Subject: Re: [sacm] 答复: new drafts about network infrastructure device's security baseline:

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Mon, 11 Sep 2017 15:35:13 +0000

Hi Frank,

It is not clear to me why we couldn’t reference the work and attributes already being worked on in NETMOD and perhaps i2nsf?  While I agree that SACM includes network elements as endpoints, I think we can leverage work already being defined by other working groups.

Warm regards, Nancy

From: sacm <[email-masked]> on behalf of "Xialiang (Frank)" <[email-masked]>
Date: Thursday, September 7, 2017 at 7:39 PM
To: "Waltermire, David A. (Fed)" <[email-masked]>, Panos Kampanakis <[email-masked]>, "[email-masked]" <[email-masked]>
Cc: "Linqiushi (Jessica, SCC)" <[email-masked]>, "Zhengguangying (Walker)" <[email-masked]>, "dongyue (D)" <[email-masked]>
Subject: [sacm] 答复: new drafts about network infrastructure device's security baseline:

Hi Dave and Panos,
I think Dave gives a very clear and detailed clarification about the definition of endpoints in SACM and the latest SACM plan, thanks.

I will follow the SACM information model and the latest decision to update these drafts.
Any comments are welcome!

B.R.
Frank

发件人: Waltermire, David A. (Fed) [mailto:[email-masked]]
发送时间: 2017年9月8日 3:01
收件人: Panos Kampanakis (pkampana); Xialiang (Frank); [email-masked]
抄送: Linqiushi (Jessica, SCC); Zhengguangying (Walker); dongyue (D)
主题: RE: new drafts about network infrastructure device's security baseline:

Panos,

At the last IETF meeting we started discussing a charter update. I believe we are currently waiting on the chairs to start this discussion on the list. This will give the working group an opportunity to clarify this issue in the charter.

As far as endpoints, the definition that has been used for endpoints in the SACM charter is the one from RFC 5209, which is “Any computing device that can be connected to a network.
      Such devices normally are associated with a particular link layer
      address before joining the network and potentially an IP address
      once on the network.  This includes: laptops, desktops, servers,
      cell phones, or any device that may have an IP address.”

As most network devices are connected to networks, and often expose a management interface that is IP addressable, I’d say they qualify as endpoints. This view is also reflected in the SACM terminology, which states “To further clarify the [RFC5209<https://tools.ietf.org/html/rfc5209>] definition, an endpoint is any

      physical or virtual device that may have a network address.  Note

      that, network infrastructure devices (e.g. switches, routers,

      firewalls), which fit the definition, are also considered to be

      endpoints within this document.”

This text squares with my original view of endpoints way back when we were working on the original SACM charter.

Regards,

Dave

From: sacm [mailto:[email-masked]] On Behalf Of Panos Kampanakis (pkampana)
Sent: Thursday, September 07, 2017 2:11 PM
To: Xialiang (Frank) <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Cc: Linqiushi (Jessica, SCC) <[email-masked]<mailto:[email-masked]>>; Zhengguangying (Walker) <[email-masked]<mailto:[email-masked]>>; dongyue (D) <[email-masked]<mailto:[email-masked]>>
Subject: Re: [sacm] new drafts about network infrastructure device's security baseline:

When checking the SACM charter, I do not see any references to network infrastructure or network elements. I believe SACM’s initial focus was on endpoints. Do these three drafts even fall in SACM’s charter as it is right now?
Panos

From: sacm [mailto:[email-masked]] On Behalf Of Xialiang (Frank)
Sent: Thursday, September 07, 2017 4:05 AM
To: [email-masked]<mailto:[email-masked]>
Cc: Linqiushi (Jessica, SCC) <[email-masked]<mailto:[email-masked]>>; Zhengguangying (Walker) <[email-masked]<mailto:[email-masked]>>; dongyue (D) <[email-masked]<mailto:[email-masked]>>
Subject: [sacm] new drafts about network infrastructure device's security baseline:

Hi all,
We just submit 3 drafts to specify the yang data model of network infrastructure devices (i.e., router, switch, firewall, etc) security posture, or call it security baseline. Each draft covers one of the three planes of network infrastructure devices: data plane, control plane, management plane.

https://tools.ietf.org/html/draft-xia-sacm-nid-dp-security-baseline-00

https://tools.ietf.org/html/draft-dong-sacm-nid-cp-security-baseline-00

https://tools.ietf.org/html/draft-lin-sacm-nid-mp-security-baseline-00

The goal is to facilitate the collection and assessment of the overall security posture of the network infrastructure devices, in order to realize the whole lifecycle security automation for the infrastructure network.
Your comments are warmly welcome!

