Subject: Re: [sacm] call for reviewers for NEA/TNC specs (corrected)

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 9 Jun 2015 13:46:53 +0000

Hi,

We did not receive any answers to this call for volunteers. The next virtual meeting is less than three weeks away and we need at least a reviewer to read and evaluate this work. Please step ahead.

Thanks and Regards,

Dan

From: sacm [mailto:[email-masked]] On Behalf Of Romascanu, Dan (Dan)
Sent: Wednesday, May 20, 2015 12:13 PM
To: [email-masked]
Subject: [sacm] call for reviewers for NEA/TNC specs (corrected)

Following the virtual interim meeting last week we would like to have (at least) one SACM assigned reviewer looking into the relevant NEA/TNC specifications.

The relevant specifications are available at:

Endpoint Compliance Profile: http://www.trustedcomputinggroup.org/files/static_page_files/1B8D6839-1A4B-B294-D005B7E08AFD599C/Endpoint%20Compliance%20Profile%20v1r10.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_1B8D6839-2D1A4B-2DB294-2DD005B7E08AFD599C_Endpoint-2520Compliance-2520Profile-2520v1r10.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=F9UWbX2-VvBwthJ6zxRlHI8telBw-9u1zMk3wT8Wfyw&e=>

IF-IMC: http://www.trustedcomputinggroup.org/files/static_page_files/1D8C8F15-1A4B-B294-D0CD725393CC0A93/TNC_IFIMC_v1_3_r18.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_1D8C8F15-2D1A4B-2DB294-2DD0CD725393CC0A93_TNC-5FIFIMC-5Fv1-5F3-5Fr18.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=xAxT9cvhiY96L0stYHZkcNkjXnTgT1DlchZcj4GT59Y&e=>

IF-IMV: http://www.trustedcomputinggroup.org/files/static_page_files/1B8DC7E9-1A4B-B294-D03FF940B830FADE/TNC_IFIMV_v1_4_r10.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_1B8DC7E9-2D1A4B-2DB294-2DD03FF940B830FADE_TNC-5FIFIMV-5Fv1-5F4-5Fr10.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=aKjwHATD-6rWHd1OecZRRcgwYlGJgtM2CUDGuWgDNVc&e=>

SWID Messages for IF-M (DRAFT): http://www.trustedcomputinggroup.org/files/static_page_files/14609086-1A4B-B294-D01DE94EC996C8B9/SWID_Messages_For_IFM_v1r26-forreview.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_14609086-2D1A4B-2DB294-2DD01DE94EC996C8B9_SWID-5FMessages-5FFor-5FIFM-5Fv1r26-2Dforreview.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=I5_VmcDFCBZelKYXc8yl3SemYD_POgn6PYGCf3UnLiE&e=>

PDP Server Discovery and Validation (DRAFT): http://www.trustedcomputinggroup.org/files/static_page_files/AC1492C5-1A4B-B294-D0C02056A4F9A400/PDP_Discovery_And_Validation_v1_0r9.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.trustedcomputinggroup.org_files_static-5Fpage-5Ffiles_AC1492C5-2D1A4B-2DB294-2DD0C02056A4F9A400_PDP-5FDiscovery-5FAnd-5FValidation-5Fv1-5F0r9.pdf&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=1KfSQg7cx9B50Qm7VrFirN3WhKw13x7Pqy1Zq09Rni8&e=>
(note: a new draft, with substantial revisions, is due out for public review quite soon)

NEA specifications: https://datatracker.ietf.org/wg/nea/documents/<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_wg_nea_documents_&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=ruOyuWwnHnogIhqUeg8XacVqUkSHfA6h9zxqe6CFkdY&e=>

strongSwan's implementation: https://wiki.strongswan.org/projects/strongswan/wiki/TrustedNetworkConnect<https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.strongswan.org_projects_strongswan_wiki_TrustedNetworkConnect&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=I4dzGxR31OcNXCJfQzvlsiLQfucBXRucPvdrphpBsFA&m=y6s52Q7WpFP68SM_YmTCikbDhcr5yjHFzSGDpfKl7Dk&s=4W-yiw2AChRs6ihRRhXHGrynlAhTESFtwMJgOcq1xuU&e=>

The purpose of this assessment is to evaluate how the NEA/TNC specifications meet the requirements for SACM and can fit into the SACM framework.
The timeline is until the next SACM interim meeting on June 29 or 30. Earlier would be appreciated.

Thanks and Regards,

Dan

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 9 Jun 2015 13:57:03 +0000

I will review them and give comments by the end of this week.

