BoF Request

 David:

David Oliva

On 09/12/12, Waltermire, David A.<[email-masked]<mailto:[email-masked]>> wrote:

Sincerely,
Dave

Sincerely,
Dave Waltermire

--

Draft Charter:

Chairs:
TBD
TBD

Security Area Directors:

Security Area Advisor:

Mailing Lists:

Phase One

Phase Two

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 13 Sep 2012 07:52:48 -0400

Mark,

That would be great!  Thank you for volunteering.

Sincerely,
Dave

From: Davidson II, Mark S [mailto:[email-masked]]
Sent: Wednesday, September 12, 2012 3:58 PM
To: [email-masked]; Waltermire, David A.; [email-masked]
Subject: RE: [sacm] FW: SACM BoF Request

Thank you.
-Mark Davidson

 David:

David Oliva

Sincerely,
Dave

Sincerely,
Dave Waltermire

--

Draft Charter:

Chairs:
TBD
TBD

Security Area Directors:

Security Area Advisor:

Mailing Lists:

Phase One

Phase Two

---

From: "Davidson II, Mark S" <[email-masked]>
Date: Thu, 13 Sep 2012 17:49:07 +0000

Thank you. I’m happy to work with David Oliva on this.

What is the proper procedure for drafting the RFC? I’m new to the IETF, so direction will be beneficial. Also, what would the group need from a dates/deliverables perspective?

If it’s acceptable, I’ll work offline with David O. and come back to the group at regular intervals as the schedule demands.

Thank you.
-Mark

From: Waltermire, David A. [mailto:[email-masked]]
Sent: Thursday, September 13, 2012 7:53 AM
To: Davidson II, Mark S; [email-masked]; [email-masked]
Subject: RE: [sacm] FW: SACM BoF Request

Mark,

Sincerely,
Dave

From: Davidson II, Mark S [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Wednesday, September 12, 2012 3:58 PM
To: [email-masked]<mailto:[email-masked]>; Waltermire, David A.; [email-masked]<mailto:[email-masked]>
Subject: RE: [sacm] FW: SACM BoF Request

Thank you.
-Mark Davidson

 David:

David Oliva

Sincerely,
Dave

Sincerely,
Dave Waltermire

--

Draft Charter:

Chairs:
TBD
TBD

Security Area Directors:

Security Area Advisor:

Mailing Lists:

Phase One

Phase Two

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Thu, 13 Sep 2012 13:56:05 -0400

Hi Mark,

Many thanks to you and Dave for preparing a draft!  The following link should help to answer all your questions:
http://www.ietf.org/id-info/guidelines.html

I use the xml template when working on drafts, but there are other options such as the Word template.  You and Dave should decide which works best for you and prepare the draft using that format.  You will run into some questions like what state do I put the document in?  Informational will work for now and it can get changed later.  The naming of the draft as well (file name) is covered in the link and you can follow the examples of other documents recently posted.

Please post any specific questions.  

Best regards,
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Davidson II, Mark S [[email-masked]]
Sent: Thursday, September 13, 2012 1:49 PM
To: Waltermire, David A.; [email-masked]; [email-masked]
Subject: Re: [sacm] FW: SACM BoF Request

Thank you.
-Mark

Mark,

Sincerely,
Dave

Thank you.
-Mark Davidson

 David:

David Oliva

Sincerely,
Dave

Sincerely,
Dave Waltermire

--

Draft Charter:

Chairs:
TBD
TBD

Security Area Directors:

Security Area Advisor:

Mailing Lists:

Phase One

Phase Two

---

From: Michael Hammer <[email-masked]>
Date: Thu, 13 Sep 2012 18:07:36 +0000

All,

I have seen a couple mentions of “new to IETF”, so was looking for the “Tau of the IETF” document which is on this first link:

http://www.ietf.org/newcomers.html

But note also these as well:

http://www.ietf.org/about/process-docs.html

http://www.ietf.org/edu/process-oriented-tutorials.html

http://tools.ietf.org/

Hope that helps.

Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Davidson II, Mark S
Sent: Thursday, September 13, 2012 1:49 PM
To: Waltermire, David A.; [email-masked]; [email-masked]
Subject: Re: [sacm] FW: SACM BoF Request

Thank you.

