Subject: [sacm] From Today's Architecture Discussion

From: "Adam W. Montville" <[email-masked]>
Date: Tue, 22 Jul 2014 17:11:23 -0400

Today several of us sat down to talk about the architecture draft - specifically to identify improvements.  I captured a list of things that either require further discussion or that we know we want to address.  Hopefully, the categorization of these items are faithfully represented below.  We will be meeting again tomorrow from 5-7pm and on Thursday from 9-11am (Eastern) on-site at IETF 90.  If those who attended the WebEx today thought it was useful, I can set up another - I know at least Gunnar had an issue being heard via WebEx (apologies for that).  

For those who were present during today’s discussion, feel free to bash what I’ve written below for “things we know we need to do” and “for further discussion”.

Next Steps:

Wednesday: Walking through a usage scenario (preferably from the use case draft), which will inform both architecture and information model.
Thursday: Start folding together the two information model drafts.  
Friday: Second SACM session

————————

Things we know we need to do:
Define and relate to each other the concepts of “role”, “function”, and “capability.”  
Provide better segregation between control plane vs. data plane operations (functions? capabilities?)
Partition transport and what is transported
Be more specific about how we integrate/interact/relate with other IETF efforts (i.e. NEA, MILE, etc.)
Might we consider referencing their architectures?

For further discussion:
How do we talk about “repositories” and “security automation data” in the architecture draft?  Four repositories were mentioned (including one from Gunnar):
Guidance
Attribute
Evaluation results
Classification/Taxonomy
Collection providers as proxy (i.e. mediation between protocols; select options as part of timing information)
Control plane interfaces: Should the architecture document define these, or should these be expressed elsewhere?
What are the data flows required within the SACM ecosystem and how do these flows inform information models?
The subject of timing/time-stamping is probably better put in requirements, but could be discussed in architecture
Provider/Consumer chaining and/or delegation - we may want to include something about this on an informative basis and certainly don’t want to preclude this ability
Provisioning/registration
There was some discussion about whether this is “information model” or “architecture” material - or something else (i.e. ops spec?)
“Discovery” is as client, not as endpoint (i.e. active scanning for previously unknown endpoints is not in scope here)

Kind Regards,

Adam