Subject: [sacm] Notes on Vulnerability Scenario Working Session

From: Adam Montville <[email-masked]>
Date: Thu, 19 Jan 2017 17:35:08 +0000

Hello. A few of us met informally today to discuss the vulnerability
scenario in some more detail with the goal of maintaining the narrow focus
on a vulnerability assessment slice through our notional environment.  We
are tending to look at major components as black boxes with interfaces and
data format expectations, and we are not necessarily concerned with how
those components do things internally/behind the scenes.

The meeting was recorded (you can find it with today's date at [1]).  The
topic of discussion was primarily in the "phase 1" area of what Danny sent
to the list not very long ago [2], and resulted in a *starting point*
diagram [3].

The group who met today are (roughly) agreed on the six main "components"
represented in that diagram, but also see that we have some work ahead.
Specifically, we quickly recognized that some of the assumptions the
vulnerability draft makes may be assumptions we cannot afford to make and
need to include in the exploration.

We thought it would be a good idea to have another informal discussion in a
couple of weeks (February 2) at the same time (10am Eastern / 3pm UTC),
using the same WebEx [4].   At that time we intend to roll through the
vulnerability assessment scenario assumptions in an effort to determine
which ones can be left as assumptions and which ones cannot.  Then we'll
take another look at the diagram and work on its next version.

Stay tuned.

Thanks to Danny, Stephen, and Jerome for joining and contributing!

Kind regards,

Adam

[1] https://drive.google.com/open?id=0B8Wf9Un5FdCbWGhDOHpVR0tMd1E
[2] https://mailarchive.ietf.org/arch/msg/sacm/_LiKlyvAws_OVLFhB5NSU58MXDM
[3] https://drive.google.com/open?id=0B8Wf9Un5FdCbMU5pdTRjejJtNHc
[4] https://ietf.webex.com/meet/sacm

---

From: Jerome Athias <[email-masked]>
Date: Thu, 19 Jan 2017 21:01:28 +0300

Hi,

Thanks a lot, I do like the diagram.

While reviewed recently, and could potentially support the transition
between Phase 1 (from "Identify -where- different tasks occur in the
diagram" to "Identify -when- different tasks occur in the diagram")
and Phase 2:
(understanding that the scope of the following resource is not
directly related to SACM), I found some of the diagrams (i.e. Figure
3, Page 8) of this reference interesting in terms of "events/tasks
over time representation"
https://www.first.org/_assets/downloads/FIRST-Multiparty-Vulnerability-Coordination-draft.pdf

(note also in its content some points related to aggregation and the
"left side" of our diagram as discussed during the meeting)

On Thu, Jan 19, 2017 at 8:35 PM, Adam Montville
<[email-masked]> wrote:
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Adam Montville <[email-masked]>
Date: Mon, 30 Jan 2017 17:21:37 +0000

Hi everyone.  Just a friendly reminder that we are planning to meet again
this Thursday at the same time (2/2 @ 10am Eastern/3pm UTC) using SACM's
meeting room at https://ietf.webex.com/meet/sacm.

Kind regards,

Adam

On Thu, Jan 19, 2017 at 11:35 AM Adam Montville <[email-masked]>
wrote:

> We thought it would be a good idea to have another informal discussion in
> a couple of weeks (February 2) at the same time (10am Eastern / 3pm UTC),