Subject: [sacm] Revised draft charter

From: Karen O'Donoghue <[email-masked]>
Date: Tue, 26 Sep 2017 15:21:49 +0000

Folks,

Below is the edited version of the charter update that was produced during the virtual interim today. Thanks to all who participated in the resolution of the comments. This version resolves all the comments received on the mailing list and will be forwarded to Kathleen for review.

Regards,
Karen

**************
SACM Revised Charter
2017-09-26

Securing information and the systems that store, process, and transmit that information is a challenging task for organizations of all sizes, and many security practitioners spend much of their time on manual processes. Standardized protocols and models aiding collection and evaluation of endpoint attributes enables automation, thus freeing practitioners to focus on high priority tasks.

At its core, posture assessment consists of five basic steps, which the working group desires to fulfill in an innovative, automated manner capable of avoiding ad hoc or scheduled assessments:

1. Identify and characterize target endpoints
2. Determine specific endpoint elements to assess
3. Collect and make available specified elements' actual values
4. Compare actual element values to expected element values
5. Make results available
This working group will focus on collection, evaluation, and orchestration and communication, as described herein.

A. Collection. The WG will define a standardized way to provide two types of imperative guidance to collectors over varying collection mechanisms:

1) Which target endpoints to collect from, and
2) What to collect from these target endpoints.
When classified, a set of instructions (such as vulnerability description data, YANG filter expressions, Windows Management Instrumentation classes, etc.) can be brokered to the appropriate collectors using the control plane functions defined by "C. Orchestration and Communication" (below). Detecting and classifying desired attributes beforehand may require orchestrating functions that go beyond the set of capabilities a collector can provide, and will inform the requirements and characteristics for "C. Orchestration and Communication". The working group recognizes that manual configuration of targets and corresponding collection profiles will not scale and does not seem to be a viable option.

B. Evaluation. The working group will standardize a criteria language enabling evaluation of actual endpoint posture information against desired endpoint posture information to produce a standardized result. This extensible language will support complex Boolean statements, comparison operators, logical flow statements, and functions for string manipulation. Additionally, the working group will seek to discover an approach that allows data from any posture collection mechanism to be generically evaluated.
C. Orchestration and Communication. The working group will define a set of control plane functions to enable the discovery and orchestration between devices that can provide the requisite information sought by posture collectors, posture evaluators, data repositories, and other SACM architectural components.

Due to the breadth of this work, the working group will address enterprise use cases pertaining to the assessment of endpoint posture (using the definitions of Endpoint and Posture from RFC 5209). In alignment with RFC 5209, a network device is an endpoint.
Specific work items will include the following:

- Define a way to provide three types of imperative guidance to the correct SACM collectors: 1) Which target endpoints to collect from and 2) what to collect from these target endpoints, and 3) how quickly after an attribute change information must be collected. When classified, a set of instructions, such as vulnerability description data or YANG expressions, can be brokered to the appropriate collectors. Detecting and classifying beforehand might require orchestrating functions that go beyond the set of capabilities some SACM collectors can provide.
- Define an extension of IETF NEA to collect and deliver information about firmware, operating systems, and software installed on an endpoint.
- Describe a criteria language capable of being evaluated against endpoint posture information to produce a standardized result. The language will support complex Boolean statements, comparison operators, and functions for string manipulation; and will be extensible enough to be applicable to the full range of collected posture attributes. Additionally, this document will describe an approach that allows data from any posture collection mechanism to be evaluated.

- Define a control plane function to enable the discovery and orchestration between devices that can provide the requisite information sought by posture collectors, posture evaluators or both. For example, XMPP capable host/endpoint interactions may be defined through XMPP control plane and data transfer protocol extensions.  Likewise, the asynchronous push of selected attributes on switches and routers may be framed using YANG Push for periodic and on-change triggers.
- Define a method of expressing software metadata that is suitable for use by constrained devices including a CBOR-based format derived from the ISO/IEC 19770-2 Software Identification (SWID) tag standard.
- Define best practices for the collection of posture information from endpoints and its delivery to a collector, from which it can be distributed using the SACM messaging standards.
- Extend existing standards for information exchange to support the sharing of software, configuration information, and other forms of imperative guidance including extensions to the Resource-Oriented Lightweight Information Exchange (ROLIE).
- Describe a SACM Information Model and a SACM Architecture including protocol requirements and their associated use cases as well as a description of how SACM protocols fit together into a system.

---

From: Adam Montville <[email-masked]>
Date: Thu, 28 Sep 2017 16:28:11 +0000

Karen,

>From a comment received on a hackathon issue (see [1]). There is a proposal
to change the text in the fourth item of our first numbered list from
"Compare actual element values to expected element values" to "Compare
actual element values to acceptable element values." The proposal
additionally offers that "policy-compliant" could be used in place of
"acceptable".

