Subject: [sacm] comments for draft-handt-sacm-alternate-architecture-01

From: Chris Inacio <[email-masked]>
Date: Wed, 31 Jul 2013 19:22:21 +0000

I really like the concreteness of the architecture, its easy to think about.  But I feel like this alternative isn't complete enough.  From my comments in the review of the draft-waltermire-sacm-architecture-00 architecture, I really feel like more than just BPD's (which I think is code for IDS/IPS) should be considered to complete the situational awareness (SA) picture.

I believe that we need to include passive asset devices, active vuln scan capability, and machine config management (Windows AD, Red Hat Satellite Server, Puppet, CFEngine, MDM systems, …).  I don't think that is covered in your model.

So after we've done all of this evaluation - what are the protocols used to reconfigure the network to isolate a compromised / at risk machine?  Is that all NETCONF?

--
Chris Inacio
[email-masked]