Subject: [sacm] Questions to draft-ietf-sacm-use-cases-07

From: Linda Dunbar <[email-masked]>
Date: Tue, 15 Jul 2014 15:40:49 +0000

David W and David H:

General question:

-          Is SACM about defining the standard "data set" or is more about the "collection mechanism" of various data?

-          How is "Endpoint target" related to "endpoint"? Can you give some concrete examples?

-
Section 2.1.1:

-          Are there any examples for the "Data Definition" described in this section? or data model?

-          I can't figure out what "data" is SACM targeted for.

-
Section 2.2.1:

-          Can you give some examples of "specialized endpoint devices" referred in the first sentence of the section?

-          The first paragraph talked about manufacture publishing guidelines on how to configure their devices. Is the objective of SACM for standardize those guidelines?

-

Section 2.2.3:

-          Does SACM standardize the protocols to detect "end points" attachment to the network?

Thank you very much,

Linda Dunbar
Huawei USA IP Lab
5340 Legacy Drive,
Plano, TX 75024
Tel: +1 469-277 - 5840
Fax: +1 469 -277 - 5900

---

From: David Harrington <[email-masked]>
Date: Wed, 16 Jul 2014 11:01:49 -0400

Hi Linda,

I have drifted away from editing of this document, but I think I can answer some of your questions.

On Jul 15, 2014, at 11:40 AM, Linda Dunbar <[email-masked]> wrote:

> David W and David H:
>  
>  
> General question:
> -          Is SACM about defining the standard “data set” or is more about the “collection mechanism” of various data?

Potentially, both. The charter spells out what the SACM WG is supposed to do, and I recommend you read that to get a through answer.
My thinking on this is:
1)  SACM needs to define an architecture capable of supporting multiple protocols for collecting data and making said data accessible to processes that want to be consumers of that data.
2) SACM may need to define a generic information model for some core information, or reuse IMs from other protocols that have already modeled appropriate data sets.

> -          How is “Endpoint target” related to “endpoint”? Can you give some concrete examples?

endpoints exist in a network.
A SACM assessment process might only be interested in a subset of the available endpoints.
The members of that subset would be endpoint “targets”.
For example, an assessment might, as part of an overall assessment process, focus on assessing the current configuration of Huawei routers in a heterogeneous network, based on administratively-defined rules about how a Huawei router should be configured.
Each of the selected Huawei routers in that subset would then be an "endpoint target" for that assessment.

Are you asking for concrete example so you understand the document better, or are you asking us to add some concrete examples to the document?
(If you didn’t understand this from the current text, then some concrete examples in the document would seem a good idea….)

> -           
> Section 2.1.1:
> -          Are there any examples for the “Data Definition” described in this section? or data model?

We have the non-unique problem that, because SACM is such a broad topic, this WG draws people from multiple SDOs and multiple vendors with products in the “SACM space”.
We have avoided mentioning specific standards as examples because we feared a rush of “what about <my favorite protocol>?” requests.
Do you feel that the text is too hard to understand without examples?

> -          I can’t figure out what “data” is SACM targeted for.

Because we are currently working at such an abstract level, discussing use cases and architectures, SACM scope includes many different potential flows.
In many cases, the “data” depends on the flow involved.
For example, a collector application might collect current values from a managed switch using SNMP and MIB data models, and from a managed router using Netconf and YANG data models.
The collector might convert that data into database-specific format for storage and fast retrieval; It might organize the data into its own internal information models, organized to support its approach to security assessment.
When an assessment application asks the database for some data, it might request a specific (database-record-defined) information model’s worth of data, or a mixed-model set of data, using an SQL request
The assessment application might generate data into a report containing the results of the assessment, possibly in, let’s say, Excel format or in a text message to an operator.

Because SACM scope (security assessment) is very broad, it is hard to nail down what the data is in any particular flow, without excluding some data that somebody wants included (and is a legitimate type of data for SACM purposes).
That’s why we’re starting with a use cases document - to help identify the types of data that might be needed to address certain types of assessment.
You’re not alone. We have had lots of concern about the nebulous-ness of the “data” that SACM targets.
We have been working to better differentiate the various flows of data (data=corporate guidelines versus collected values of operational state, for example).

> -           
> Section 2.2.1:
> -          Can you give some examples of “specialized endpoint devices” referred in the first sentence of the section?

It can be any device that provides a specialized function, such as a router, a switch, a firewall device, etc.

> -          The first paragraph talked about manufacture publishing guidelines on how to configure their devices. Is the objective of SACM for standardize those guidelines?

