Subject: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #4 - Processing Vulnerability Description Information

From: "Haynes, Dan" <[email-masked]>
Date: Wed, 18 May 2016 11:49:48 +0000

During yesterday's virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide's from the meeting can be found here [4].

The fourth issue was around the use of about the processing of vulnerability description information.  Specifically, is the assumption that an enterprise receives vulnerability description information and processes it into a format usable by security tools the same as saying vulnerability description information can be processed into vulnerability detection data?  Furthermore, is this processing related to the assumption that an enterprise has a means of extracting endpoint information into a form that is compatible with the vulnerability description information?

At the meeting, this issue was mostly covered during the discussion around clarifying the definition of vulnerability detection data and the fact there seemed to be agreement around vulnerability detection data representing the instructions generated from the vulnerability description information that can then be used by enterprise security tools.  However, it was noted that we should make sure that the processing of vulnerability description information into vulnerability detection data is covered in the assumptions for the scenario.  Looking at the Vulnerability Assessment Scenario, I believe that this assumption is covered in the first bullet of the "Assumptions" section which states:

"The document begins with the assumption that the enterprise has received vulnerability description data, and that the data has
already been processed into a format that the enterprise's security software tools can understand and use.  In particular, this
document:

      *  Does not discuss how the enterprise identifies potentially
         relevant vulnerability description data.

      *  Does not discuss how the enterprise collects the vulnerability
         description data.

      *  Does not discuss how the enterprise assesses the authenticity
         of the vulnerability description data.

      *  Does not discuss parsing of the vulnerability description data
         into a usable format."

As a result, I think the way forward on this issue is to update the definition of "vulnerability detection data" to make it clear it is the format used by an enterprise's security tools as well as update references to a format that can be used by enterprise tool's to "vulnerability detection data".  We should probably also update the assumption that "The enterprise has a means of extracting relevant information about enterprise endpoints in a form that is compatible with the vulnerability description information" to "...that is compatible with the vulnerability detection data" since security tools will be leveraging vulnerability detection data to carry out assessments.

Does this seem like a reasonable approach for this issue?  Is there anything that I am missing?  If you have any thoughts on this issue, please provide feedback by May 31st.  We are planning to have an updated version of the scenario for June 8th.

Thanks,

Danny

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://github.com/sacmwg/vulnerability-scenario/pull/3
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html
[4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks like the slides are not available just yet, but, I suspect they should be soon)

---

From: Jerome Athias <[email-masked]>
Date: Wed, 18 May 2016 19:07:13 +0300

It makes sense for me

Best regards

2016-05-18 14:49 GMT+03:00 Haynes, Dan <[email-masked]>:
> During yesterday’s virtual interim meeting, we discussed various open issues
> with respect to the Vulnerability Assessment Scenario [1] as a result of
> feedback that we received on the draft which you can see here [2][3].  The
> slide’s from the meeting can be found here [4].
>
>
>
> The fourth issue was around the use of about the processing of vulnerability
> description information.  Specifically, is the assumption that an enterprise
> receives vulnerability description information and processes it into a
> format usable by security tools the same as saying vulnerability description
> information can be processed into vulnerability detection data?
> Furthermore, is this processing related to the assumption that an enterprise
> has a means of extracting endpoint information into a form that is
> compatible with the vulnerability description information?
>
>
>
> At the meeting, this issue was mostly covered during the discussion around
> clarifying the definition of vulnerability detection data and the fact there
> seemed to be agreement around vulnerability detection data representing the
> instructions generated from the vulnerability description information that
> can then be used by enterprise security tools.  However, it was noted that
> we should make sure that the processing of vulnerability description
> information into vulnerability detection data is covered in the assumptions
> for the scenario.  Looking at the Vulnerability Assessment Scenario, I
> believe that this assumption is covered in the first bullet of the
> “Assumptions” section which states:
>
>
>
> “The document begins with the assumption that the enterprise has received
> vulnerability description data, and that the data has
>
> already been processed into a format that the enterprise's security software
> tools can understand and use.  In particular, this
>
> document:
>
>
>
>          into a usable format.”
> As a result, I think the way forward on this issue is to update the
> definition of “vulnerability detection data” to make it clear it is the
> format used by an enterprise’s security tools as well as update references
> to a format that can be used by enterprise tool’s to “vulnerability
> detection data”.  We should probably also update the assumption that “The
> enterprise has a means of extracting relevant information about enterprise
> endpoints in a form that is compatible with the vulnerability description
> information” to “…that is compatible with the vulnerability detection data”
> since security tools will be leveraging vulnerability detection data to
> carry out assessments.
>
>
>
> Does this seem like a reasonable approach for this issue?  Is there anything
> that I am missing?  If you have any thoughts on this issue, please provide
> feedback by May 31st.  We are planning to have an updated version of the
> scenario for June 8th.
>
>
>
> Thanks,
>
> Danny
>
>
>
> [4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks
> like the slides are not available just yet, but, I suspect they should be
> soon)
>
>
>
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Adam Montville <[email-masked]>
Date: Thu, 19 May 2016 19:20:13 -0500

+1

> On May 18, 2016, at 11:07 AM, Jerome Athias <[email-masked]> wrote:
> 
> It makes sense for me
> 
> Best regards
>

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 24 May 2016 11:49:35 +0000

Thanks for the feedback Jerome and Adam!  Do others have thoughts on these proposed changes?

