Subject: Re: [sacm] Working Group Last Call for draft-ietf-sacm-vuln-scenario

From: Adam Montville <[email-masked]>
Date: Mon, 1 Aug 2016 17:48:18 -0400

All:

This is a reminder on this WGLC.  Please provide your input in favor or against.  I'm surprised no one has yet chimed in.

Kind regards,

Adam

> On Jul 28, 2016, at 10:20 AM, Adam Montville <[email-masked]> wrote:
> 
> This message starts a Working Group Last Call for the Internet-Draft ‘SACM Vulnerability Assessment Scenario’ — https://datatracker.ietf.org/doc/draft-ietf-sacm-vuln-scenario/ <https://datatracker.ietf.org/doc/draft-ietf-sacm-vuln-scenario/>.  Please send your comments, questions, and edit proposals to the WG mail list until August 5, 2016.  If you believe the document is ready to be submitted to the IESG for consideration as an Informational RFC, please send a short message stating so.
> 
> Kind regards,
> 
> Adam

---

From: Jessica Fitzgerald-McKay <[email-masked]>
Date: Wed, 3 Aug 2016 10:33:04 -0400

The Vulnerability Assessment Scenario is a good capture of a problem that
plagues network security experts. SACM can focus in the near term on
developing solutions to address the Vulnerability Assessment Scenario;
these solutions can then be built upon to support additional use cases in
the SACM work space. Therefore, I vote in favor of submitting the document
to the IESG as an Informational RFC.

Thanks,
Jess

On Mon, Aug 1, 2016 at 5:48 PM, Adam Montville <[email-masked]>
wrote:

> All:
>
> This is a reminder on this WGLC.  Please provide your input in favor or
> against.  I'm surprised no one has yet chimed in.
>
> Kind regards,
>
> Adam
>
> This message starts a Working Group Last Call for the Internet-Draft ‘SACM
> Vulnerability Assessment Scenario’ —
> https://datatracker.ietf.org/doc/draft-ietf-sacm-vuln-scenario/.  Please
> send your comments, questions, and edit proposals to the WG mail list until
> August 5, 2016.  If you believe the document is ready to be submitted to
> the IESG for consideration as an Informational RFC, please send a short
> message stating so.
>
> Kind regards,
>
> Adam
>
>
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>
>

---

From: "Haynes, Dan" <[email-masked]>
Date: Wed, 3 Aug 2016 17:55:05 +0000

+1.

-Danny

From: sacm [mailto:[email-masked]] On Behalf Of Jessica Fitzgerald-McKay
Sent: Wednesday, August 03, 2016 10:33 AM
To: Adam Montville <[email-masked]>
Cc: <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Working Group Last Call for draft-ietf-sacm-vuln-scenario

The Vulnerability Assessment Scenario is a good capture of a problem that plagues network security experts. SACM can focus in the near term on developing solutions to address the Vulnerability Assessment Scenario; these solutions can then be built upon to support additional use cases in the SACM work space. Therefore, I vote in favor of submitting the document to the IESG as an Informational RFC.
Thanks,
Jess

On Mon, Aug 1, 2016 at 5:48 PM, Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:
All:

Kind regards,

Adam

On Jul 28, 2016, at 10:20 AM, Adam Montville <[email-masked]<mailto:[email-masked]>> wrote:

This message starts a Working Group Last Call for the Internet-Draft ‘SACM Vulnerability Assessment Scenario’ — https://datatracker.ietf.org/doc/draft-ietf-sacm-vuln-scenario/.  Please send your comments, questions, and edit proposals to the WG mail list until August 5, 2016.  If you believe the document is ready to be submitted to the IESG for consideration as an Informational RFC, please send a short message stating so.

Kind regards,

Adam

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 4 Aug 2016 19:09:53 +0000

I believe that this document is ready for submission to the IESG for consideration as Informational RFC.

Regards,

Dan

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Thursday, July 28, 2016 5:21 PM
To: <[email-masked]>
Subject: [sacm] Working Group Last Call for draft-ietf-sacm-vuln-scenario

Kind regards,

Adam

---

From: Henk Birkholz <[email-masked]>
Date: Fri, 5 Aug 2016 13:32:34 +0200

Hello,

a few comments and nits:

- Why is "Endpoint Vulnerability Assessment Capability" only a title of 
section 5 and not in the list of section 2 (or used anywhere else)?