No. I think these guidelines might be thought of as release notes.
But part of the goal would be to encourage expressing the guidelines in a machine-friendly format to promote automation, and possibly to encourage vendors to use industry standard data formats.
But even if the vendor doesn’t provide the information in a standardized format, such as a MIB module, they might explain how to use proprietary interfaces (such as a CLI) to set and retrieve the current values.
Part of the guideline would be the vendor’s recommendation for values to use for the specific model of product, to achieve a specific security-related configuration.
As an example, a vendor that supports SNMPv3 in their product might specify how to configure the View-based Access Control Model tables (SNMP-VIEW-BASED-ACM-MIB from RFC3415).
Appendix A of RFC 3415 contains an example guidelines, that could be used by a SACM assessor to assess the security posture of an initial configuration of an SNMPv3 deployment.

As another example, the NSA provides guidelines about how to configure routers for various security functionality.
See http://www.nsa.gov/ia/_files/routers/c4-040r-02.pdf

> -          Does SACM standardize the protocols to detect "end points" attachment to the network?

I expect that SACM needs to be able to support multiple protocols for this purpose.
Network Management Systems often use multiple technologies to “auto discover” a network, such as ping, trace route, SNMP, etc., and they use the information gathered to heuristically discover additional endpoints, iteratively.
SACM might use such mechanisms directly, but also might “import” the network topology from an NMS that already does auto discovery.

> Fax: +1 469 -277 - 5900

David Harrington
[email-masked]

---

From: Linda Dunbar <[email-masked]>
Date: Wed, 16 Jul 2014 22:42:22 +0000

David,

Reading through your explanation make me feel SACM is more like what NETCONF wants to do, except SACM is the reverse direction, isn't it?
NETCONF: Controller (or NMS) --> device;
SACM: devices --> Controller (or NMS)

More questions/comments are inserted below:

From: David Harrington [mailto:[email-masked]]

The members of that subset would be endpoint "targets".

[Linda] Does it mean SACM is like NETCONF, except the information is from Devices to Controller (or NMS)?

Are you asking for concrete example so you understand the document better, or are you asking us to add some concrete examples to the document?
(If you didn't understand this from the current text, then some concrete examples in the document would seem a good idea....)

[Linda] absolutely some examples will help a lot. Use cases are supposed to be examples, examples of "end points", examples of actual "data" to be collected, examples of "data-definitions" used in the draft, etc.

-
Section 2.1.1:

We have the non-unique problem that, because SACM is such a broad topic, this WG draws people from multiple SDOs and multiple vendors with products in the "SACM space".
We have avoided mentioning specific standards as examples because we feared a rush of "what about <my favorite protocol>?" requests.
Do you feel that the text is too hard to understand without examples?

[Linda] I thought that IETF doesn't do too broad problems WG. Are there examples of "Data Definitions" in mind?

Because we are currently working at such an abstract level, discussing use cases and architectures, SACM scope includes many different potential flows.
In many cases, the "data" depends on the flow involved.
For example, a collector application might collect current values from a managed switch using SNMP and MIB data models, and from a managed router using Netconf and YANG data models.
The collector might convert that data into database-specific format for storage and fast retrieval; It might organize the data into its own internal information models, organized to support its approach to security assessment.
When an assessment application asks the database for some data, it might request a specific (database-record-defined) information model's worth of data, or a mixed-model set of data, using an SQL request
The assessment application might generate data into a report containing the results of the assessment, possibly in, let's say, Excel format or in a text message to an operator.

[Linda] Does SACM target to have one proxy data models for "NETCONF, SNMP, SQL, ..."?

Because SACM scope (security assessment) is very broad, it is hard to nail down what the data is in any particular flow, without excluding some data that somebody wants included (and is a legitimate type of data for SACM purposes).
That's why we're starting with a use cases document - to help identify the types of data that might be needed to address certain types of assessment.

[Linda] Then the Use Case document should have concrete examples.

You're not alone. We have had lots of concern about the nebulous-ness of the "data" that SACM targets.
We have been working to better differentiate the various flows of data (data=corporate guidelines versus collected values of operational state, for example).

-
Section 2.2.1:

[Linda] Is SACM trying to get one model for "router/switch/firewall"? How is it different from SNMP?