-Mark

Mark,

Sincerely,

Dave

Thank you.

-Mark Davidson

 David:

David Oliva

Sincerely,

Dave

Sincerely,

Dave Waltermire

--

AREA: Security

Agenda:

Number of sessions: 1

Draft Charter:

Chairs:

TBD

TBD

Security Area Directors:

Security Area Advisor:

Mailing Lists:

Phase One

Phase Two

 

  _____

---

From: Sean Turner <[email-masked]>
Date: Tue, 25 Sep 2012 11:42:19 -0400

A direct link to the tao:

https://www.ietf.org/tao.html

And feel free to ask questions.

spt

On 9/13/12 2:07 PM, Michael Hammer wrote:
> All,
>
> I have seen a couple mentions of “new to IETF”, so was looking for the
> “Tau of the IETF” document which is on this first link:
>
> *From:[email-masked] [mailto:[email-masked]] *On Behalf
> Of *Davidson II, Mark S
> *Sent:* Thursday, September 13, 2012 1:49 PM
> *To:* Waltermire, David A.; [email-masked]; [email-masked]
> *Subject:* Re: [sacm] FW: SACM BoF Request
>
> What is the proper procedure for drafting the RFC? I’m new to the IETF,
> so direction will be beneficial. Also, what would the group need from a
> dates/deliverables perspective?
>
> If it’s acceptable, I’ll work offline with David O. and come back to the
> group at regular intervals as the schedule demands.
>
> Thank you.
>
> -Mark
>
> *From:*Waltermire, David A. [mailto:[email-masked]]
> <mailto:[mailto:[email-masked]]>
> *Sent:* Thursday, September 13, 2012 7:53 AM
> *To:* Davidson II, Mark S; [email-masked]
> <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
> *Subject:* RE: [sacm] FW: SACM BoF Request
>
> Mark,
>
> *From:*Davidson II, Mark S [mailto:[email-masked]]
> <mailto:[mailto:[email-masked]]>
> *Sent:* Wednesday, September 12, 2012 3:58 PM
> *To:* [email-masked] <mailto:[email-masked]>;
> Waltermire, David A.; [email-masked] <mailto:[email-masked]>
> *Subject:* RE: [sacm] FW: SACM BoF Request
>
> As an original author for the ASR spec, I’d like to participate in
> bringing ASR to the IETF. Is that a possibility?
>
> Thank you.
>
> -Mark Davidson
>
> *From:[email-masked] <mailto:[email-masked]>
> [mailto:[email-masked]] *On Behalf Of [email-masked]
> <mailto:[email-masked]>
> *Sent:* Wednesday, September 12, 2012 12:17 PM
> *To:* [email-masked] <mailto:[email-masked]>;
> [email-masked] <mailto:[email-masked]>
> *Subject:* Re: [sacm] FW: SACM BoF Request
>
>   David:
>
> On 09/12/12, Waltermire, David A.<[email-masked]
> <mailto:[email-masked]>> wrote:
>
> I sent in a request to hold a SACM BoF at the IETF 85 meeting in
> Atlanta, GA.  The details are below for anyone interested.  At this
> point we need to complete preparations for the BoF.  To be successful,
> we will need your participation in the BoF and your help getting ready.
>
> At this point we need additional drafts to be submitted to augment the
> agenda and support the BoF.  I’d be happy to work with anyone interested
> in preparing drafts for any of the existing specifications in this area
> (e.g. CPE, Asset Identification, ARF, ASR, etc.)  We should probably do
> a direct conversion of existing specifications for -00 versions before
> making any changes.  The -00 deadline for the IETF 85 meeting is 10/15
> with any updated drafts due a week later on 10/22.  Any volunteers?
>
> We will also need speakers to present drafts.  Please let me or Kathleen
> know if you are interested in making a short presentation.
>
> We also need to continue to refine the charter (included below) and use
> case documents. Any additional comments/changes would be appreciated.
>
> Sincerely,
>
> Dave
>
> *From:*Waltermire, David A.
> *Sent:* Monday, September 10, 2012 6:45 PM
> *To:* [email-masked] <mailto:[email-masked]>';
> [email-masked] <mailto:[email-masked]>'; 'Moriarty, Kathleen'
> *Subject:* SACM BoF Request
>
> Please find the our request for a WG formation BoF below.  I have also
> included a draft charter that we have been developing with feedback from
> the SACM list.  Please let me know if you have any questions or if you
> would like any additional details.
>
> Sincerely,
>
> Dave Waltermire
>
> --
>
> Full Description of BOF: The SACM BoF is intended to progress the work
> from the SACM mailing list to solidify discussions on a proposed
> charter, use cases and milestones in support of moving to an IETF
> working group.
>
>       Sean Turner <[email-masked] <mailto:[email-masked]>>
>
> Security Area Advisor:
>
>       Sean Turner <[email-masked] <mailto:[email-masked]>>
>
> Mailing Lists:
>
