Subject: Re: [sacm] [draft-ietf-sacm-terminology] We need a set of common security service terms for common usage among all of the documents (#2)

From: henkbirkholz <[email-masked]>
Date: Fri, 03 Jul 2015 02:23:34 -0700

There is consensus in the group to add the following terms:

data confidentiality, data integrity, authorization, authentication.

Jim provided well suited references from RFC4949, which will be included in the terminology draft.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/2#issuecomment-118289708

---

From: henkbirkholz <[email-masked]>
Date: Fri, 03 Jul 2015 02:25:42 -0700

There is consensus in the group to include a term, such as Origin of Data or Data Origination, and - as a point of reference – the term Data Provenance to the terminology.

#### Data Origin

The current proposal “A property that verifies the identity of a system entity that is claimed to be the original source of received data.” implies the task of “verification of identity”.

**Question**: Is that intentional and would this be in the scope of SACM?

There was discussion in the group about the differentiation between an “determined endpoint identity” and the “task of identifying an endpoint”. There is no final consensus about this in the group.

**Question**: Is consensus regarding this a prerequisite to agree on related terminology?

Meanwhile, a slightly modified definition could be added to the terminology, as a first step:

“One or more properties that enable a SACM component to identify an Endpoint that is claimed to be the original source of received data.”

**Question**: Is Original Source sufficiently self-explaining?

#### Data Provenance

While a “chain of custody” or “historical record” of raw (“collectible”) endpoint attributes is out of scope for SACM, there remains the question if this is also true for SACM payload transported and refined between SACM components. A core functionality of SACM is the aggregation and correlation of data to enable better refined and more complex assertions regarding endpoint posture.

**Question**: Is a “historical record” in this context also out of scope for SACM?

As a first step, the following definition could be added tho the terminology:

“data provenance: a historical record of the origins and evolution of data that is influenced by inputs, entities, functions and processes.”

This example is based on definitions found in:

Pohly, Devin J., Stephen McLaughlin, Patrick McDaniel, and Kevin Butler. "Hi-Fi: collecting high-fidelity whole-system provenance." In Proceedings of the 28th Annual Computer Security Applications Conference, pp. 259-268. ACM, 2012.

and

McDaniel, Patrick, Kevin RB Butler, Stephen E. McLaughlin, Radu Sion, Erez Zadok, and Marianne Winslett. "Towards a Secure and Efficient System for End-to-End Provenance." In 2nd USENIX Workshop on the Theory and Practice of Provenance, 2010.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/2#issuecomment-118290158

---

From: Jerome Athias <[email-masked]>
Date: Sat, 04 Jul 2015 22:05:57 -0700

The Committee on National Security Systems (CNSS) Glossary
, CNSSI No. 4009 could be used/adapted to context
Ref. https://www.cnss.gov/CNSS/issuances/Instructions.cfm

In it, "data provenance":
"In the context of computers and law enforcement use, it is an equivalent
term to chain of custody. It involves the method of generation,
transmission and storage of information that may be used to trace the
origin of a piece of information processed by community resources. Source:
ISA SSA (adapted)"

2015-07-03 12:25 GMT+03:00 henkbirkholz <[email-masked]>:

> There is consensus in the group to include a term, such as Origin of Data
> or Data Origination, and - as a point of reference – the term Data
> Provenance to the terminology.
> Data Origin
>
> The current proposal “A property that verifies the identity of a system
> entity that is claimed to be the original source of received data.” implies
> the task of “verification of identity”.
>
> *Question*: Is that intentional and would this be in the scope of SACM?
>
> There was discussion in the group about the differentiation between an
> “determined endpoint identity” and the “task of identifying an endpoint”.
> There is no final consensus about this in the group.
>
> *Question*: Is consensus regarding this a prerequisite to agree on
> related terminology?
>
> “One or more properties that enable a SACM component to identify an
> Endpoint that is claimed to be the original source of received data.”
>
> *Question*: Is Original Source sufficiently self-explaining?
> Data Provenance
>
> While a “chain of custody” or “historical record” of raw (“collectible”)
> endpoint attributes is out of scope for SACM, there remains the question if
> this is also true for SACM payload transported and refined between SACM
> components. A core functionality of SACM is the aggregation and correlation
> of data to enable better refined and more complex assertions regarding
> endpoint posture.
>
> *Question*: Is a “historical record” in this context also out of scope
> for SACM?
>
> “data provenance: a historical record of the origins and evolution of data
> that is influenced by inputs, entities, functions and processes.”
>
> Pohly, Devin J., Stephen McLaughlin, Patrick McDaniel, and Kevin Butler.
> "Hi-Fi: collecting high-fidelity whole-system provenance." In Proceedings
> of the 28th Annual Computer Security Applications Conference, pp. 259-268.
> ACM, 2012.
>
> and
>
> McDaniel, Patrick, Kevin RB Butler, Stephen E. McLaughlin, Radu Sion, Erez
> Zadok, and Marianne Winslett. "Towards a Secure and Efficient System for
> End-to-End Provenance." In 2nd USENIX Workshop on the Theory and Practice
> of Provenance, 2010.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/2#issuecomment-118290158>
> .
>

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/2#issuecomment-118579789