No. I think these guidelines might be thought of as release notes.
But part of the goal would be to encourage expressing the guidelines in a machine-friendly format to promote automation, and possibly to encourage vendors to use industry standard data formats.
But even if the vendor doesn't provide the information in a standardized format, such as a MIB module, they might explain how to use proprietary interfaces (such as a CLI) to set and retrieve the current values.
Part of the guideline would be the vendor's recommendation for values to use for the specific model of product, to achieve a specific security-related configuration.
As an example, a vendor that supports SNMPv3 in their product might specify how to configure the View-based Access Control Model tables (SNMP-VIEW-BASED-ACM-MIB from RFC3415).
Appendix A of RFC 3415 contains an example guidelines, that could be used by a SACM assessor to assess the security posture of an initial configuration of an SNMPv3 deployment.

-

Section 2.2.3:

I expect that SACM needs to be able to support multiple protocols for this purpose.
Network Management Systems often use multiple technologies to "auto discover" a network, such as ping, trace route, SNMP, etc., and they use the information gathered to heuristically discover additional endpoints, iteratively.
SACM might use such mechanisms directly, but also might "import" the network topology from an NMS that already does auto discovery.

Thank you very much,

Linda Dunbar
Huawei USA IP Lab
5340 Legacy Drive,
Plano, TX 75024
Tel: +1 469-277 - 5840
Fax: +1 469 -277 - 5900

David Harrington
[email-masked]<mailto:[email-masked]>

---

From: Gunnar Engelbach <[email-masked]>
Date: Thu, 17 Jul 2014 11:54:55 -0400

Linda,

Let me restate what David has said in a different way and see if that is 
of any help.

SACM is about standards for automating the security assessments of 
endpoints.  That starts with an expression of security policies in a 
form that a machine can apply, but also needs to include the abilities 
to determine applicability of each policy to an endpoint (and find all 
policies that apply to an endpoint), to generate a list of endpoints, 
and to request/receive data items for each endpoint necessary to 
complete analysis of the policy(ies).

This working group is still in the process of defining requirements for 
all of this let alone determining what form any of these will take, but 
it looks like this will result in discrete components that can be used 
for other purposes.

That could mean, for example, taking advantage of a SACM-compliant 
system to collect specific data times from certain classes of endpoints 
for your own analysis, or it could mean creating automated policies that 
use SACM to produce a set of results and then doing further analysis or 
aggregation on that result set.

Given that any endpoint may or may not be owned by the interested party, 
as recognized in your proposal, there would be a spectrum along which 
security posture could be determined:

1) Direct query of endpoint attributes
2) Indirect query of endpoint attributes (SACM collection)*
3) Request for validation at the SACM policy level
4) Stating desired policy and validation via behavioral analysis
5) Stating desired policy with no external validation
6) Service Level Agreement contract
7) None.

The lower the number the more reliable (and current) the results, but a 
3rd party is certainly not going to make #1 available.  However, given 
the direction SACM is going, I would think that #2 and #3 are very possible.

Incidentally, this exact problem is something NIST started bringing 
under the SCAP umbrella about five years ago, so it's a happy confluence 
to see you bringing this up with SACM.

--gun

* A SACM query should be as reliable as a direct query, but a mechanism 
for guaranteeing this has not yet been worked out.