Linda

From: sacm [mailto:[email-masked]] On Behalf Of Romascanu, Dan (Dan)
Sent: Tuesday, June 09, 2015 8:47 AM
To: [email-masked]
Subject: Re: [sacm] call for reviewers for NEA/TNC specs (corrected)

Hi,

Thanks and Regards,

Dan

From: sacm [mailto:[email-masked]] On Behalf Of Romascanu, Dan (Dan)
Sent: Wednesday, May 20, 2015 12:13 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [sacm] call for reviewers for NEA/TNC specs (corrected)

Thanks and Regards,

Dan

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 15 Jun 2015 09:14:06 +0000

The Endpoint Assessment (NEA) is to assess endpoints to determine their compliance with security policies. SACM is to continuously monitor endpoint. How different they are?

Using  my work PC as an example, it has company installed agent which communicates with its manager to automatically update my virus files, and monitor my activities on the PC.

Are  NEA and SACM  both for establishing a standard protocol between the agent on my PC and its manager?

Can NEA protocol be used to achieve what SACM intends to do?

NEA architecture is very similar to TNC architecture (TCG IF-M 1.0 protocol)

draft-shah-sacm-tnc-architecture uses TNC architecture for SACM.

Does it mean that TNC, NEA, SACM all have the same architecture?

Linda

Hi,

Thanks and Regards,

Dan

Thanks and Regards,

Dan

---

From: Jerome Athias <[email-masked]>
Date: Mon, 15 Jun 2015 13:18:24 +0300

Does TNC, NEA provide answers to our use cases? (e.g. other than
Network Access Control)

>From a Common Criteria based evaluation point of view, will it be able
to generate a -detailed- level of audit?
(Ref. CCPART2V3.1R4, FAU_GEN.1.1. "Detailed - any configuration
changes made to the mechanism, including the actual configuration
values before and after the change.")

2015-06-15 12:14 GMT+03:00 Linda Dunbar <[email-masked]>:
>
>
> The Endpoint Assessment (NEA) is to assess endpoints to determine their
> compliance with security policies. SACM is to continuously monitor endpoint.
> How different they are?
>
>
>
> Using  my work PC as an example, it has company installed agent which
> communicates with its manager to automatically update my virus files, and
> monitor my activities on the PC.
>
>
>
> We did not receive any answers to this call for volunteers. The next virtual
> meeting is less than three weeks away and we need at least a reviewer to
> read and evaluate this work. Please step ahead.
>
>
>
> Thanks and Regards,
>
>
>
> Dan
>
>
>
>
>
> Following the virtual interim meeting last week we would like to have (at
> least) one SACM assigned reviewer looking into the relevant NEA/TNC
> specifications.
>
>
>
> Endpoint Compliance Profile:
> http://www.trustedcomputinggroup.org/files/static_page_files/1B8D6839-1A4B-B294-D005B7E08AFD599C/Endpoint%20Compliance%20Profile%20v1r10.pdf
>
>
>
> IF-IMC:
> http://www.trustedcomputinggroup.org/files/static_page_files/1D8C8F15-1A4B-B294-D0CD725393CC0A93/TNC_IFIMC_v1_3_r18.pdf
>
>
>
> IF-IMV:
> http://www.trustedcomputinggroup.org/files/static_page_files/1B8DC7E9-1A4B-B294-D03FF940B830FADE/TNC_IFIMV_v1_4_r10.pdf
>
>
>
> SWID Messages for IF-M (DRAFT):
> http://www.trustedcomputinggroup.org/files/static_page_files/14609086-1A4B-B294-D01DE94EC996C8B9/SWID_Messages_For_IFM_v1r26-forreview.pdf
>
>
>
> PDP Server Discovery and Validation (DRAFT):
> http://www.trustedcomputinggroup.org/files/static_page_files/AC1492C5-1A4B-B294-D0C02056A4F9A400/PDP_Discovery_And_Validation_v1_0r9.pdf
>
> NEA specifications: https://datatracker.ietf.org/wg/nea/documents/
>
>
>
> strongSwan's implementation:
> https://wiki.strongswan.org/projects/strongswan/wiki/TrustedNetworkConnect
>
>
>
>
>
> The purpose of this assessment is to evaluate how the NEA/TNC specifications
> meet the requirements for SACM and can fit into the SACM framework.
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 15 Jun 2015 23:08:31 +0000

Jerome, 

Are you saying that SACM provides Audit that can't be achieved by NEA and TNC?

I never participated in the NEA WG discussion other than reviewing the NEA RFCs as requested by SACM Chair Dan for comparison to SACM. 
Based on the RFC5209, NEA is a mechanism to evaluate the
posture of a system, it can check if the end points have the required security postures. Sounds like what SACM is claiming to do.

Linda

-----Original Message-----
From: Jerome Athias [mailto:[email-masked]] 
Sent: Monday, June 15, 2015 5:18 AM
To: Linda Dunbar
Cc: Romascanu, Dan (Dan); [email-masked]
Subject: Re: [sacm] What are the difference between NEA, TNC architecture and SACM architecture?

Does TNC, NEA provide answers to our use cases? (e.g. other than Network Access Control)

From a Common Criteria based evaluation point of view, will it be able to generate a -detailed- level of audit?
(Ref. CCPART2V3.1R4, FAU_GEN.1.1. "Detailed - any configuration changes made to the mechanism, including the actual configuration values before and after the change.")

2015-06-15 12:14 GMT+03:00 Linda Dunbar <[email-masked]>:
>
>
> The Endpoint Assessment (NEA) is to assess endpoints to determine 
> their compliance with security policies. SACM is to continuously monitor endpoint.
> How different they are?
>
>
>
> communicates with its manager to automatically update my virus files, 
> and monitor my activities on the PC.
>
>
>
> We did not receive any answers to this call for volunteers. The next 
> virtual meeting is less than three weeks away and we need at least a 
> reviewer to read and evaluate this work. Please step ahead.
>
>
>
> Thanks and Regards,
>
>
>
> Dan
>
>
>
>
>
> http://www.trustedcomputinggroup.org/files/static_page_files/1B8D6839-
> 1A4B-B294-D005B7E08AFD599C/Endpoint%20Compliance%20Profile%20v1r10.pdf
>
>
>
> IF-IMC:
> http://www.trustedcomputinggroup.org/files/static_page_files/1D8C8F15-
> 1A4B-B294-D0CD725393CC0A93/TNC_IFIMC_v1_3_r18.pdf
>
>
>
> IF-IMV:
> http://www.trustedcomputinggroup.org/files/static_page_files/1B8DC7E9-
> 1A4B-B294-D03FF940B830FADE/TNC_IFIMV_v1_4_r10.pdf
>
>
>
> http://www.trustedcomputinggroup.org/files/static_page_files/14609086-
> 1A4B-B294-D01DE94EC996C8B9/SWID_Messages_For_IFM_v1r26-forreview.pdf
>
>
>
> http://www.trustedcomputinggroup.org/files/static_page_files/AC1492C5-
> 1A4B-B294-D0C02056A4F9A400/PDP_Discovery_And_Validation_v1_0r9.pdf
>
> The purpose of this assessment is to evaluate how the NEA/TNC 
> specifications meet the requirements for SACM and can fit into the SACM framework.
>

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 30 Jun 2015 22:09:48 +0000

SACM group,

I have reviewed all the documents listed below. Here is my summary on how they meet the requirement for SACM and if they fit into SACM framework:

-          The Endpoint Assessment (NEA) is to assess endpoints to determine their compliance with security policies. SACM is to continuously monitor endpoints.  They have similar goals. IMHO, NEA definitely fits into SACM framework. One may argue that SACM requires monitoring endpoints not within enterprise network, whereas NEA only monitor endpoints within the enterprise network. But I think the differences are only in the FW setting. In terms of mechanism, they are same.

One view point is that SACM also does Audit that can't be achieved by NEA or TNC, as shown in :
Ref. CCPART2V3.1R4, FAU_GEN.1.1. "Detailed - any configuration changes made to the mechanism, including the actual configuration values before and after the change."

But I would think "Audit" is periodic checking of the running status. Therefore, NEA should be utilized by SACM. There should a qualifier for "what types of configuration", because there are a lot of configurations that are specific to end points which have no implication on security.

-          NEA architecture is very similar to TNC architecture (TCG IF-M 1.0 protocol).  draft-shah-sacm-tnc-architecture uses TNC architecture for SACM.

I think that TNC, NEA, SACM all have the same architecture.

Regards, Linda Dunbar

Thanks and Regards,

Dan

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 1 Jul 2015 04:33:02 +0000

Thanks, Linda.

Comments on the mail list are welcome.

I suggest to include a short item on the agenda at IETF 93 to discuss. Same wrt. OVAL.

Regards,

Dan

From: Linda Dunbar [mailto:[email-masked]]
Sent: Wednesday, July 01, 2015 1:10 AM
To: Romascanu, Dan (Dan); [email-masked]
Subject: Summary of the review comments for NEA/TNC specs (to see if they meet the requirement for SACM and can fit into the SACM framework)

SACM group,

Regards, Linda Dunbar

Thanks and Regards,

Dan