Subject: [sacm] Concepts for the Vulnerability Scenario Working Session

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Thu, 19 Jan 2017 14:54:57 +0000

I unfortunately have another commitment this morning, and will not be able to attend the Vulnerability Scenario call this AM. Here are some quickly pulled together notes on components and operations derived from the scenario. This is not a complete list, but IMHO a place to start a conversation.

Please let me know if you have any questions.

Regards,
Dave

Provider of Vulnerability Description Information
-----------------------------------------------------------------
A vulnerability description information resource provider. Examples include the MITRE CVE project, the NIST National Vulnerability Database, and vendor provided vulnerability information feeds.

*         Ideally the vulnerability description information is made available using a common, standardized data model. Such a model has not emerged, although there are a bunch of partial solutions. The model should contain:

o   Vulnerable HW and SW product mappings that can be correlated with endpoint SW and HW inventory data/

*         There is a need to know when a source of vulnerability information has published new  or updated information

*         There is a need to access a specific vulnerability record by request

*         There is a need to search collections of vulnerability information based on metadata found within the records.

*         There is a need for syndication and aggregation of existing vulnerability description information within the bounds of a community or within the network of an end use organization for availability

Enterprise Vulnerability Description Information/Data Repository
---------------------------------------------------------------------------------------
A store, local to the enterprise, of vulnerability description information, vulnerability detection data, and related data.

*         There is a need for syndication and aggregation of existing vulnerability description information from multiple sources. The sources must be tracked so updates can be managed.

*         Need to subscribe to change notifications from sources.

*         May contain a combination of information from multiple sources.

*         There is a need to know when new or updated information has been stored

*         There is a need to access a specific vulnerability record by request

*         There is a need to search collections of vulnerability information based on metadata found within the records.

Configuration Management Database (CMDB) / Posture Store
-----------------------------------------------------------------------------------
Maintains long-term stores of target endpoint HW and SW inventory.

*         Allows publication of target endpoint HW and SW inventory from points of collection.

*         Needs to support querying of stored information and retrieval of specific records

*         Need to support archival, query, and retrieval of historic inventory data to support tending.

Target Endpoint / Collector Client
---------------------------------------------
A networked computing device that may contain vulnerable software or hardware instances.

*         There is a need to externally know the hardware and software load of the endpoint.

*         There is a need to externally subscribe to and monitor SW and HW change events that occur on the endpoint.

*         The enterprise needs to discover new, changed, or removed target endpoints within the enterprise

Collector Server
---------------------
Coordinates collection across a group of target endpoints.

*         Need to manage the what data is collected from a number of endpoints

*         Need to subscribe to HW and SW change events for specific endpoints of interest

*         Need to drive initial collection of new or changed endpoints

*         Need to publish collected data to the CMDB

*         Need to notify Vulnerability Assessment Capability of new data for a given endpoint

Vulnerability Assessment Capability / Evaluator
---------------------------------------------------------------
Performs vulnerability assessment using Vulnerability detection data and collected HW and SW inventory.

*         Need to compare target endpoint HW and SW inventory against vulnerability description data to determine the presence of vulnerabilities on one or more endpoints

David Waltermire
Information Technology Laboratory | Computer Security Division
National Institute of Standards and Technology

---

From: "Haynes, Dan" <[email-masked]>
Date: Mon, 30 Jan 2017 12:24:29 +0000

Hi Dave,

Thanks for the feedback! Your feedback all make sense to me, however, I have a few quick comments/questions inline below.

Thanks,

Danny

> -----Original Message-----
> From: sacm [mailto:[email-masked]] On Behalf Of Waltermire, David
> A. (Fed)
> Sent: Thursday, January 19, 2017 9:55 AM
> To: [email-masked]
> Subject: [sacm] Concepts for the Vulnerability Scenario Working Session
> 
> I unfortunately have another commitment this morning, and will not be able
> to attend the Vulnerability Scenario call this AM. Here are some quickly
> pulled together notes on components and operations derived from the
> scenario. This is not a complete list, but IMHO a place to start a conversation.
> 
> A vulnerability description information resource provider. Examples include
> the MITRE CVE project, the NIST National Vulnerability Database, and vendor
> provided vulnerability information feeds.
> 
> *         Ideally the vulnerability description information is made available using
> a common, standardized data model. Such a model has not emerged,
> although there are a bunch of partial solutions. The model should contain:
> 
> *         There is a need for syndication and aggregation of existing vulnerability
> description information within the bounds of a community or within the
> network of an end use organization for availability

[danny] I absolutely agree with all of this. However, for now, can we simply acknowledge/document it in the wiki and continue to work under the assumption that the enterprise gets this information in some unspecified way and converts it to some machine-readable format for their tools? Just trying to keep the scope of our work as focused as possible. We can always come back to it.

> A store, local to the enterprise, of vulnerability description information,
> vulnerability detection data, and related data.
> 
> *         There is a need for syndication and aggregation of existing vulnerability
> description information from multiple sources. The sources must be tracked
> so updates can be managed.
> 

[danny] Same as above. 

> Configuration Management Database (CMDB) / Posture Store

[danny]: Don't we want to also include basic configuration setting information here as well?

> *         There is a need to externally subscribe to and monitor SW and HW
> change events that occur on the endpoint.
> 

[danny]: Don't we want to also include basic configuration setting information here as well?

> Collector Server

[danny]: Do we want to say something about identifying endpoints and possibly building up endpoint characterization records?

> *         Need to compare target endpoint HW and SW inventory against
> vulnerability description data to determine the presence of vulnerabilities on
> one or more endpoints

[danny]: Don't we want to also include basic configuration setting information here as well?