Thanks,

Danny 

> -----Original Message-----
> From: Adam Montville [mailto:[email-masked]]
> Sent: Thursday, May 19, 2016 8:20 PM
> To: Jerome Athias <[email-masked]>
> Cc: Haynes, Dan <[email-masked]>; [email-masked]
> Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #4
> - Processing Vulnerability Description Information
> 
> +1
> 
> >> During yesterday’s virtual interim meeting, we discussed various open
> >> issues with respect to the Vulnerability Assessment Scenario [1] as a
> >> result of feedback that we received on the draft which you can see
> >> here [2][3].  The slide’s from the meeting can be found here [4].
> >>
> >>
> >>
> >> The fourth issue was around the use of about the processing of
> >> vulnerability description information.  Specifically, is the
> >> assumption that an enterprise receives vulnerability description
> >> information and processes it into a format usable by security tools
> >> the same as saying vulnerability description information can be processed
> into vulnerability detection data?
> >> Furthermore, is this processing related to the assumption that an
> >> enterprise has a means of extracting endpoint information into a form
> >> that is compatible with the vulnerability description information?
> >>
> >>
> >>
> >> At the meeting, this issue was mostly covered during the discussion
> >> around clarifying the definition of vulnerability detection data and
> >> the fact there seemed to be agreement around vulnerability detection
> >> data representing the instructions generated from the vulnerability
> >> description information that can then be used by enterprise security
> >> tools.  However, it was noted that we should make sure that the
> >> processing of vulnerability description information into
> >> vulnerability detection data is covered in the assumptions for the
> >> scenario.  Looking at the Vulnerability Assessment Scenario, I
> >> “The document begins with the assumption that the enterprise has
> >> received vulnerability description data, and that the data has
> >>
> >> already been processed into a format that the enterprise's security
> >> software tools can understand and use.  In particular, this
> >>
> >> document:
> >>
> >>
> >>
> >> definition of “vulnerability detection data” to make it clear it is
> >> the format used by an enterprise’s security tools as well as update
> >> references to a format that can be used by enterprise tool’s to
> >> “vulnerability detection data”.  We should probably also update the
> >> assumption that “The enterprise has a means of extracting relevant
> >> information about enterprise endpoints in a form that is compatible
> >> with the vulnerability description information” to “…that is compatible
> with the vulnerability detection data”
> >> since security tools will be leveraging vulnerability detection data
> >> to carry out assessments.
> >>
> >>
> >>
> >> Does this seem like a reasonable approach for this issue?  Is there
> >> anything that I am missing?  If you have any thoughts on this issue,
> >> please provide feedback by May 31st.  We are planning to have an
> >> updated version of the scenario for June 8th.
> >>
> >>
> >>
> >> Thanks,
> >>
> >> Danny
> >>
> >>
> >>
> >> [4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/
> >> (looks like the slides are not available just yet, but, I suspect
> >> they should be
> >> soon)
> >>
> >>
> >>
> >>

---

From: Bill Munyan <[email-masked]>
Date: Tue, 24 May 2016 16:27:54 -0400

Danny,
This makes sense to me, as long as there's perhaps some explanation in
(maybe?) the terminology noting that the "vulnerability detection data" is
the guidance which "security tools will use to carry out assessments".
That might already be in the terminology draft for "vulnerability detection
data" so forgive me if I'm restating something obvious there.

Cheers,
-Bill M.

---

From: "Haynes, Dan" <[email-masked]>
Date: Wed, 25 May 2016 01:16:00 +0000

Hi Bill,

Yes, assuming there are no objections on [1], the updated definition for “vulnerability detection data” will include text saying it is the guidance that provide instructions for security tools to carry out vulnerability assessments.

Thanks,

Danny

[1] https://www.ietf.org/mail-archive/web/sacm/current/msg03980.html

From: sacm [mailto:[email-masked]] On Behalf Of Bill Munyan
Sent: Tuesday, May 24, 2016 4:28 PM
To: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #4 - Processing Vulnerability Description Information

Danny,
This makes sense to me, as long as there's perhaps some explanation in (maybe?) the terminology noting that the "vulnerability detection data" is the guidance which "security tools will use to carry out assessments".  That might already be in the terminology draft for "vulnerability detection data" so forgive me if I'm restating something obvious there.

Cheers,
-Bill M.

On Tue, May 24, 2016 at 7:49 AM, Haynes, Dan <[email-masked]<mailto:[email-masked]>> wrote:
Thanks for the feedback Jerome and Adam!  Do others have thoughts on these proposed changes?

Thanks,

Danny

> From: Adam Montville [mailto:[email-masked]<mailto:[email-masked]>]
> To: Jerome Athias <[email-masked]<mailto:[email-masked]>>
> Cc: Haynes, Dan <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
> > On May 18, 2016, at 11:07 AM, Jerome Athias <[email-masked]<mailto:[email-masked]>>
> wrote:
> >
> > It makes sense for me
> >
> > Best regards
> >
> > 2016-05-18 14:49 GMT+03:00 Haynes, Dan <[email-masked]<mailto:[email-masked]>>:
> >> [email-masked]<mailto:[email-masked]>
> > [email-masked]<mailto:[email-masked]>

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm