Subject: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #3 - Defining Targeted Collection

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 17 May 2016 18:58:17 +0000

During today's virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide's from today's meeting can be found here [4].

The third issue was around the definition of "targeted collection".  Specifically, whether or not "targeted collection" meant a server was explicitly requesting additional information from an endpoint to supplement automated collection or if it has a broader meaning?  Furthermore, is it even the correct term to use in this situation (e.g. maybe "supplemental collection" would be a better term?)?

During the meeting, it was mentioned that all collection by definition of the Collection task, in the latest development draft of the Terminology I-D [5], is actually targeted.  As a result, I would like to propose that use of "targeted collection" be replaced with "supplemental collection" with the understanding that the "collection" part of the definition is in fact targeted and that the "supplemental" part of the definition indicates that additional information beyond what is currently available is being collected.

If you have any thoughts on this issue, please provide feedback by May 31st.  We are planning to have an updated version of the scenario for June 8th.

Thanks,

Danny

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://github.com/sacmwg/vulnerability-scenario/pull/3
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html
[4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks like the slides are not available just yet, but, I suspect they should be soon)
[5] https://github.com/sacmwg/draft-ietf-sacm-terminology/blob/master/draft-ietf-sacm-terminology.md

---

From: Adam Montville <[email-masked]>
Date: Thu, 19 May 2016 19:06:21 -0500

No objection.

> On May 17, 2016, at 1:58 PM, Haynes, Dan <[email-masked]> wrote:
> 
> During today’s virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide’s from today’s meeting can be found here [4].
> 
> The third issue was around the definition of “targeted collection”.  Specifically, whether or not “targeted collection” meant a server was explicitly requesting additional information from an endpoint to supplement automated collection or if it has a broader meaning?  Furthermore, is it even the correct term to use in this situation (e.g. maybe “supplemental collection” would be a better term?)?
> 
> During the meeting, it was mentioned that all collection by definition of the Collection task, in the latest development draft of the Terminology I-D [5], is actually targeted.  As a result, I would like to propose that use of “targeted collection” be replaced with “supplemental collection” with the understanding that the “collection” part of the definition is in fact targeted and that the “supplemental” part of the definition indicates that additional information beyond what is currently available is being collected.
> 
> [1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/ <https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/>
> [2] https://github.com/sacmwg/vulnerability-scenario/pull/3 <https://github.com/sacmwg/vulnerability-scenario/pull/3>
> [3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html <https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html>
> [4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ <https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/> (looks like the slides are not available just yet, but, I suspect they should be soon)
> [5] https://github.com/sacmwg/draft-ietf-sacm-terminology/blob/master/draft-ietf-sacm-terminology.md <https://github.com/sacmwg/draft-ietf-sacm-terminology/blob/master/draft-ietf-sacm-terminology.md>
> 
> _______________________________________________
> sacm mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/sacm <https://www.ietf.org/mailman/listinfo/sacm>

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 24 May 2016 11:46:11 +0000

Thanks Adam.  What do others think regarding the terminology change from “targeted collection” to “supplemental collection”?

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Thursday, May 19, 2016 8:06 PM
To: Haynes, Dan <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #3 - Defining Targeted Collection

No objection.

On May 17, 2016, at 1:58 PM, Haynes, Dan <[email-masked]<mailto:[email-masked]>> wrote:

Thanks,

Danny

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Bill Munyan <[email-masked]>
Date: Tue, 24 May 2016 16:15:34 -0400

Danny,
This sounds sane to me.  No objections.
Cheers,
-Bill M.

On Tue, May 24, 2016 at 7:46 AM, Haynes, Dan <[email-masked]> wrote:

> Thanks Adam.  What do others think regarding the terminology change from
> “targeted collection” to “supplemental collection”?
>
>
>
> Thanks,
>
> Danny
>
>
>
>
>
> *From:* Adam Montville [mailto:[email-masked]]
> *Sent:* Thursday, May 19, 2016 8:06 PM
> *To:* Haynes, Dan <[email-masked]>
> *Cc:* [email-masked]
> *Subject:* Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue
> #3 - Defining Targeted Collection
>
>
>
> No objection.
>
>
>
> During today’s virtual interim meeting, we discussed various open issues
> with respect to the Vulnerability Assessment Scenario [1] as a result of
> feedback that we received on the draft which you can see here [2][3].  The
> slide’s from today’s meeting can be found here [4].
>
>
>
> The third issue was around the definition of “targeted collection”.
> Specifically, whether or not “targeted collection” meant a server was
> explicitly requesting additional information from an endpoint to supplement
> automated collection or if it has a broader meaning?  Furthermore, is it
> even the correct term to use in this situation (e.g. maybe “supplemental
> collection” would be a better term?)?
>
>
>
> During the meeting, it was mentioned that all collection by definition of
> the Collection task, in the latest development draft of the Terminology I-D
> [5], is actually targeted.  As a result, I would like to propose that use
> of “targeted collection” be replaced with “supplemental collection” with
> the understanding that the “collection” part of the definition is in fact
> targeted and that the “supplemental” part of the definition indicates that
> additional information beyond what is currently available is being
> collected.
>
>
>
> If you have any thoughts on this issue, please provide feedback by May 31
> st.  We are planning to have an updated version of the scenario for June 8
> th.
>
>
>
> Thanks,
>
> Danny
>
>
>
> [4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks
> like the slides are not available just yet, but, I suspect they should be
> soon)
>
> [5]
> https://github.com/sacmwg/draft-ietf-sacm-terminology/blob/master/draft-ietf-sacm-terminology.md
>
>
>
> [email-masked]
> [email-masked]

---

From: Ira McDonald <[email-masked]>
Date: Tue, 24 May 2016 18:59:37 -0400

Hi Danny,

I also like "supplemental collection", which avoids yet another overload
of the term "target" in SACM.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Winter  579 Park Place  Saline, MI  48176  734-944-0094
Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434

On Tue, May 24, 2016 at 4:15 PM, Bill Munyan <[email-masked]>
wrote:

>> *Subject:* Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario
>> Issue #3 - Defining Targeted Collection
>>
>>
>>
>> No objection.
>>
>>
>>
>> st.  We are planning to have an updated version of the scenario for June
>> 8th.
>>
>>
>>
>> Thanks,
>>
>> Danny
>>
>>
>>

---

From: "Haynes, Dan" <[email-masked]>
Date: Wed, 25 May 2016 00:56:10 +0000

Thanks for the feedback Bill and Ira.

-Danny

From: Ira McDonald [mailto:[email-masked]]
Sent: Tuesday, May 24, 2016 7:00 PM
To: Bill Munyan <[email-masked]>; Ira McDonald <[email-masked]>
Cc: Haynes, Dan <[email-masked]>; Adam Montville <[email-masked]>; [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #3 - Defining Targeted Collection

Hi Danny,

mailto: [email-masked]<mailto:[email-masked]>

On Tue, May 24, 2016 at 4:15 PM, Bill Munyan <[email-masked]<mailto:[email-masked]>> wrote:
Danny,
This sounds sane to me.  No objections.
Cheers,
-Bill M.

On Tue, May 24, 2016 at 7:46 AM, Haynes, Dan <[email-masked]<mailto:[email-masked]>> wrote:
Thanks Adam.  What do others think regarding the terminology change from “targeted collection” to “supplemental collection”?

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Thursday, May 19, 2016 8:06 PM
To: Haynes, Dan <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #3 - Defining Targeted Collection

No objection.

Thanks,

Danny