Subject: Re: [sacm] Call for MTI Information Elements

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 9 May 2016 19:10:22 +0000

Does anyone have any thoughts on the information elements (IEs) that they would like to see in the IM?  

Just a reminder, we are looking to build a list of the IEs we care about.  Whether or not they are mandatory-to-implement will be discussed at a later point in time.

For some ideas, we have some listed some IEs in the current WG IM (section 5) that were taken from the list of IPFIX information elements.  Also, Nancy and Henk have proposed some IEs for consideration in the I-D IM (section 5).

Any suggestions would be greatly appreciated as it will help drive the development of the data models that we need.

Thanks,

Danny

> -----Original Message-----
> From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
> Sent: Sunday, April 03, 2016 10:02 PM
> To: Cokus, Michael S. <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [sacm] Call for MTI Information Elements
> 
> As a point of clarification, I am not suggestion that we not talk about the
> information elements we want to see in the information model—in fact, just
> the opposite.  I would like us to discuss what we’d like to see in the
> information model, but I don’t think an MTI discussion about them would yet
> be helpful.
> 
> Kind regards,
> 
> Adam
> 
> > On Apr 3, 2016, at 6:38 PM, Adam Montville
> <[email-masked]> wrote:
> >
> > I think this is a very good discussion to have, but I encourage the working
> group to defer this discussion until the information model is fleshed out
> more completely.
> >
> > Kind regards,
> >
> > Adam
> >
> >
> >> On Apr 1, 2016, at 12:43 PM, Cokus, Michael S. <[email-masked]> wrote:
> >>
> >> Hello All,
> >>
> >> One of the Information Model "Next Steps" presented at the last virtual
> meeting was to begin discussion concerning the Mandatory-to-Implement
> (MTI) Information Elements.  The purpose of this message is to follow up on
> this.
> >>
> >> What IEs should be mandatory?
> >>
> >> Are there general principles that should be applied to deciding what
> should be MTI IEs?
> >>
> >> Another related question which may be helpful to consider is "From
> where should we draw MTI information element candidates?"  Potential
> sources are listed below (are there others we should consider?)
> >>
> >> - Architecture [1]
> >> - Requirements [2]
> >> - Vulnerability Assessment Scenario [3]
> >> - Existing models which define relevant IEs to consider (e.g., SCAP, CIM,
> SWID, APP-ID)
> >>
> >> Looking forward to your feedback on the MTI IEs, relevant principles to
> apply, and/or potential sources MTI IEs should be drawn from.  If you also
> have additional thoughts on how to approach this topic, please let the group
> know.
> >>
> >> Thanks much,
> >>
> >> --mike
> >>
> >> [1] https://datatracker.ietf.org/doc/draft-ietf-sacm-architecture/
> >> [2] https://datatracker.ietf.org/doc/draft-ietf-sacm-requirements/
> >> [3] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
> >>
> >>
> >> Mike Cokus
> >> Systems Engineer
> >> The MITRE Corporation
> >>
> >> _______________________________________________
> >> sacm mailing list
> >> [email-masked]
> >> https://www.ietf.org/mailman/listinfo/sacm
> >

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 9 May 2016 12:21:42 -0700

I would assume all of the elements representing the boxes in Figure 4 are in the IM model

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Haynes, Dan
Sent: Monday, May 09, 2016 12:10 PM
To: Adam Montville <[email-masked]>; Cokus, Michael S. <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] Call for MTI Information Elements

Thanks,

Danny

> As a point of clarification, I am not suggestion that we not talk 
> about the information elements we want to see in the information 
> model—in fact, just the opposite.  I would like us to discuss what 
> we’d like to see in the information model, but I don’t think an MTI 
> discussion about them would yet be helpful.
> 
> Kind regards,
> 
> Adam
> 
> group to defer this discussion until the information model is fleshed 
> out more completely.
> >
> > Kind regards,
> >
> > Adam
> >
> >
> (MTI) Information Elements.  The purpose of this message is to follow 
> up on this.
> >>
> apply, and/or potential sources MTI IEs should be drawn from.  If you 
> also have additional thoughts on how to approach this topic, please 
> let the group know.
> >>
> >> Thanks much,
> >>
> >> --mike
> >>
> >> [3] 
> >> https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
> >>
> >>
> >> Mike Cokus
> >> Systems Engineer
> >> The MITRE Corporation
> >>

---

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 9 May 2016 19:32:59 +0000

Yeah, that is correct.  Although, I think we may make some updates to that diagram since some of the boxes seem too low-level compared to the others.

Thanks,

Danny

> From: Jim Schaad [mailto:[email-masked]]
> Sent: Monday, May 09, 2016 3:22 PM
> To: Haynes, Dan <[email-masked]>; 'Adam Montville'
> <[email-masked]>; Cokus, Michael S. <[email-masked]>
> Cc: [email-masked]
> Subject: RE: [sacm] Call for MTI Information Elements
> 
> Just a reminder, we are looking to build a list of the IEs we care about.
> Whether or not they are mandatory-to-implement will be discussed at a later
> point in time.
> 
> For some ideas, we have some listed some IEs in the current WG IM (section
> 5) that were taken from the list of IPFIX information elements.  Also, Nancy
> and Henk have proposed some IEs for consideration in the I-D IM (section 5).
> 
> Any suggestions would be greatly appreciated as it will help drive the
> development of the data models that we need.
> 
> Thanks,
> 
> Danny
>