Subject: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #7 - Where do vulnerability assessment attributes belong

From: "Haynes, Dan" <[email-masked]>
Date: Wed, 18 May 2016 11:58:22 +0000

During yesterday's virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide's from the meeting can be found here [4].

One issue that we didn't have a chance to discuss, because we ran out of time, is where do vulnerability assessment attributes belong?  In Appendix D.2 of the Vulnerability Assessment Scenario, there is a list of definitions that describe the various attributes necessary to support the scenario.  Since these definitions really identify information needs for SACM, we would like to propose that we move these attributes to the IM in the form of information elements.

Does this seem like a reasonable approach?  Are there any objections to this approach?  If you have any thoughts on this issue, please provide any feedback by May 31st.  We are planning to have an updated version of the scenario for June 8th.

Thanks,

Danny

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://github.com/sacmwg/vulnerability-scenario/pull/3
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html
[4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks like the slides are not available just yet, but, I suspect they should be soon)

---

From: Adam Montville <[email-masked]>
Date: Thu, 19 May 2016 19:15:10 -0500

This seems like a reasonable approach.

> On May 18, 2016, at 6:58 AM, Haynes, Dan <[email-masked]> wrote:
> 
> During yesterday’s virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide’s from the meeting can be found here [4].
> 
> One issue that we didn’t have a chance to discuss, because we ran out of time, is where do vulnerability assessment attributes belong?  In Appendix D.2 of the Vulnerability Assessment Scenario, there is a list of definitions that describe the various attributes necessary to support the scenario.  Since these definitions really identify information needs for SACM, we would like to propose that we move these attributes to the IM in the form of information elements.
> 
> [1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/ <https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/>
> [2] https://github.com/sacmwg/vulnerability-scenario/pull/3 <https://github.com/sacmwg/vulnerability-scenario/pull/3>
> [3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html <https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html>
> [4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ <https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/> (looks like the slides are not available just yet, but, I suspect they should be soon)
> 
> _______________________________________________
> sacm mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/sacm <https://www.ietf.org/mailman/listinfo/sacm>

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 24 May 2016 11:48:27 +0000

Do others have thoughts on if the attributes defined in Appendix D.2 of the vulnerability assessment scenario should be carried over to the IM as information elements?

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Thursday, May 19, 2016 8:15 PM
To: Haynes, Dan <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #7 - Where do vulnerability assessment attributes belong

On May 18, 2016, at 6:58 AM, Haynes, Dan <[email-masked]<mailto:[email-masked]>> wrote:

Thanks,

Danny

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Haynes, Dan" <[email-masked]>
Date: Tue, 31 May 2016 18:57:13 +0000

Given the feedback on this and the lack of any objections, I went ahead and created an IM tracker item to add IEs for the information needs described in the Vulnerability Assessment Scenario I-D.

You can find that tracker here.

https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/43

As a result, the Appendix D.2, which contained these information needs, will be removed from the next revision of the Vulnerability Assessment Scenario I-D.

Please let me know if you have any questions or concerns.

Thanks,

Danny

From: sacm [mailto:[email-masked]] On Behalf Of Haynes, Dan
Sent: Tuesday, May 24, 2016 7:48 AM
To: Adam Montville <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #7 - Where do vulnerability assessment attributes belong

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Thursday, May 19, 2016 8:15 PM
To: Haynes, Dan <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #7 - Where do vulnerability assessment attributes belong

Thanks,

Danny