>       General Discussion: [email-masked] <mailto:[email-masked]>
>
> Securing information and the systems that store, process, and transmit
> that information has become a challenging task for organizations of all
> sizes, and we find that security practitioners spend most of their time
> on manual processes relegating them to ineffectiveness. Security
> automation to verify system configurations with the ability to
> prioritize risk based on increased situational awareness from shared
> intelligence is the key to escaping this rut. This working group will
> develop security automation standards in support of information security
> processes and practices where practical. These standards will help
> security practitioners to be better utilized within their organizations
> by automating routine tasks related to endpoint and server security so
> that practitioners can focus on more advanced tasks. The initial focus
> of this work is to address enterprise use cases.
>
> The working group will achieve this by consuming shared intelligence and
> continuing (with cooperation) the security automation work already
> performed by various organizations around the world.  The initial work
> has been fruitful, and the data formats previously published are ready
> for expansion on the international stage. Of particular interest to this
> working group are the security automation specifications supporting
> asset, change, configuration, and vulnerability management. Of
> additional interest to this working group are the emerging security
> automation interfaces and data formats relating to event management and
> continuous assessment.  The continuous assessment capabilities enable
> organizational situational awareness through frequent snapshots of the
> operating state of their environment, with risk prioritized based on
> consumed information provided by shared intelligence (vulnerabilities,
> threats, etc.).
>
> By undertaking this work, we recognize that there are multiple
> categories of problems in the security automation domain: defining
> expressions for particular domain concepts (i.e. data formats),
> establishing a standards-based foundation supporting the curation and
> exchange of security automation content collections in content
> repositories, and enabling interoperability through the development and
> use of standard interfaces and communications protocols. Content based
> on rich data standards and protocols will provide the authoritative
> instructions needed by data-driven tools to enable the automated
> collection and exchange of configuration and vulnerability data
> pertaining to enterprise assets. Information produced by these tools
> will provide accurate and timely situational awareness in support of
> organizational decision making.
>
> This working group will provide solutions to these categories of
> problems and the main areas of focus for this working group are
> described as follows:
>
> 1. Define, either by normative reference, adoption, or creation, a set
> of standards that can be used for the purpose of assessing and
> aggregating device states and comparing these device states against
> expected values, and reporting on those results in a predefined or ad
> hoc manner.  This area of focus provides for necessary language and data
> format specifications.
>
> 2. Define, either by normative reference, adoption, or creation, a set
> of standards that can be used to continuously assess and report on the
> state of systems, composed of many different types of devices and
> networks, operated by varying personnel, to ensure security process
> effectiveness in a pre-defined or ad-hoc manner.  This area of focus
> provides for integration protocols supporting plug and play continuous
> assessment and security automation networking.
>
> - Standards Track document describing how to use the languages and other
> content defined in this group with the NEA protocols
>
> Phase Two
>
> - A Standards Track document specifying communication protocols used for
> security automation and continuous assessment
>
> - A Standards Track document describing the messages and network
> protocols for distributing security automation content  (content repository)
>
> - A Standards Track document describing protocols and data formats for
> securely sharing dynamic network state information among security systems
>
> ------------------------------------------------------------------------
>
>
> [email-masked] <mailto:[email-masked]>