This change seems sane to me.

Kind regards,

Adam

[1] https://github.com/sacmwg/vulnerability-scenario/issues/30

On Tue, Sep 26, 2017 at 10:21 AM Karen O'Donoghue <[email-masked]>
wrote:

> Folks,
>
> Below is the edited version of the charter update that was produced during
> the virtual interim today. Thanks to all who participated in the resolution
> of the comments. This version resolves all the comments received on the
> mailing list and will be forwarded to Kathleen for review.
>
> Regards,
> Karen
>
> **************
>
> SACM Revised Charter
> 2017-09-26
>
> Securing information and the systems that store, process, and transmit
> that information is a challenging task for organizations of all sizes, and
> many security practitioners spend much of their time on manual processes.
> Standardized protocols and models aiding collection and evaluation of
> endpoint attributes enables automation, thus freeing practitioners to focus
> on high priority tasks.
>
> At its core, posture assessment consists of five basic steps, which the
> working group desires to fulfill in an innovative, automated manner capable
> of avoiding ad hoc or scheduled assessments:
>
> A. Collection. The WG will define a standardized way to provide two types
> of imperative guidance to collectors over varying collection mechanisms:
>
> When classified, a set of instructions (such as vulnerability description
> data, YANG filter expressions, Windows Management Instrumentation classes,
> etc.) can be brokered to the appropriate collectors using the control plane
> functions defined by "C. Orchestration and Communication" (below).
> Detecting and classifying desired attributes beforehand may require
> orchestrating functions that go beyond the set of capabilities a collector
> can provide, and will inform the requirements and characteristics for "C.
> Orchestration and Communication". The working group recognizes that manual
> configuration of targets and corresponding collection profiles will not
> scale and does not seem to be a viable option.
>
> B. Evaluation. The working group will standardize a criteria language
> enabling evaluation of actual endpoint posture information against desired
> endpoint posture information to produce a standardized result. This
> extensible language will support complex Boolean statements, comparison
> operators, logical flow statements, and functions for string manipulation.
> Additionally, the working group will seek to discover an approach that
> allows data from any posture collection mechanism to be generically
> evaluated.
>
> C. Orchestration and Communication. The working group will define a set of
> control plane functions to enable the discovery and orchestration between
> devices that can provide the requisite information sought by posture
> collectors, posture evaluators, data repositories, and other SACM
> architectural components.
>
> Due to the breadth of this work, the working group will address enterprise
> use cases pertaining to the assessment of endpoint posture (using the
> definitions of Endpoint and Posture from RFC 5209). In alignment with RFC
> 5209, a network device is an endpoint.
>
> - Define a way to provide three types of imperative guidance to the
> correct SACM collectors: 1) Which target endpoints to collect from and 2)
> what to collect from these target endpoints, and 3) how quickly after an
> attribute change information must be collected. When classified, a set of
> instructions, such as vulnerability description data or YANG expressions,
> can be brokered to the appropriate collectors. Detecting and classifying
> beforehand might require orchestrating functions that go beyond the set of
> capabilities some SACM collectors can provide.
>
> - Define an extension of IETF NEA to collect and deliver information about
> firmware, operating systems, and software installed on an endpoint.
>
> - Describe a criteria language capable of being evaluated against endpoint
> posture information to produce a standardized result. The language will
> support complex Boolean statements, comparison operators, and functions for
> string manipulation; and will be extensible enough to be applicable to the
> full range of collected posture attributes. Additionally, this document
> will describe an approach that allows data from any posture collection
> mechanism to be evaluated.
>
> - Define a control plane function to enable the discovery and
> orchestration between devices that can provide the requisite information
> sought by posture collectors, posture evaluators or both. For example, XMPP
> capable host/endpoint interactions may be defined through XMPP control
> plane and data transfer protocol extensions.  Likewise, the asynchronous
> push of selected attributes on switches and routers may be framed using
> YANG Push for periodic and on-change triggers.
>
> - Define a method of expressing software metadata that is suitable for use
> by constrained devices including a CBOR-based format derived from the
> ISO/IEC 19770-2 Software Identification (SWID) tag standard.
>
> - Define best practices for the collection of posture information from
> endpoints and its delivery to a collector, from which it can be distributed
> using the SACM messaging standards.
>
> - Extend existing standards for information exchange to support the
> sharing of software, configuration information, and other forms of
> imperative guidance including extensions to the Resource-Oriented
> Lightweight Information Exchange (ROLIE).
>
> - Describe a SACM Information Model and a SACM Architecture including
> protocol requirements and their associated use cases as well as a
> description of how SACM protocols fit together into a system.
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>