Subject: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #1 - Managing Terminology

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 17 May 2016 18:15:56 +0000

During today's virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide's from today's meeting can be found here [4].

The first issue was whether or not the following terms from Section 2 of the Vulnerability Assessment Scenario should be pulled into the Terminology I-D [5] with the expectation that any terms pulled in will be used outside of the Vulnerability Assessment Scenario.

*       Vulnerability description information
*       Vulnerability detection data
*       Endpoint management capability
*       Vulnerability management capability
*       Vulnerability assessment
*       Targeted collection

During the meeting, there were concerns that while some of these terms leverage general terms already in the Terminology I-D, they use them in specific ways with respect to the Vulnerability Assessment Scenario.  It was also noted that some terms like "endpoint management capability" and "vulnerability management capability", while specific, have the potential to become broader as SACM eventually expands into other areas (e.g. configuration, etc.).  As a result, the consensus on the call was to leave the terms in Section 2 of the Vulnerability Assessment Scenario, for now, with the expectation that we may reassess this decision in the future.

If you have any thoughts on this issue, please provide feedback by May 31st.  We are planning to have an updated version of the scenario for June 8th.

Thanks,

Danny

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://github.com/sacmwg/vulnerability-scenario/pull/3
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html
[4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks like the slides are not available just yet, but, I suspect they should be soon)
[5] https://datatracker.ietf.org/doc/draft-ietf-sacm-terminology/

---

From: Adam Montville <[email-masked]>
Date: Thu, 19 May 2016 19:03:33 -0500

I’ll echo my statements from the virtual interim by pointing out that the vulnerability scenario, while narrowing our focus, does not change the scope of our charter.  From that perspective, I would like to see terms “promoted” into the terminology draft sooner rather than later.  Of the set of terms Danny described, I think endpoint management capability and targeted collection are prime candidates for such promotion.  I also believe that vulnerability management capability and vulnerability assessment are suitable for promotion. Vulnerability description information and vulnerability detection data could stay within the vulnerability draft.

Adam

> On May 17, 2016, at 1:15 PM, Haynes, Dan <[email-masked]> wrote:
> 
> During today’s virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide’s from today’s meeting can be found here [4].
> 
> •       Vulnerability description information
> •       Vulnerability detection data
> •       Endpoint management capability
> •       Vulnerability management capability
> •       Vulnerability assessment
> •       Targeted collection
> 
> During the meeting, there were concerns that while some of these terms leverage general terms already in the Terminology I-D, they use them in specific ways with respect to the Vulnerability Assessment Scenario.  It was also noted that some terms like “endpoint management capability” and “vulnerability management capability”, while specific, have the potential to become broader as SACM eventually expands into other areas (e.g. configuration, etc.).  As a result, the consensus on the call was to leave the terms in Section 2 of the Vulnerability Assessment Scenario, for now, with the expectation that we may reassess this decision in the future.
> 
> [1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/ <https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/>
> [2] https://github.com/sacmwg/vulnerability-scenario/pull/3 <https://github.com/sacmwg/vulnerability-scenario/pull/3>
> [3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html <https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html>
> [4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ <https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/> (looks like the slides are not available just yet, but, I suspect they should be soon)
> [5] https://datatracker.ietf.org/doc/draft-ietf-sacm-terminology/ <https://datatracker.ietf.org/doc/draft-ietf-sacm-terminology/>_______________________________________________
> sacm mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/sacm <https://www.ietf.org/mailman/listinfo/sacm>

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 24 May 2016 11:42:32 +0000

Do others have thoughts regarding whether or not terminology from the vulnerability assessment scenario draft should be promoted ot the Terminology I-D?  If so, which terms make sense to promote?

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Thursday, May 19, 2016 8:04 PM
To: Haynes, Dan <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #1 - Managing Terminology

Adam

On May 17, 2016, at 1:15 PM, Haynes, Dan <[email-masked]<mailto:[email-masked]>> wrote:

Thanks,

Danny

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://github.com/sacmwg/vulnerability-scenario/pull/3
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html
[4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks like the slides are not available just yet, but, I suspect they should be soon)
[5] https://datatracker.ietf.org/doc/draft-ietf-sacm-terminology/
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 31 May 2016 20:41:42 +0000

Did anyone else have any thoughts on this particular issue?

If we want to take the approach of promoting a few terms as Adam has suggested, we might want do it as follows.

Supplemental (previously targeted) collection: The task of collecting specific endpoint information from the target endpoint, that is not available from the endpoint management capability, in order to make a determination about that endpoint (vulnerability status, identification, etc.).

This seems general enough to be promoted as-is.

Vulnerability assessment: The process of determining whether a set of endpoints is vulnerable according to the information contained in the vulnerability description information.

We would need to generalize it more to remove the reference to “vulnerability description information”. One approach might be to replace “vulnerability description information” with “information pertaining to the existence of a flaw or flaws in software, hardware, and/or firmware on an endpoint.”  It might also make sense to highlight this as a specialization of “assessment”.  As a side note, does anyone see a distinction between process and workflow (as described here http://blog.goodelearning.com/bpmn/business-process-vs-workflow/) and that assessment might be better described as a workflow? With that said, our definition comes from RFC5209 and we may not want to make any changes which is perfectly fine – just something to think about :).

Endpoint management capability:  An enterprise IT capability managing endpoint identity, endpoint information, and associated metadata on an ongoing basis.

Vulnerability management capability:  An enterprise IT capability managing endpoint vulnerabilities and associated metadata on an ongoing basis by ingesting vulnerability description information and vulnerability detection data, and performing a vulnerability assessment.

Right now, we have definitions for “endpoint management capability” and “vulnerability management capability”. To support promoting these, we may want to create a more general “management capability” term and then include “endpoint management capability” and “vulnerability management capability” as specializations of that term.  A definition of “management capability” might read something like “An enterprise IT capability responsible for managing specific information about an endpoint in support of continuous monitoring processes which may or may not be driven by guidance”.

Anyways, this is just a little bit more to think about :).  Let me know what you think.

Thanks,

Danny

From: sacm [mailto:[email-masked]] On Behalf Of Haynes, Dan
Sent: Tuesday, May 24, 2016 7:43 AM
To: Adam Montville <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #1 - Managing Terminology

Thanks,
Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Thursday, May 19, 2016 8:04 PM
To: Haynes, Dan <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #1 - Managing Terminology

Adam

Thanks,

Danny