Subject: [sacm] http://tools.ietf.org/html/draft-waltermire-sacm-architecture-00 comments

From: Chris Inacio <[email-masked]>
Date: Wed, 31 Jul 2013 18:57:08 +0000

I think the architecture draft would be helped TREMENDOUSLY by defining some terminology and using it to describe the intents of the architecture.  By having everything be defined as "DF #", it isn't very descriptive.  It doesn't have to be named in any form that implies using any particular solution (obviously, that would be bad) but by defining an architecture, you are effectively splitting the problem into (hopefully) manageable components with defined tasks.

Maybe splitting terminology out of the use-case doc and into a separate doc so that everything can use it (and for easier reference in the future.)

Additionally, since we are the IETF, maybe we want to call the DF's protocols - it's kind of our bread and butter. :)

Second general comment, I understand the goal of the document/architecture being such that an we could use a passive/active separate evaluator to create information about a <host> - but I think that's hard to discern from the architecture.  Second, from the architecture, it's hard to discern that the goal is to evaluate a <host>.  I'm using <host>, the charter uses endpoint.  Can we identify what that is - because I'm not so sure.  Does that include a manageable network switch?  A printer?  A laptop?  What if the printer runs Windows?

RFC5209 (NEA requirements) defines endpoint as:

Endpoint - Any computing device that can be connected to a network.
      Such devices normally are associated with a particular link layer
      address before joining the network and potentially an IP address
      once on the network.  This includes: laptops, desktops, servers,
      cell phones, or any device that may have an IP address.

Is that the intended scope for SACM?  (It's copied into the use cases, and references 5209 there, that way.)

The Controller:

The controller receives data collection tasks?  From whom, where?

In the LMAP working group, derived from the IPPM working group (mostly well aligned to the broadband forum) the terminology in use is Instructions and Reports.  From that paragraph, I would be, I imagine the controller as an intelligent MEDIATOR (stealing terminology from IPFIX) which can be inline to sensors and understands the sensor & evaluator infrastructure such that it can take complex tasks and allocate them appropriately - and then combine the results?

Is that the intention?

If I turn that into reality, then I might have something like:

And passive asset/vulnerability device at the border, and IDS at the border, a active scanner inside the appropriate network segment, some host based agents able to send back configuration status, and the software configuration system.  (Product wise, if it helps people, think:  passive inventory:Tennable PVS, active scanner: Nmap/metasploit, host agents: McAfee ePolicy Orchestrator/End Point Protection, software config management: Windows AD.)

At some central console (no idea where / if that fits into the architecture) I send a task (née Instruction) to the Controller.  The Controller, using something akin to a compiler, breaks the Instruction down into sub-Instructions and sends those to the passive asset/vuln detector, active vuln scanner, host based config agent, and software config management system.  Presumably, because this is about security, and we're not very trusting folks, the Controller asks as MANY as possible the same question.

Then the Controller receives the Reports, presumably it detects discrepancies.

I'm nervous about what level of detail we dictate about the Controller, especially with respect to the Data Store.  That's really an implementors choice I think.  Not that we don't acknowledge its existence, but I'm not sure how detailed describing the iteration with data store should be.  We need describe the Controllers function, not how it gets it done.

Can a Controller task another Controller?  Or can a Controller pretend its a sensor?  Is there a trust system involved?  Is the trust transitive?

Content Repository:

What are the security requirements for the Content Repository?  Everything accesses it, including potentially compromised endpoints.  Is that really necessary?  It seems almost as if the glueing together of the system is via the Content Repository. 

I'm not really clear, what the Content Repository really is.  Is it a big Oracle system (or Postgres, CouchDB, MonetDB, MongoDB, or … for anyone who has their favorite DB system) with 3 extra protocols on top that aren't SQL?

--
Chris Inacio
[email-masked]