On 7/16/2014 6:42 PM, Linda Dunbar wrote:
> David,
>
> Reading through your explanation make me feel SACM is more like what
> NETCONF wants to do, except SACM is the reverse direction, isn’t it?
>
> NETCONF: Controller (or NMS) àdevice;
>
> SACM: devices àController (or NMS)
>
> *From:*David Harrington [mailto:[email-masked]]
>
>
>
> -How is “Endpoint target” related to “endpoint”? Can you give some
> concrete examples?
>
> For example, an assessment might, as part of an overall assessment
> process, focus on assessing the current configuration of Huawei routers
> in a heterogeneous network, based on administratively-defined rules
> about how a Huawei router should be configured.
>
> Are you asking for concrete example so you understand the document
> better, or are you asking us to add some concrete examples to the document?
>
> (If you didn’t understand this from the current text, then some concrete
> examples in the document would seem a good idea….)
>
> [Linda] absolutely some examples will help a lot. Use cases are supposed
> to be examples, examples of “end points”, examples of actual “data” to
> be collected, examples of “data-definitions” used in the draft, etc.
>
>
>
> -
>
> Section 2.1.1:
>
> -Are there any examples for the “Data Definition” described in this
> section? or data model?
>
> We have the non-unique problem that, because SACM is such a broad topic,
> this WG draws people from multiple SDOs and multiple vendors with
> products in the “SACM space”.
>
> We have avoided mentioning specific standards as examples because we
> feared a rush of “what about <my favorite protocol>?” requests.
>
> [Linda] I thought that IETF doesn’t do too broad problems WG. Are there
> examples of “Data Definitions” in mind?
>
>
>
> -I can’t figure out what “data” is SACM targeted for.
>
> Because we are currently working at such an abstract level, discussing
> use cases and architectures, SACM scope includes many different
> potential flows.
>
> For example, a collector application might collect current values from a
> managed switch using SNMP and MIB data models, and from a managed router
> using Netconf and YANG data models.
>
> The collector might convert that data into database-specific format for
> storage and fast retrieval; It might organize the data into its own
> internal information models, organized to support its approach to
> security assessment.
>
> When an assessment application asks the database for some data, it might
> request a specific (database-record-defined) information model’s worth
> of data, or a mixed-model set of data, using an SQL request
>
> The assessment application might generate data into a report containing
> the results of the assessment, possibly in, let’s say, Excel format or
> in a text message to an operator.
>
> [Linda] Does SACM target to have one proxy data models for “NETCONF,
> SNMP, SQL, …”?
>
> Because SACM scope (security assessment) is very broad, it is hard to
> nail down what the data is in any particular flow, without excluding
> some data that somebody wants included (and is a legitimate type of data
> for SACM purposes).
>
> That’s why we’re starting with a use cases document - to help identify
> the types of data that might be needed to address certain types of
> assessment.
>
> We have been working to better differentiate the various flows of data
> (data=corporate guidelines versus collected values of operational state,
> for example).
>
>
>
> -
>
> Section 2.2.1:
>
> -Can you give some examples of “specialized endpoint devices” referred
> in the first sentence of the section?
>
> It can be any device that provides a specialized function, such as a
> router, a switch, a firewall device, etc.
>
> [Linda] Is SACM trying to get one model for “router/switch/firewall”?
> How is it different from SNMP?
>
>
>
> -The first paragraph talked about manufacture publishing guidelines on
> how to configure their devices. Is the objective of SACM for standardize
> those guidelines?
>
> But part of the goal would be to encourage expressing the guidelines in
> a machine-friendly format to promote automation, and possibly to
> encourage vendors to use industry standard data formats.
>
> But even if the vendor doesn’t provide the information in a standardized
> format, such as a MIB module, they might explain how to use proprietary
> interfaces (such as a CLI) to set and retrieve the current values.
>
> Part of the guideline would be the vendor’s recommendation for values to
> use for the specific model of product, to achieve a specific
> security-related configuration.
>
> As an example, a vendor that supports SNMPv3 in their product might
> specify how to configure the View-based Access Control Model tables
> (SNMP-VIEW-BASED-ACM-MIB from RFC3415).
>
> Appendix A of RFC 3415 contains an example guidelines, that could be
> used by a SACM assessor to assess the security posture of an initial
> configuration of an SNMPv3 deployment.
>
> As another example, the NSA provides guidelines about how to configure
> routers for various security functionality.
>
> -Does SACM standardize the protocols to detect "end points" attachment
> to the network?
>
> Network Management Systems often use multiple technologies to “auto
> discover” a network, such as ping, trace route, SNMP, etc., and they use
> the information gathered to heuristically discover additional endpoints,
> iteratively.
>
> SACM might use such mechanisms directly, but also might “import” the
> network topology from an NMS that already does auto discovery.
>
>
>
> Thank you very much,
>
> Linda Dunbar
>
> *Huawei USA IP Lab*
>
> *5340 Legacy Drive,*
>
> *Plano, TX 75024*
>
> *Tel: +1 469-277 - 5840*
>
> *Fax: +1 469 -277 - 5900*
>
> David Harrington
>
> [email-masked] <mailto:[email-masked]>
>
>
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 17 Jul 2014 12:55:25 -0400

SACM doesn't preclude the use of existing interfaces to access endpoint
information, just to make sure that point is clear.  The issued a wide call
for proposals and are open to submissions to meet their use cases, etc.

On Thu, Jul 17, 2014 at 11:54 AM, Gunnar Engelbach <
[email-masked]> wrote:

> endpoints.  That starts with an expression of security policies in a form
> that a machine can apply, but also needs to include the abilities to
> determine applicability of each policy to an endpoint (and find all
> policies that apply to an endpoint), to generate a list of endpoints, and
> to request/receive data items for each endpoint necessary to complete
> analysis of the policy(ies).
>
> all of this let alone determining what form any of these will take, but it
> looks like this will result in discrete components that can be used for
> other purposes.
>
> That could mean, for example, taking advantage of a SACM-compliant system
> to collect specific data times from certain classes of endpoints for your
> own analysis, or it could mean creating automated policies that use SACM to
> produce a set of results and then doing further analysis or aggregation on
> that result set.
>
>
> 3rd party is certainly not going to make #1 available.  However, given the
> direction SACM is going, I would think that #2 and #3 are very possible.
>
>
> Incidentally, this exact problem is something NIST started bringing under
> the SCAP umbrella about five years ago, so it's a happy confluence to see
> you bringing this up with SACM.
>
>
> --gun
>
>
>

-- 

Best regards,
Kathleen

---

From: Linda Dunbar <[email-masked]>
Date: Thu, 17 Jul 2014 17:17:24 +0000

Gunnar, 

Thank you very much for the further explanation. 