- I would like to see a better differentiation between Endpoint, Target 
Endpoint and SACM component. Mostly the term Endpoint is used for all 
three purposes, I think.

- I would like to see a better mapping of the very general terms in 
section 2 to more specific terms that are aligned with SACM terminology. 
Some of that is already done throughout the Appendices, but is quite 
difficult to find and thereby to understand, I think.

Please have a look at a very naive, probably far from complete, and too 
wordy attempt of illustrating what I try to convey here:

Vulnerability description information: information about 
vulnerabilities, e.g. CVE
=> Vulnerability Description Information
=> Vulnerability Description Information Repository

Vulnerability detection data: guidance on how to detect a vulnerable 
software component on a target endpoint
=> Vulnerability Detection Guidance
=> Vulnerability Detection Guidance Repository

Endpoint management capability: tasks and functions that create and 
provide an updated list of target endpoints in a SACM domain
=> Target Endpoint Information
=> Target Endpoint Information Repository
=> Target Endpoint Discovery Task
=> Target Endpoint Discovery Results
=> Target Endpoint Collection Task (is called "Endpoint Data Collection" 
in B.1.)
=> Target Endpoint Collection Results

Vulnerability management capability: the task of detecting vulnerable 
software components on a target endpoint
=> Vulnerability Detection Task
=> Vulnerability Detection Results

Vulnerability assessment: the work-flow that produces evaluation results 
regarding target endpoints with vulnerable software components
=> Vulnerability Assessment
=> Vulnerability Assessment Results

Viele Grüße,

Henk

On 07/28/2016 04:20 PM, Adam Montville wrote:
> This message starts a Working Group Last Call for the Internet-Draft
> ‘SACM Vulnerability Assessment Scenario’
> — https://datatracker.ietf.org/doc/draft-ietf-sacm-vuln-scenario/.
>  Please send your comments, questions, and edit proposals to the WG mail
> list until August 5, 2016.  If you believe the document is ready to be
> submitted to the IESG for consideration as an Informational RFC, please
> send a short message stating so.
>
> Kind regards,
>
> Adam
>
>

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Fri, 5 Aug 2016 12:56:59 +0000

+1

Dave

From: sacm [mailto:[email-masked]] On Behalf Of Haynes, Dan
Sent: Wednesday, August 03, 2016 1:55 PM
To: Jessica Fitzgerald-McKay <[email-masked]>; Adam Montville <[email-masked]>
Cc: <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Working Group Last Call for draft-ietf-sacm-vuln-scenario

+1.

-Danny

From: sacm [mailto:[email-masked]] On Behalf Of Jessica Fitzgerald-McKay
Sent: Wednesday, August 03, 2016 10:33 AM
To: Adam Montville <[email-masked]<mailto:[email-masked]>>
Cc: <[email-masked]<mailto:[email-masked]>> <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] Working Group Last Call for draft-ietf-sacm-vuln-scenario

Kind regards,

Adam

Kind regards,

Adam

---

From: John Strassner <[email-masked]>
Date: Fri, 5 Aug 2016 13:50:08 -0500

+1

regards,
John

On Fri, Aug 5, 2016 at 7:56 AM, Waltermire, David A. (Fed) <
[email-masked]> wrote:

> +1
>
>
>
> Dave
>
>
>
> *From:* sacm [mailto:[email-masked]] *On Behalf Of *Haynes, Dan
> *Sent:* Wednesday, August 03, 2016 1:55 PM
> *To:* Jessica Fitzgerald-McKay <[email-masked]>; Adam Montville <
> [email-masked]>
> *Cc:* <[email-masked]> <[email-masked]>
> *Subject:* Re: [sacm] Working Group Last Call for
> draft-ietf-sacm-vuln-scenario
>
>
>
> +1.
>
>
>
> -Danny
>
>
>
> *From:* sacm [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Jessica Fitzgerald-McKay
> *Sent:* Wednesday, August 03, 2016 10:33 AM
> *To:* Adam Montville <[email-masked]>
> *Cc:* <[email-masked]> <[email-masked]>
> *Subject:* Re: [sacm] Working Group Last Call for
> draft-ietf-sacm-vuln-scenario
>
>
>
> Vulnerability Assessment Scenario’ — https://datatracker.ietf.
> org/doc/draft-ietf-sacm-vuln-scenario/.  Please send your comments,
> questions, and edit proposals to the WG mail list until August 5, 2016.  If
> you believe the document is ready to be submitted to the IESG for
> consideration as an Informational RFC, please send a short message stating
> so.
>
>
>
> Kind regards,
>
>
>
> Adam
>
>
>
>

-- 
regards,
John

---

From: Ira McDonald <[email-masked]>
Date: Fri, 5 Aug 2016 14:59:08 -0400

Hi,

+1

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Jan-April: 579 Park Place  Saline, MI  48176  734-944-0094
May-Dec: PO Box 221  Grand Marais, MI 49839  906-494-2434

On Fri, Aug 5, 2016 at 2:50 PM, John Strassner <[email-masked]> wrote:

>> On Mon, Aug 1, 2016 at 5:48 PM, Adam Montville <
>> [email-masked]> wrote:
>>
>> All:
>>
>>
>>
>> ‘SACM Vulnerability Assessment Scenario’ — https://datatracker.ietf.org
>> /doc/draft-ietf-sacm-vuln-scenario/.  Please send your comments,

---

From: Jarrett Lu <[email-masked]>
Date: Wed, 10 Aug 2016 13:02:20 -0700

On 08/ 5/16 04:32 AM, Henk Birkholz wrote:
> Hello,
>
> a few comments and nits:
>
> - Why is "Endpoint Vulnerability Assessment Capability" only a title 
> of section 5 and not in the list of section 2 (or used anywhere else)?
>
> - I would like to see a better differentiation between Endpoint, 
> Target Endpoint and SACM component. Mostly the term Endpoint is used 
> for all three purposes, I think.
>
> section 2 to more specific terms that are aligned with SACM 
> terminology. Some of that is already done throughout the Appendices, 
> but is quite difficult to find and thereby to understand, I think.
>
> Please have a look at a very naive, probably far from complete, and 
> too wordy attempt of illustrating what I try to convey here:
>
> => Target Endpoint Collection Task (is called "Endpoint Data 
> Collection" in B.1.)

Henk and I talked about his comment in our terminology sub team meeting 
today. I suggested that making the word "capability" plural, i.e. 
capability -> capabilities, may help clarifying the mapping. Since we 
already have the terms "capability" and "task" defined in terminology 
draft, listing Target Endpoint management capabilities in the 
vulnerability draft should not confuse readers. We don't have plans to 
add this list of capabilities to the terminology draft but can be 
persuaded to do so.

I understand that my comment didn't meet the last call deadline. My 
apologies.

- Jarrett

> Vulnerability assessment: the work-flow that produces evaluation 
> results regarding target endpoints with vulnerable software components

---

From: Adam Montville <[email-masked]>
Date: Wed, 24 Aug 2016 14:56:22 -0500

There seems to be good consensus on putting our vulnerability draft through to the IESG.  Henk had some terminology-related comments that were augmented by Jarrett.  The suggestion [1] was to change "Endpoint Vulnerability Assessment Capability" to "Endpoint Vulnerability Assessment Capabilities" (make it plural).  Given that we have consensus as it stands, I don't feel that we should require the draft to be updated, but the change is small, and simple, so we could do so easily.  Danny, would you be willing to make that small change before we submit the draft to IESG?

Kind regards,

Adam

[1] https://mailarchive.ietf.org/arch/msg/sacm/lPHC95Ug2lQWTYC1HG5s2iMOYic <https://mailarchive.ietf.org/arch/msg/sacm/lPHC95Ug2lQWTYC1HG5s2iMOYic> 

> On Jul 28, 2016, at 9:20 AM, Adam Montville <[email-masked]> wrote:
>

---

From: Adam Montville <[email-masked]>
Date: Wed, 24 Aug 2016 15:02:28 -0500

I just noticed Jim's comments under a different subject (next time, please provide your comments under the same subject heading which makes judging consensus and open issues a bit less error prone and a bit easier).  Does anyone have any comment on Jim's findings?  https://mailarchive.ietf.org/arch/msg/sacm/JjvnpiodY9X32yjq72W-FIMLpB4 <https://mailarchive.ietf.org/arch/msg/sacm/JjvnpiodY9X32yjq72W-FIMLpB4>  I'll reproduce his comments here.

