Subject: [sacm] FW: New Version Notification for draft-waltermire-sacm-use-cases-02.txt

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 7 Sep 2012 15:52:34 -0400

I just posted an updated use cases document (see below) that reduces the scope to UC1-3 and adds a lot of new content.  Many thanks to Adam Montville for all his hard work on this revision.

Comments are appreciated.

Sincerely,
Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, September 07, 2012 3:49 PM
To: Waltermire, David A.
Cc: [email-masked]
Subject: New Version Notification for draft-waltermire-sacm-use-cases-02.txt

A new version of I-D, draft-waltermire-sacm-use-cases-02.txt
has been successfully submitted by David Waltermire and posted to the IETF repository.

Filename:	 draft-waltermire-sacm-use-cases
Revision:	 02
Title:		 Analysis of Security Automation and Continuous Monitoring (SACM) Use Cases
Creation date:	 2012-09-07
WG ID:		 Individual Submission
Number of pages: 23
URL:             http://www.ietf.org/internet-drafts/draft-waltermire-sacm-use-cases-02.txt
Status:          http://datatracker.ietf.org/doc/draft-waltermire-sacm-use-cases
Htmlized:        http://tools.ietf.org/html/draft-waltermire-sacm-use-cases-02
Diff:            http://www.ietf.org/rfcdiff?url2=draft-waltermire-sacm-use-cases-02

Abstract:
   This document identifies foundational use cases, derived functional
   capabilities and requirements, architectural components, and the
   supporting standards needed to define an interoperable,
   automation\infrastructure required to support timely, accurate and
   actionable situational awareness over an organization's IT systems.
   Automation tools implementing a continuous monitoring approach will
   utilize this infrastructure together with existing and emerging
   event, incident and network management standards to provide
   visibility into the state of assets, user activities and network
   \behavior.  Stakeholders will be able to use these tools to aggregate
   and analyze relevant security and operational data to understand the
   organizations security posture, quantify business risk, and make
   informed decisions that support organizational objectives while
   protecting critical information.  Organizations will be able to use
   these tools to augment and automate information sharing activities to
   collaborate with partners to identify and mitigate threats.  Other
   automation tools will be able to integrate with these capabilities to
   enforce policies based on human decisions to harden systems, prevent
   misuse and reduce the overall attack surface.

The IETF Secretariat

---

From: "Baker, Jon" <[email-masked]>
Date: Mon, 24 Sep 2012 11:20:23 +0000

I looking through section 4 I noticed that the references to UC1 and UC2 appear to be incorrect. The document currently says,

"4.  Functional Capabilities

   In general, the activities of managing assets, configurations, and
   vulnerabilities are common between UC1 and UC2.  UC1 uses these
   activities to either grant or deny an entity access to a requested
   resource.  UC2 uses these activities in support of compliance
   measurement on a periodic basis.

   At the most basic level, an enterprise needing to satisfy UC1 and UC2
   will need certain capabilities to be met.  Specifically, we are
   talking about risk management capabilities.  This is the central
   problem domain, so it makes sense to be able to convey information
   about technical and non-technical controls, benchmarks, control
   requirements, control frameworks and other concepts in a common way."

I believe you intended to refer to UC2 and UC3. UC1 is the common piece that is used by UC2 and UC3. 

Jon

============================================
Jonathan O. Baker
G022 - IA Industry Collaboration
The MITRE Corporation
Email: [email-masked]

>From: [email-masked] [mailto:[email-masked]] On Behalf Of
>Waltermire, David A.
>Sent: Friday, September 07, 2012 3:53 PM
>To: [email-masked]
>Cc: Adam Montville
>Subject: [sacm] FW: New Version Notification for draft-waltermire-sacm-use-
>cases-02.txt
>
>I just posted an updated use cases document (see below) that reduces the
>scope to UC1-3 and adds a lot of new content.  Many thanks to Adam
>Montville for all his hard work on this revision.
>
>_______________________________________________
>sacm mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/sacm

---

From: Adam Montville <[email-masked]>
Date: Mon, 24 Sep 2012 14:24:05 +0000

You're probably right, Jon.  Either Dave or I will review and fix.  It
seems, however, that the intent was clear enough for you (the reader) to
figure out.

I'm interested in hearing any feedback about the use cases, how they're
broken down, what's missing, whether the scope is correct, and so on.

Regards,

Adam

On 9/24/12 4:20 AM, "Baker, Jon" <[email-masked]> wrote:

>I looking through section 4 I noticed that the references to UC1 and UC2
>appear to be incorrect. The document currently says,
>
>>has been successfully submitted by David Waltermire and posted to the
>>IETF
>>repository.
>>
>>URL:             
>>http://www.ietf.org/internet-drafts/draft-waltermire-sacm-use-
>>cases-02.txt
>>Status:          
>>http://datatracker.ietf.org/doc/draft-waltermire-sacm-use-cases
>>Htmlized:        
>>http://tools.ietf.org/html/draft-waltermire-sacm-use-cases-02
>>Diff:            
>>http://www.ietf.org/rfcdiff?url2=draft-waltermire-sacm-use-cases-
>>02
>>
>>Abstract: