Subject: [sacm] Vulnerability Assessment Scenario Issue #23 - Update Appendix E to Reference CSC v6.0

From: "Haynes, Dan" <[email-masked]>
Date: Fri, 17 Jun 2016 12:59:15 +0000

We have a tracker that recommends updating Appendix E to reference Critical Security Controls v6.0 instead of v5.1 [1][2].  I went through both versions of the document and made the appropriate updates to the text (see attached) as some controls have changed or have been removed.

Please review the attached changes and let me know if they seem reasonable to incorporate into the next revision of the Vulnerability Assessment Scenario I-D.

Thanks,

Danny

[1] https://github.com/sacmwg/vulnerability-scenario/issues/23
[2] https://www.cisecurity.org/critical-controls.cfm

---

From: Adam Montville <[email-masked]>
Date: Fri, 17 Jun 2016 16:58:32 -0500

This looks good from my perspective, Danny, thank you.

> On Jun 17, 2016, at 7:59 AM, Haynes, Dan <[email-masked]> wrote:
> 
> [1] https://github.com/sacmwg/vulnerability-scenario/issues/23 <https://github.com/sacmwg/vulnerability-scenario/issues/23>
> [2] https://www.cisecurity.org/critical-controls.cfm <https://www.cisecurity.org/critical-controls.cfm>
> 
> <csc-updates.docx>_______________________________________________
> sacm mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/sacm <https://www.ietf.org/mailman/listinfo/sacm>

---

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 20 Jun 2016 14:04:19 +0000

Thanks Adam.  Do others have thoughts on these changes?

Thanks,

Danny

From: Adam Montville [mailto:[email-masked]]
Sent: Friday, June 17, 2016 5:59 PM
To: Haynes, Dan <[email-masked]>
Cc: [email-masked]
Subject: Re: [sacm] Vulnerability Assessment Scenario Issue #23 - Update Appendix E to Reference CSC v6.0

On Jun 17, 2016, at 7:59 AM, Haynes, Dan <[email-masked]<mailto:[email-masked]>> wrote:

Thanks,

Danny

<csc-updates.docx>_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Ira McDonald <[email-masked]>
Date: Mon, 20 Jun 2016 10:10:12 -0400

Hi Danny,

+1

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Winter  579 Park Place  Saline, MI  48176  734-944-0094
Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434

On Mon, Jun 20, 2016 at 10:04 AM, Haynes, Dan <[email-masked]> wrote:

> *From:* Adam Montville [mailto:[email-masked]]
> *Sent:* Friday, June 17, 2016 5:59 PM
> *To:* Haynes, Dan <[email-masked]>
> *Cc:* [email-masked]
> *Subject:* Re: [sacm] Vulnerability Assessment Scenario Issue #23 -
> Update Appendix E to Reference CSC v6.0
>
>
>
> We have a tracker that recommends updating Appendix E to reference
> Critical Security Controls v6.0 instead of v5.1 [1][2].  I went through
> both versions of the document and made the appropriate updates to the text
> (see attached) as some controls have changed or have been removed.
>
>
>
> Please review the attached changes and let me know if they seem reasonable
> to incorporate into the next revision of the Vulnerability Assessment
> Scenario I-D.
>
>
>
> Thanks,
>
>
>
> Danny
>
>
>
> [email-masked]
> _______________________________________________
> sacm mailing list
> [email-masked]

---

From: Henk Birkholz <[email-masked]>
Date: Mon, 20 Jun 2016 17:03:02 +0200

The changes look fine to me.

The CSC 4 System Entity Relationship diagram seems to imply the use of a 
vulnerability scanner, I think. Could an "SCAP Unauthenticated 
Vulnerability Scanner" be used as an example for a Posture Collector 
that does not reside on the target endpoint itself?

Grüße,

Henk

On 06/20/2016 04:04 PM, Haynes, Dan wrote:
> *From:*Adam Montville [mailto:[email-masked]]
>     Critical Security Controls v6.0 instead of v5.1 [1][2].  I went
>     through both versions of the document and made the appropriate
>     updates to the text (see attached) as some controls have changed or
>     have been removed.
>
>     Please review the attached changes and let me know if they seem
>     reasonable to incorporate into the next revision of the
>     Vulnerability Assessment Scenario I-D.
>
>     Thanks,
>
>     Danny
>
>     [1]https://github.com/sacmwg/vulnerability-scenario/issues/23
>
>     [2]https://www.cisecurity.org/critical-controls.cfm
>

---

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 20 Jun 2016 17:02:40 +0000

Thanks Ira and Henk.  

Henk, I think so.  With that said, I think the scanner in the diagram could be either on/off the endpoint and it could perform authenticated/unauthenticated scans. 
 
Thanks,

Danny

> -----Original Message-----
> From: sacm [mailto:[email-masked]] On Behalf Of Henk Birkholz
> Sent: Monday, June 20, 2016 11:03 AM
> To: [email-masked]
> vulnerability scanner, I think. Could an "SCAP Unauthenticated Vulnerability
> Scanner" be used as an example for a Posture Collector that does not reside
> on the target endpoint itself?
> 
> Grüße,
> 
> Henk
> 
> 
> >     <csc-
> updates.docx>_______________________________________________
> >     sacm mailing list

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 20 Jun 2016 18:34:10 -0400

This listing is updated every six months.  It
is a handy compendium, inter alia, for formal
citations to many SACM related specifications.

Note the citations to the ITU-T version of OVAL
- X.1526.  It is freely available with official
translations into five other languages.
http://www.itu.int/rec/T-REC-X.1526-201401-I

The citation to the Critical Security Controls,
ETSI TR 103 305 is to the V5.1 version.  The V6.0
version as well as the various compendiums and
mapping to frameworks and implementations were
adopted last Friday by the TC CYBER Plenary, and
will be published shortly.   X.1500 Amd 10 in Sept
will reflect the new version.  It will also likely
contain updates for the OASIS STIX, TAXII, and
CybOX specifications, and the new 3GPP Security
Assurance Specification for 3GPP Network Products
(TS 33.116 ,  TS 33.117, and TS 33.926).

--tony

---

From: Adam Montville <[email-masked]>
Date: Mon, 20 Jun 2016 18:43:32 -0500

> On Jun 20, 2016, at 12:02 PM, Haynes, Dan <[email-masked]> wrote:
> 

I believe you are correct, Danny.

---

From: Adam Montville <[email-masked]>
Date: Mon, 20 Jun 2016 18:49:46 -0500

Thanks, Tony.

> On Jun 20, 2016, at 5:34 PM, Tony Rutkowski <[email-masked]> wrote:
> 
> http://www.itu.int/rec/T-REC-X.1526-201401-I <http://www.itu.int/rec/T-REC-X.1526-201401-I>
> 
> <T-REC-X.1500-201603-I!Amd9!PDF-E.pdf>_______________________________________________
> sacm mailing list

---

From: "Haynes, Dan" <[email-masked]>
Date: Wed, 22 Jun 2016 18:40:13 +0000

Given the feedback, I have pulled these changes into the development draft of the I-D on GitHub and they will be available in the next revision.

Thanks,

Danny