Subject: [sacm] new drafts about network infrastructure device's security baseline:

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 7 Sep 2017 08:04:50 +0000

Hi all,
We just submit 3 drafts to specify the yang data model of network infrastructure devices (i.e., router, switch, firewall, etc) security posture, or call it security baseline. Each draft covers one of the three planes of network infrastructure devices: data plane, control plane, management plane.

https://tools.ietf.org/html/draft-xia-sacm-nid-dp-security-baseline-00

https://tools.ietf.org/html/draft-dong-sacm-nid-cp-security-baseline-00

https://tools.ietf.org/html/draft-lin-sacm-nid-mp-security-baseline-00

The goal is to facilitate the collection and assessment of the overall security posture of the network infrastructure devices, in order to realize the whole lifecycle security automation for the infrastructure network.
Your comments are warmly welcome!

B.R.
Frank

---

From: Henk Birkholz <[email-masked]>
Date: Thu, 7 Sep 2017 12:48:04 +0200

Hi Frank,

wow that is nice complementary work! But may I ask, is the a reason why u started it without me? Isn't is aligning with the i2nsf IM for monitoring? Im only curious.

Viele Grüße,

Henk

On September 7, 2017 10:04:50 AM GMT+02:00, "Xialiang (Frank)" <[email-masked]> wrote:
>Hi all,
>We just submit 3 drafts to specify the yang data model of network
>infrastructure devices (i.e., router, switch, firewall, etc) security
>posture, or call it security baseline. Each draft covers one of the
>three planes of network infrastructure devices: data plane, control
>plane, management plane.
>
>The goal is to facilitate the collection and assessment of the overall
>security posture of the network infrastructure devices, in order to
>realize the whole lifecycle security automation for the infrastructure
>network.

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 7 Sep 2017 15:19:25 +0000

Hi Henk,
happy that you are interested in these drafts. In fact, we think this work is very suitable in the scope of SACM WG, as they are focusing on the security posture collection and assessment of network device endpoint.
So, our plan is to make all of these data models aligned with the defined SACM information model in the next step.
we appreciate any comments and helps from SACM WG.
--------------------------------------------------
Frank
Products & Solutions-Network Integration Technology Research Dept
发件人：Henk Birkholz
收件人：[email-masked],
时间：2017-09-07 18:48:37
主 题：Re: [sacm] new drafts about network infrastructure device's security baseline:

Hi Frank,

Viele Grüße,

Henk

B.R.
Frank

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Thu, 7 Sep 2017 18:10:37 +0000

When checking the SACM charter, I do not see any references to network infrastructure or network elements. I believe SACM's initial focus was on endpoints. Do these three drafts even fall in SACM's charter as it is right now?
Panos

From: sacm [mailto:[email-masked]] On Behalf Of Xialiang (Frank)
Sent: Thursday, September 07, 2017 4:05 AM
To: [email-masked]
Cc: Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying (Walker) <[email-masked]>; dongyue (D) <[email-masked]>
Subject: [sacm] new drafts about network infrastructure device's security baseline:

Hi all,

B.R.
Frank

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Thu, 7 Sep 2017 19:00:30 +0000

Panos,

At the last IETF meeting we started discussing a charter update. I believe we are currently waiting on the chairs to start this discussion on the list. This will give the working group an opportunity to clarify this issue in the charter.

As far as endpoints, the definition that has been used for endpoints in the SACM charter is the one from RFC 5209, which is "Any computing device that can be connected to a network.
      Such devices normally are associated with a particular link layer
      address before joining the network and potentially an IP address
      once on the network.  This includes: laptops, desktops, servers,
      cell phones, or any device that may have an IP address."

As most network devices are connected to networks, and often expose a management interface that is IP addressable, I'd say they qualify as endpoints. This view is also reflected in the SACM terminology, which states "To further clarify the [RFC5209<https://tools.ietf.org/html/rfc5209>] definition, an endpoint is any

      physical or virtual device that may have a network address.  Note

      that, network infrastructure devices (e.g. switches, routers,

      firewalls), which fit the definition, are also considered to be

      endpoints within this document."

This text squares with my original view of endpoints way back when we were working on the original SACM charter.

Regards,

Dave

From: sacm [mailto:[email-masked]] On Behalf Of Panos Kampanakis (pkampana)
Sent: Thursday, September 07, 2017 2:11 PM
To: Xialiang (Frank) <[email-masked]>; [email-masked]
Cc: Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying (Walker) <[email-masked]>; dongyue (D) <[email-masked]>
Subject: Re: [sacm] new drafts about network infrastructure device's security baseline:

From: sacm [mailto:[email-masked]] On Behalf Of Xialiang (Frank)
Sent: Thursday, September 07, 2017 4:05 AM
To: [email-masked]<mailto:[email-masked]>
Cc: Linqiushi (Jessica, SCC) <[email-masked]<mailto:[email-masked]>>; Zhengguangying (Walker) <[email-masked]<mailto:[email-masked]>>; dongyue (D) <[email-masked]<mailto:[email-masked]>>
Subject: [sacm] new drafts about network infrastructure device's security baseline:

Hi all,

B.R.
Frank

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Fri, 8 Sep 2017 02:39:44 +0000

Hi Dave and Panos,
I think Dave gives a very clear and detailed clarification about the definition of endpoints in SACM and the latest SACM plan, thanks.

