Subject: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #6 - Storage of Collected Data

From: "Haynes, Dan" <[email-masked]>
Date: Wed, 18 May 2016 11:55:06 +0000

During yesterday's virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide's from the meeting can be found here [4].

One issue that we didn't have a chance to discuss, because we ran out of time, was whether or not we need to update text, such as the following, to account for the fact that in the SACM breakout session, during IETF 95 [5], the group seemed to be in agreement that SACM is primarily concerned with data-in-motion and not data-at-rest which could be left as an area where product vendors could differentiate themselves.

"Moreover, the scenario incorporates long-term storage of collected data, vulnerability description information, and assessment results in order to facilitate meaningful and ongoing reassessment."

So, this really breaks down into two questions.

1.       Is the WG in agreement that SACM is primarily focused on data-in-motion rather than data-at-rest as proposed during the breakout session?

2.       If so, do we need to update text (like above), in the Vulnerability Assessment Scenario, to de-emphasize the focus on the long-term storage of data?

If you have any thoughts on this issue, please provide feedback by May 31st.  We are planning to have an updated version of the scenario for June 8th.

Thanks,

Danny

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://github.com/sacmwg/vulnerability-scenario/pull/3
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html
[4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks like the slides are not available just yet, but, I suspect they should be soon)
[5] https://www.ietf.org/mail-archive/web/sacm/current/msg03907.html

---

From: Adam Montville <[email-masked]>
Date: Thu, 19 May 2016 19:14:20 -0500

> On May 18, 2016, at 6:55 AM, Haynes, Dan <[email-masked]> wrote:
> 
> “Moreover, the scenario incorporates long-term storage of collected data, vulnerability description information, and assessment results in order to facilitate meaningful and ongoing reassessment.”
> 

I believe we are focused primarily on data-in-motion.

> 2.       If so, do we need to update text (like above), in the Vulnerability Assessment Scenario, to de-emphasize the focus on the long-term storage of data?

I do not believe we are focused exclusively on data-in-motion, and do not see harm in the referenced sentence.  The scenario should incorporate long-term storage of collected data, even if such incorporation treats that long-term storage as a black box with an interface.

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 24 May 2016 11:47:06 +0000

Thanks for the feedback Adam!  Do others have thoughts on these two questions?

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Thursday, May 19, 2016 8:14 PM
To: Haynes, Dan <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #6 - Storage of Collected Data

On May 18, 2016, at 6:55 AM, Haynes, Dan <[email-masked]<mailto:[email-masked]>> wrote:

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 24 May 2016 09:21:55 -0400

The key related issues both technically and
legally concern how this work is integrated
with STIX and CybOX.

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 24 May 2016 13:29:08 +0000

Hi Tony,

I don't see why structured threat intelligence information couldn't be stored in a SACM repository and used to drive the assessment of endpoints with respect to indicators of compromise.  Is that what you getting at?

Thanks,

Danny

From: Tony Rutkowski [mailto:[email-masked]]
Sent: Tuesday, May 24, 2016 9:22 AM
To: Haynes, Dan <[email-masked]>; Adam Montville <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #6 - Storage of Collected Data

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 24 May 2016 10:06:12 -0400

As an individual, if you mean the structured defined are targeted at
in motion, I am for that option.  For interoperability, consistent
methods to exchange the data between vendors is needed.

However, if you use a RESTful interface, you'll want access to that
data using an interface that lets you access that data using the
defined format for transport.

Kathleen

On Tue, May 24, 2016 at 9:29 AM, Haynes, Dan <[email-masked]> wrote:
> Hi Tony,
>
>
>
> I don’t see why structured threat intelligence information couldn’t be
> stored in a SACM repository and used to drive the assessment of endpoints
> with respect to indicators of compromise.  Is that what you getting at?
>
>
>
> Thanks,
>
> Danny
>
>
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

-- 

Best regards,
Kathleen

---

From: Michael Godsey <[email-masked]>
Date: Tue, 24 May 2016 14:30:56 +0000

Agreed, Adam.  I would think we don’t want to imply the focus is only on data-in-motion, even if the primary focus is that.  I think long term storage of the data is a separate scenario even, but if we limit to just data-in-motion, how do we treat data-at-rest which itself is still being used in the assessment process, or which can be leveraged for some time even if not yet relegated to long term storage?   Seems we don’t want to focus on only the very narrow time slice of data while in-motion, but also the surrounding timeframe whereby data is captured, analyzed, and persists for a while more data is captured, possibly over defined time slices or just some “near term” future time period.

From: sacm [mailto:[email-masked]] On Behalf Of Haynes, Dan
Sent: Tuesday, May 24, 2016 4:47 AM
To: Adam Montville <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #6 - Storage of Collected Data

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Thursday, May 19, 2016 8:14 PM
To: Haynes, Dan <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #6 - Storage of Collected Data

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 24 May 2016 15:25:33 +0000

Hi Kathleen,

Just to clarify, by "structured threat information", I really just meant threat intelligence information in a common data format (e.g. STIX).  Sorry for not using the more appropriate terminology :).

But, yes, I agree we need some consistent methods for exchanging information between repositories and other SACM components. 

Thanks,

Danny

> -----Original Message-----
> From: Kathleen Moriarty [mailto:[email-masked]]
> Sent: Tuesday, May 24, 2016 10:06 AM
> Cc: [email-masked]; Adam Montville <[email-masked]>;
> [email-masked]
> As an individual, if you mean the structured defined are targeted at in
> motion, I am for that option.  For interoperability, consistent methods to
> exchange the data between vendors is needed.
> 
> However, if you use a RESTful interface, you'll want access to that data using
> an interface that lets you access that data using the defined format for
> transport.
> 
> Kathleen
> 
> > stored in a SACM repository and used to drive the assessment of
> > endpoints with respect to indicators of compromise.  Is that what you
> getting at?
> >
> >
> >
> > Thanks,
> >
> > Danny
> >
> >
> >
> > legally concern how this work is integrated with STIX and CybOX.
> >

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 24 May 2016 11:37:02 -0400

Hi Dan,

Yes, I got that and just used more generic terminology to apply to any
format or data model worked on by SACM.

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 31 May 2016 15:44:20 +0000

Given the feedback on this thread, I am inclined to leave the following sentence as-is in the next revision.
“Moreover, the scenario incorporates long-term storage of collected data, vulnerability description information, and assessment results in order to facilitate meaningful and ongoing reassessment.”
Let me know if you have any questions or concerns.
Thanks,

Danny

From: Michael Godsey [mailto:[email-masked]]
Sent: Tuesday, May 24, 2016 10:31 AM
To: Haynes, Dan <[email-masked]>; Adam Montville <[email-masked]>
Cc: [email-masked]
Subject: RE: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #6 - Storage of Collected Data

To: Adam Montville <[email-masked]<mailto:[email-masked]>>

Thanks,

Danny