David's reply indicates that the "end point" can be "routers, switches, or other devices". Is it true?

Your reply indicates that SACM is about the "Security Assessment of end point". Does it mean that SACM is about defining the security related metrics for "routers, switches or other devices"? 

Linda 

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Gunnar Engelbach
Sent: Thursday, July 17, 2014 10:55 AM
To: Linda Dunbar; David Harrington
Cc: [email-masked]; David Waltermire
Subject: Re: [sacm] Questions to draft-ietf-sacm-use-cases-07

Linda,

Let me restate what David has said in a different way and see if that is of any help.

SACM is about standards for automating the security assessments of endpoints.  That starts with an expression of security policies in a form that a machine can apply, but also needs to include the abilities to determine applicability of each policy to an endpoint (and find all policies that apply to an endpoint), to generate a list of endpoints, and to request/receive data items for each endpoint necessary to complete analysis of the policy(ies).

This working group is still in the process of defining requirements for all of this let alone determining what form any of these will take, but it looks like this will result in discrete components that can be used for other purposes.

That could mean, for example, taking advantage of a SACM-compliant system to collect specific data times from certain classes of endpoints for your own analysis, or it could mean creating automated policies that use SACM to produce a set of results and then doing further analysis or aggregation on that result set.

Given that any endpoint may or may not be owned by the interested party, as recognized in your proposal, there would be a spectrum along which security posture could be determined:

The lower the number the more reliable (and current) the results, but a 3rd party is certainly not going to make #1 available.  However, given the direction SACM is going, I would think that #2 and #3 are very possible.

Incidentally, this exact problem is something NIST started bringing under the SCAP umbrella about five years ago, so it's a happy confluence to see you bringing this up with SACM.

--gun

* A SACM query should be as reliable as a direct query, but a mechanism for guaranteeing this has not yet been worked out.

On 7/16/2014 6:42 PM, Linda Dunbar wrote:
> NETCONF wants to do, except SACM is the reverse direction, isn't it?
>
> -How is "Endpoint target" related to "endpoint"? Can you give some
> concrete examples?
>
> (If you didn't understand this from the current text, then some concrete
> examples in the document would seem a good idea..)
>
> to be examples, examples of "end points", examples of actual "data" to
> be collected, examples of "data-definitions" used in the draft, etc.
>
>
>
> -
>
> Section 2.1.1:
>
> -Are there any examples for the "Data Definition" described in this
> section? or data model?
>
> products in the "SACM space".
>
> feared a rush of "what about <my favorite protocol>?" requests.
>
> -I can't figure out what "data" is SACM targeted for.
>
> request a specific (database-record-defined) information model's worth
> the results of the assessment, possibly in, let's say, Excel format or
> [Linda] Does SACM target to have one proxy data models for "NETCONF,
> SNMP, SQL, ."?
>
> That's why we're starting with a use cases document - to help identify
> -Can you give some examples of "specialized endpoint devices" referred
> But even if the vendor doesn't provide the information in a standardized
> Part of the guideline would be the vendor's recommendation for values to
> Network Management Systems often use multiple technologies to "auto
> discover" a network, such as ping, trace route, SNMP, etc., and they use
> SACM might use such mechanisms directly, but also might "import" the

---

From: Gunnar Engelbach <[email-masked]>
Date: Thu, 17 Jul 2014 14:01:54 -0400

> David's reply indicates that the "end point" can be "routers, switches, or other devices". Is it true?

Certainly, and other things as well, such as a clustered database or and 
installed piece of software.  It's really any discrete item about which 
a policy can be expressed and the necessary data items collected.

> Your reply indicates that SACM is about the "Security Assessment of end point". Does it mean that SACM is about defining the security related metrics for "routers, switches or other devices"?

Not really the metrics, but about how those metrics can be expressed in 
a way where the determination of policy compliance can be automated.

For example, the DISA STIGs (Security Technical Information Guides) are 
documents that define a set of configuration items for a number of 
platforms that must be set at certain values in order to be compliant 
with DoD's security policies.