I will follow the SACM information model and the latest decision to update these drafts.
Any comments are welcome!

B.R.
Frank

发件人: Waltermire, David A. (Fed) [mailto:[email-masked]]
发送时间: 2017年9月8日 3:01
收件人: Panos Kampanakis (pkampana); Xialiang (Frank); [email-masked]
抄送: Linqiushi (Jessica, SCC); Zhengguangying (Walker); dongyue (D)
主题: RE: new drafts about network infrastructure device's security baseline:

Panos,

As far as endpoints, the definition that has been used for endpoints in the SACM charter is the one from RFC 5209, which is “Any computing device that can be connected to a network.
      Such devices normally are associated with a particular link layer
      address before joining the network and potentially an IP address
      once on the network.  This includes: laptops, desktops, servers,
      cell phones, or any device that may have an IP address.”

As most network devices are connected to networks, and often expose a management interface that is IP addressable, I’d say they qualify as endpoints. This view is also reflected in the SACM terminology, which states “To further clarify the [RFC5209<https://tools.ietf.org/html/rfc5209>] definition, an endpoint is any

      endpoints within this document.”

Regards,

Dave

To: Xialiang (Frank) <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>

When checking the SACM charter, I do not see any references to network infrastructure or network elements. I believe SACM’s initial focus was on endpoints. Do these three drafts even fall in SACM’s charter as it is right now?
Panos

Hi all,

B.R.
Frank

---

From: Adam Montville <[email-masked]>
Date: Fri, 08 Sep 2017 13:33:50 +0000

Dave's recollection regarding "endpoint" in SACM is correct - it's an old
discussion that comes up from time to time, but because network devices are
often addressable by IP, they're considered in the context of their
management an endpoint. The charter could have been clearer, perhaps, and
as we work toward a new charter (chairs will have something to the list
very soon) the working group may choose to be more specific.

Kind regards,

Adam

On Thu, Sep 7, 2017 at 9:40 PM Xialiang (Frank) <[email-masked]>
wrote:

> Hi Dave and Panos,
>
> I think Dave gives a very clear and detailed clarification about the
> definition of endpoints in SACM and the latest SACM plan, thanks.
>
>
>
> *发件人:* Waltermire, David A. (Fed) [mailto:[email-masked]]
> *发送时间:* 2017年9月8日 3:01
> *收件人:* Panos Kampanakis (pkampana); Xialiang (Frank); [email-masked]
> *抄送:* Linqiushi (Jessica, SCC); Zhengguangying (Walker); dongyue (D)
> *主题:* RE: new drafts about network infrastructure device's security
> baseline:
>
>
>
> Panos,
>
>
>
> At the last IETF meeting we started discussing a charter update. I believe
> we are currently waiting on the chairs to start this discussion on the
> list. This will give the working group an opportunity to clarify this issue
> in the charter.
>
>
>
> As most network devices are connected to networks, and often expose a management interface that is IP addressable, I’d say they qualify as endpoints. This view is also reflected in the SACM terminology, which states “To further clarify the [RFC5209 <https://tools.ietf.org/html/rfc5209>] definition, an endpoint is any
>
> *From:* sacm [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Panos Kampanakis (pkampana)
> *Sent:* Thursday, September 07, 2017 2:11 PM
> *To:* Xialiang (Frank) <[email-masked]>; [email-masked]
> *Cc:* Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying
> (Walker) <[email-masked]>; dongyue (D) <[email-masked]>
> *Subject:* Re: [sacm] new drafts about network infrastructure device's
> security baseline:
>
>
>
> When checking the SACM charter, I do not see any references to network
> infrastructure or network elements. I believe SACM’s initial focus was on
> endpoints. Do these three drafts even fall in SACM’s charter as it is right
> now?
>
> Panos
>
>
>
>
>
> *From:* sacm [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Xialiang (Frank)
> *Sent:* Thursday, September 07, 2017 4:05 AM
> *To:* [email-masked]
> *Cc:* Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying
> (Walker) <[email-masked]>; dongyue (D) <[email-masked]>
> *Subject:* [sacm] new drafts about network infrastructure device's
> security baseline:
>
>
>
> Hi all,
>
> posture, or call it security baseline. Each draft covers one of the three
> planes of network infrastructure devices: data plane, control plane,
> management plane.
>
> security posture of the network infrastructure devices, in order to realize
> the whole lifecycle security automation for the infrastructure network.
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>