Section 1 - first sentence.  This says that it is detailed.  I question that
statement as I found it to gloss over almost everything

The second sentence of the introduction makes a promise that I cannot find
fulfilled anyplace in the core text of this document.  How is this informing
protocol or data model development?  What I expect to see if a set of
statements in the document along the lines of "This affects means that we
need to have a protocol that does X" or "This affects the data model because
it needs to do Y."  I expect that this is going to be highlighted in the
text if that is the function of the document.

Section 1 - If prioritization is so important - should it affect the IM?

Section 1 - Are we expecting to publish vulnerabilities in the IM long term?
If so it would see that at least part of publication would be in scope.

Section 2 - are you sure you want me to read this?  Vulnerability
description information:  The subject of the first sentence is Information -
so it appears to say Information which can adversely impact. Kill everything
starting with which

Section 3 - bullet point 1 - How much of the processing is processing into
something that is SACM IM aware?  Actually, looking at most of these
assumptions they seem to be things that people have said that SACM should be
able to do.  It would be useful to call that out and say what things in SACM
will support these assumptions.

Section 3 - bullet point 4 - I have no idea what this says

Section 4.2 - What components are we talking about that it is going to
understood by?  This is the first time that I know that you have used this
word.  As far as I know, there is current no reason for any of this data to
be SACM data but could all be company proprietary.

I found this document to be very hard to review.  From my point of view it
is lacking any useful information and therefore does not help progress any
work in the group.  If it is published I will do my best to forget that it
ever existed and go forward.

Jim

Never ask for a review unless you really want one, you will probably not be
happy with the results.

Appendix I seems to be short on implementation specific details as promised
in section 4.1

B.1 para #1 - The last sentence makes zero sense to me

B.1 para #2-4 - You need to motivate these paragraphs.

> On Aug 24, 2016, at 2:56 PM, Adam Montville <[email-masked]> wrote:
> 
>> On Jul 28, 2016, at 9:20 AM, Adam Montville <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: Adam Montville <[email-masked]>
Date: Thu, 25 Aug 2016 07:24:59 -0500

Jim, I've reviewed your comments, thanks for making them.  I think your perspective is at a lower level than that which this draft intends to live.  The draft is intended to describe an operational scenario not at the network layer, but from the perspective of running and operating a security program.  I think some of the nits you have are probably valid, but many of your comments, I feel, may stem from the desire to have this scenario describe something at a lower level than that which was intended.

As someone familiar with security programs and the basic processes and procedures typically embodied by them, this draft made sense to me (as did many of the novel acronyms, having been in this problem domain for a while).

> On Aug 24, 2016, at 3:02 PM, Adam Montville <[email-masked]> wrote:
> 
>> On Aug 24, 2016, at 2:56 PM, Adam Montville <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: Jim Schaad <[email-masked]>
Date: Thu, 25 Aug 2016 19:25:53 -0700

My memory can easily be faulty on this, nothing like going to a meeting long ago and only partially paying attention.  However I was under the impression that the purpose of this document was to help formulate the solutions that the WG needed to create.  This would include helping to figure out what goes into the IM, what interfaces, and what control are needed.  My impression was not that this was a high level document to describe how to operate a security program.

I have no way to evaluate if it meets the second goal, nor am I sure that it is useful to document that goal as I have zero basis to evaluate that on.  I definitely does not meet what I thought the goal of the document was.  This does not mean that I would be so violently oppose to publishing the document as to file an appeal or anything.

Jim

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Thursday, August 25, 2016 5:25 AM
To: <[email-masked]> <[email-masked]>
Subject: Re: [sacm] Working Group Last Call for draft-ietf-sacm-vuln-scenario

 

On Aug 24, 2016, at 3:02 PM, Adam Montville <[email-masked] <mailto:[email-masked]> > wrote:

I just noticed Jim's comments under a different subject (next time, please provide your comments under the same subject heading which makes judging consensus and open issues a bit less error prone and a bit easier).  Does anyone have any comment on Jim's findings?  https://mailarchive.ietf.org/arch/msg/sacm/JjvnpiodY9X32yjq72W-FIMLpB4  I'll reproduce his comments here.

Jim

On Aug 24, 2016, at 2:56 PM, Adam Montville <[email-masked] <mailto:[email-masked]> > wrote:

Kind regards,

Adam

[1] https://mailarchive.ietf.org/arch/msg/sacm/lPHC95Ug2lQWTYC1HG5s2iMOYic 

On Jul 28, 2016, at 9:20 AM, Adam Montville <[email-masked] <mailto:[email-masked]> > wrote:

Kind regards,

Adam