These have traditionally been expressed as prose documents where each 
piece of ADPE must be manually verified before the equipment is allowed 
to connect to the network.

So, for example, a Solaris 10 SPARC system used in a environment that 
requires adherence to a policy of Mission Critical Classified.  SACM 
would be interested in how to encode that policy in a manner where 
assessment can be automated, but the actual metrics codified in that 
document would be defined by DISA.

Similarly to ensure compliance with health care regulations (HIPAA), 
financial regulations (Sorbanes-Oxley), NATO, Automotive Network 
Exchange, etc.  Anything where the policy can be expressed in the SACM 
format.

SACM will also be defining the mechanism to query for and retrieve data 
items about endpoint(s), so evaluation of a policy is not the only entry 
point into a SACM system.

--gun

---

From: Gunnar Engelbach <[email-masked]>
Date: Thu, 17 Jul 2014 14:12:52 -0400

Thanks, yes, I did not mean that a SACM endpoint data collection query 
would be a replacement for any other method.

To be compliant an endpoint would need to implement the SACM collection 
query mechanism, but could also make 0 to many other interfaces available.

Endpoints that do not implement the SACM interface could still 
participate by means of a proxy.

On 7/17/2014 12:55 PM, Kathleen Moriarty wrote:
> information, just to make sure that point is clear.  The issued a wide
> call for proposals and are open to submissions to meet their use cases, etc.
>
>
>
>
> On Thu, Jul 17, 2014 at 11:54 AM, Gunnar Engelbach
> <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>     Linda,
>
>     form that a machine can apply, but also needs to include the
>     abilities to determine applicability of each policy to an endpoint
>     (and find all policies that apply to an endpoint), to generate a
>     list of endpoints, and to request/receive data items for each
>     endpoint necessary to complete analysis of the policy(ies).
>
>     This working group is still in the process of defining requirements
>     for all of this let alone determining what form any of these will
>     take, but it looks like this will result in discrete components that
>     can be used for other purposes.
>
>     system to collect specific data times from certain classes of
>     endpoints for your own analysis, or it could mean creating automated
>     policies that use SACM to produce a set of results and then doing
>     further analysis or aggregation on that result set.
>
>
>     Given that any endpoint may or may not be owned by the interested
>     party, as recognized in your proposal, there would be a spectrum
>     along which security posture could be determined:
>
>     The lower the number the more reliable (and current) the results,
>     but a 3rd party is certainly not going to make #1 available.
>       However, given the direction SACM is going, I would think that #2
>     and #3 are very possible.
>
>
>     under the SCAP umbrella about five years ago, so it's a happy
>     confluence to see you bringing this up with SACM.
>
>
>     --gun
>
>
>
>     * A SACM query should be as reliable as a direct query, but a
>     mechanism for guaranteeing this has not yet been worked out.
>
>
>
>         *From:*David Harrington [mailto:[email-masked]
>         <mailto:[email-masked]>]
>
>
>
>         A SACM assessment process might only be interested in a subset
>         of the
>         available endpoints.
>
>         You’re not alone. We have had lots of concern about the
>         nebulous-ness of
>         the “data” that SACM targets.
>
>         See http://www.nsa.gov/ia/_files/__routers/c4-040r-02.pdf
>         <http://www.nsa.gov/ia/_files/routers/c4-040r-02.pdf>
>
>
>
>         -
>
>         Section 2.2.3:
>
>         I expect that SACM needs to be able to support multiple
>         protocols for
>         this purpose.
>
>         *Tel: +1 469-277 - 5840 <tel:%2B1%20469-277%20-%205840>*
>
>         *Fax: +1 469 -277 - 5900 <tel:%2B1%20469%20-277%20-%205900>*
>
>         David Harrington
>
>         <mailto:[email-masked] <mailto:[email-masked]>>
>
>
>
>
>         _________________________________________________
>         sacm mailing list
>         [email-masked] <mailto:[email-masked]>
>         https://www.ietf.org/mailman/__listinfo/sacm
>         <https://www.ietf.org/mailman/listinfo/sacm>
>
>
>     _________________________________________________
>     sacm mailing list
>     [email-masked] <mailto:[email-masked]>
>     https://www.ietf.org/mailman/__listinfo/sacm
>     <https://www.ietf.org/mailman/listinfo/sacm>
>
>
>
>
> --
>
> Best regards,
> Kathleen

---

From: Linda Dunbar <[email-masked]>
Date: Thu, 17 Jul 2014 21:11:10 +0000

Gunnar,

What you provided is very helpful.

