Subject: Re: [sacm] [draft-ietf-sacm-terminology] Definition of "Asset" (#1)

From: henkbirkholz <[email-masked]>
Date: Thu, 02 Jul 2015 09:24:51 -0700

#### Various Related References

##### ISO/IEC 27000:2014

It seems the term Asset was dropped from Section 2 “terms and definition” in ISO/IEC 27000:2014? (http://standards.iso.org/ittf/PubliclyAvailableStandards/c063411_ISO_IEC_27000_2014.zip)

##### Common Criteria

Definitions from CC (https://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R4.pdf):

"target of evaluation (TOE): set of software, firmware and/or hardware possibly accompanied by guidance."
"operational environment: environment in which the TOE is operated"
"component TOE: successfully evaluated TOE that is part of another composed TOE"
"composed TOE: TOE comprised solely of two or more components that have been successfully evaluated"
"functional interface: external interface providing a user with access to functionality of the TOE which is not directly involved in enforcing security functional requirements".

**Question**: Can a Target Endpoint be interpreted as a specialization of a TOE?

##### 802.1AR

There also is the definition of Aggregate Device from IEEE 802.1ar:
“aggregate device: A device containing multiple logical or physical devices.”
But device is different from endpoint in that specific “secure device identifier” context:
“device: A device is any entity that has a single IDevID credential.”

##### RFC4949

The definition of Asset from RFC4949 (Internet Security Glossary, Version 2) seems to be quite specific due to the context of the RFC:
“(I) A system resource that is (a) required to be protected by an information system's security policy, (b) intended to be protected by a countermeasure, or (c) required for a system's mission.”

#### Usage in SACM

Asset is currently defined in the terminology draft and the information model (in section 4.1.  "Software Component"). The definitions are basically a reference to RFC4949. There is a conflicting definition in the "attic" of the IM draft in section B.1.1. "Pre-defined and Modified Terms", which exeeds the scope of Endpoints ("anything that has value to an organization").

The requirements draft (“the assets composing an endpoint”) and the use-cases draft (“endpoints and the assets they are composed of”) indicate that endpoints are composed of assets. The information model draft highlights that “hardware components may also be assets and/or harmful”.

On one hand, it seems that there is implicit consensus that endpoints are composed of assets. On the other hand, outside of SACM Asset seems to be the more general term compared to Endpoint.

**Question**: Is there actually consensus about Assets being the components of Endpoints?

Unfortunately, defining Assets as "components of endpoints" or "building blocks of endpoints" might raise a new issue: Component is an already used as a vital term in the architecture draft and Building Blocks is already defined in the terminology draft.

**Question**: Would defining and differentiating SACM Components and Endpoint Components (e.g. Hardware Component or Software Component) improve the current situation?
**Question**: Do we need the term Asset for more than a point of reference (included mabye in the definition of Endpoint or potentially Endpoint Component)?

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/1#issuecomment-118084348

---

From: adammontville <[email-masked]>
Date: Sun, 19 Jul 2015 02:23:47 -0700

What if we expand the definition of asset to recognize that assets are composite in nature?  Such a recognition would not interrupt the RFC4949 definition of asset too much, and may obviate the need to differentiate between SACM Components and Endpoint Components.  

Jim's initial examples of USB port and user identity, both of which exist as part of an endpoint, the composite view of asset coupled with RFC4949 (I)(a) qualification of "asset" would seem to be covered.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/1#issuecomment-122641726

---

From: llorenzin <[email-masked]>
Date: Tue, 21 Jul 2015 05:29:50 -0700

During our discussion this morning, we were struggling to grasp the relationships between an endpoint, an asset, and an attribute, and we realized that the definition of "asset" in the terminology draft is not sufficiently clear for our purposes.  We clarified among ourselves that:

An asset can be composed of other assets
An endpoint is composed of assets
An endpoint is itself an asset

An attribute is a property of an endpoint, and it's more specifically a property of an asset on an endpoint

Examples:
User account existing on a machine = asset
Hardware component = asset
Software component = asset
Logged-in user = attribute

This seems to be relevant to multiple definitions (asset, attribute, endpoint) so perhaps we need a separate section on relationships between terms?

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/1#issuecomment-123290236