A few more questions:

-----Original Message-----
From: Gunnar Engelbach [mailto:[email-masked]]

Not really the metrics, but about how those metrics can be expressed in a way where the determination of policy compliance can be automated.

For example, the DISA STIGs (Security Technical Information Guides) are documents that define a set of configuration items for a number of platforms that must be set at certain values in order to be compliant with DoD's security policies.

[Linda] Can you give some examples of the "platforms" that you are talking about? What does it mean by saying "configuration items to be set at certain values"?

Does it mean that "secure login password" has to be X number of characters?

These have traditionally been expressed as prose documents where each piece of ADPE must be manually verified before the equipment is allowed to connect to the network.

So, for example, a Solaris 10 SPARC system used in a environment that requires adherence to a policy of Mission Critical Classified.
[Linda] any examples of the "policies" for Mission Critical Classified?

SACM would be interested in how to encode that policy in a manner where assessment can be automated, but the actual metrics codified in that document would be defined by DISA.

[Linda] Do you have some examples of the "policies" that are to be encoded to enable the automation?

Similarly to ensure compliance with health care regulations (HIPAA), financial regulations (Sorbanes-Oxley), NATO, Automotive Network Exchange, etc.  Anything where the policy can be expressed in the SACM format.

[Linda] Any examples of those "policies" used for HIPAA, financial regulations?

SACM will also be defining the mechanism to query for and retrieve data items about endpoint(s),

[Linda] If the end point is a router, what kind of "data items about endpoints (i.e. router)" are to be queried? Is it FIB/RIB? Or configuration of interfaces?

so evaluation of a policy is not the only entry point into a SACM system.

--gun

> Cc: [email-masked]<mailto:[email-masked]>; David Waltermire
>> process, focus on assessing the current configuration of Huawei
>> routers in a heterogeneous network, based on administratively-defined
>> rules about how a Huawei router should be configured.
>>
>> (If you didn't understand this from the current text, then some
>> concrete examples in the document would seem a good idea..)
>>
>> [Linda] absolutely some examples will help a lot. Use cases are
>> supposed to be examples, examples of "end points", examples of actual
>> "data" to be collected, examples of "data-definitions" used in the draft, etc.
>>
>>
>>
>> -
>>
>> Section 2.1.1:
>>
>> We have the non-unique problem that, because SACM is such a broad
>> topic, this WG draws people from multiple SDOs and multiple vendors
>> with products in the "SACM space".
>>
>> [Linda] I thought that IETF doesn't do too broad problems WG. Are
>> there examples of "Data Definitions" in mind?
>>
>>
>>
>> Because we are currently working at such an abstract level,
>> discussing use cases and architectures, SACM scope includes many
>> different potential flows.
>>
>> For example, a collector application might collect current values
>> from a managed switch using SNMP and MIB data models, and from a
>> managed router using Netconf and YANG data models.
>>
>> The collector might convert that data into database-specific format
>> for storage and fast retrieval; It might organize the data into its
>> own internal information models, organized to support its approach to
>> security assessment.
>>
>> When an assessment application asks the database for some data, it
>> might request a specific (database-record-defined) information
>> model's worth of data, or a mixed-model set of data, using an SQL
>> request
>>
>> The assessment application might generate data into a report
>> containing the results of the assessment, possibly in, let's say,
>> Excel format or in a text message to an operator.
>>
>> some data that somebody wants included (and is a legitimate type of
>> data for SACM purposes).
>>
>> That's why we're starting with a use cases document - to help
>> identify the types of data that might be needed to address certain
>> types of assessment.
>>
>> We have been working to better differentiate the various flows of
>> data (data=corporate guidelines versus collected values of
>> operational state, for example).
>>
>>
>>
>> -
>>
>> Section 2.2.1:
>>
>> -Can you give some examples of "specialized endpoint devices"
>> referred in the first sentence of the section?
>>
>> -The first paragraph talked about manufacture publishing guidelines
>> on how to configure their devices. Is the objective of SACM for
>> standardize those guidelines?
>>
>> But part of the goal would be to encourage expressing the guidelines
>> in a machine-friendly format to promote automation, and possibly to
>> But even if the vendor doesn't provide the information in a
>> standardized format, such as a MIB module, they might explain how to
>> use proprietary interfaces (such as a CLI) to set and retrieve the current values.
>>
>> Part of the guideline would be the vendor's recommendation for values
>> to use for the specific model of product, to achieve a specific
>> As another example, the NSA provides guidelines about how to
>> configure routers for various security functionality.
>>
>> -Does SACM standardize the protocols to detect "end points"
>> attachment to the network?
>>
>> discover" a network, such as ping, trace route, SNMP, etc., and they
>> use the information gathered to heuristically discover additional
>> endpoints, iteratively.
>>
>> [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>
>>
>>
>>
>> [email-masked]<mailto:[email-masked]>
> [email-masked]<mailto:[email-masked]>

---

From: Gunnar Engelbach <[email-masked]>
Date: Thu, 17 Jul 2014 18:19:11 -0400

On 7/17/2014 5:11 PM, Linda Dunbar wrote:
> [Linda] Can you give some examples of the “platforms” that you are
> talking about?

For the STIGs, a platform would be Solaris 9, Solaris 10, AIX 5.3, 
Windows 7, and so on.  Some STIGs also address software components like 
the .Net framework, Internet Explorer, and so on.

What does it mean by saying “configuration items to be
> set at certain values”?
> Does it mean that “secure login password” has to be X number of characters?

Exactly.  The STIGs will include rules like "The maximum password age 
must be 30 days" and "The minimum password age must be 1 day"

In total, the Windows 7 STIG has nearly 300 of these rules. 
Collectively, that set of 272 rules is the STIG policy for Windows 7. 
Each Windows 7 machine must pass every rule in order to be compliant 
with the policy.

Similarly, the USGCG policy for Windows 7 has about the same number of 
rules, most of which cover the same items, but might have different 
values.  For example, under USGCB the maximum password age is allowed to 
be 60 days.

> requires adherence to a policy of Mission Critical Classified.
> [Linda] any examples of the “policies” for Mission Critical Classified?

Mission Critical Classified (aka MAC-1 Classified) *is* the policy, as 
are other Windows 7 STIG policies, such as Administrative Public 
(MAC-III Public) or Mission Support Sensitive (MAC-II Sensitive).

Each of these policies, for the most part cover the same rules (give or 
take a few here and there) but will have more or less stringent settings 
for many of these rules depending on the security level the target 
computer is running at.

Which policy applies to which computer depends on the role and type of 
data being processed by that computer.  Matching up the proper policy to 
the proper computer is part of the assessment process.

This is a little less complicated in other areas, like USGCB or HIPAA, 
where there is a single policy that applies equally to all computers.

So a policy is made up of one or more rules, and each rule requires one 
or more data items to be evaluated.

> SACM would be interested in how to encode that policy in a manner where
> [Linda] Do you have some examples of the “policies” that are to be
> encoded to enable the automation?
> [Linda] Any examples of those “policies” used for HIPAA, financial
> regulations?
> items about endpoint(s),
> [Linda] If the end point is a router, what kind of “data items about
> endpoints (i.e. router)” are to be queried? Is it FIB/RIB? Or
> configuration of interfaces?

That depends on the policy.  Like from the STIG password example where 
the minimum and password ages are part of the policy those two data 
items would need to be known about each endpoint to which the policy 
applies.  Full evaluation of the policy would require all of the needed 
data items and nothing more, and the policy would need to specify what 
those data items are.  Those data items would then be collected and the 
level of policy compliance could be computed.

>> Cc:[email-masked] <mailto:[email-masked]>; David Waltermire
>> SACM is about standards for automating the security assessments of endpoints.  That starts with an expression of security policies in a form that a machine can apply, but also needs to include the abilities to determine applicability of each policy to  an endpoint (and find all policies that apply to an endpoint), to
> generate a list of endpoints, and to request/receive data items for each
>>> Seehttp://www.nsa.gov/ia/_files/routers/c4-040r-02.pdf
>>>
>>>
>>>
>>> -
>>>
>>> Section 2.2.3:
>>>
> <mailto:[email-masked]>
>>>
>>>
>>>

---

From: Gunnar Engelbach <[email-masked]>
Date: Thu, 17 Jul 2014 18:53:15 -0400

It seemed like I was getting a little wordy there so I tried to restrain 
myself, but it occurs to me that maybe I should clarify something.

When I refer to STIG, USGCG, HIPAA, etc, policies, those are all just 
one class of policy -- measuring conformity with security settings.

There can be other kinds of policies.  Such as determining 
susceptibility to known vulnerabilities, or if disallowed software is 
installed, or if there is evidence of malware, and so on.

--gun

On 7/17/2014 6:19 PM, Gunnar Engelbach wrote:
>>> (and find all policies that apply to an endpoint), to
>>> The lower the number the more reliable (and current) the results, but
>>> a 3rd party is certainly not going to make #1 available.  However,
>>> given the direction SACM is going, I would think that #2 and #3 are
>>> very possible.
>>>
>>>