B.R.
Frank

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 11 Sep 2017 17:26:04 -0400

On Mon, Sep 11, 2017 at 11:35 AM, Nancy Cam-Winget (ncamwing)
<[email-masked]> wrote:
> Hi Frank,
>
>
>
> It is not clear to me why we couldn’t reference the work and attributes
> already being worked on in NETMOD and perhaps i2nsf?  While I agree that
> SACM includes network elements as endpoints, I think we can leverage work
> already being defined by other working groups.

Yes, I agree with Nancy.  If the work exists already, it should be
referenced.  YANG is the preferred method and there appears to be
direct copy and paste from IPFIX and other technologies.

Best regards,
Kathleen
> To: "Waltermire, David A. (Fed)" <[email-masked]>, Panos
> Kampanakis <[email-masked]>, "[email-masked]" <[email-masked]>
> Cc: "Linqiushi (Jessica, SCC)" <[email-masked]>, "Zhengguangying
> (Walker)" <[email-masked]>, "dongyue (D)" <[email-masked]>
> I think Dave gives a very clear and detailed clarification about the
> definition of endpoints in SACM and the latest SACM plan, thanks.
>
>
>
> At the last IETF meeting we started discussing a charter update. I believe
> we are currently waiting on the chairs to start this discussion on the list.
> This will give the working group an opportunity to clarify this issue in the
> charter.
>
>
>
> As far as endpoints, the definition that has been used for endpoints in the
> SACM charter is the one from RFC 5209, which is “Any computing device that
> can be connected to a network.
>
> As most network devices are connected to networks, and often expose a
> management interface that is IP addressable, I’d say they qualify as
> endpoints. This view is also reflected in the SACM terminology, which states
> “To further clarify the [RFC5209] definition, an endpoint is any
>
> To: Xialiang (Frank) <[email-masked]>; [email-masked]
> Cc: Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying (Walker)
> <[email-masked]>; dongyue (D) <[email-masked]>
> When checking the SACM charter, I do not see any references to network
> infrastructure or network elements. I believe SACM’s initial focus was on
> endpoints. Do these three drafts even fall in SACM’s charter as it is right
> now?
>
> Panos
>
>
>
>
>
> To: [email-masked]
> Cc: Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying (Walker)
> <[email-masked]>; dongyue (D) <[email-masked]>
> We just submit 3 drafts to specify the yang data model of network
> infrastructure devices (i.e., router, switch, firewall, etc) security
> posture, or call it security baseline. Each draft covers one of the three
> planes of network infrastructure devices: data plane, control plane,
> management plane.
>
> The goal is to facilitate the collection and assessment of the overall
> security posture of the network infrastructure devices, in order to realize
> the whole lifecycle security automation for the infrastructure network.
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

-- 

Best regards,
Kathleen

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Tue, 12 Sep 2017 02:01:18 +0000

Hi Nancy, Kathleen,
Your point make sense. Let me explain our intention as below:
1. Our objective is to specify the security posture (we call it security baseline in the documents) of network devices, like router, switch or maybe FW. By collecting and evaluating them, to meet the SACM requirements on network device as endpoint. We only focus on the security baseline information;
2. Current -00 version of drafts do not have the contents about: how to encapsulate the security baseline information into SACM Information Model, how to send them to the collector by YANG push and pub/sub mechanisms, and how to adapt these information into SACM protocol, we will address these issues in following updated versions;
3. we do find that some YANG model has been defined in IETF WGs like netmod, i2rs, i2nsf, etc. But we also observe that: there are still some YANG model related with device security baseline are not defined yet (i.e., URPF, CPU defend, Keychain, Remote Login Security, etc); Even some YANG model (i.e., BGP, OSPF, SNMP, etc) has been defined in IETF, their security configuration and status part are not completed and have potential room for improvement. If we find the existing contents as you pointed, we'd like to reference them and will not reinvent the wheel.

In summary, we want to follow the SACM Information Model and protocol, and extend the YANG push and pub/sub mechanisms to systematically specify the security baseline data model in SACM WG.

B.R.
Frank

-----邮件原件-----
发件人: Kathleen Moriarty [mailto:[email-masked]] 
发送时间: 2017年9月12日 5:26
收件人: Nancy Cam-Winget (ncamwing)
抄送: Xialiang (Frank); Waltermire, David A. (Fed); Panos Kampanakis (pkampana); [email-masked]; Linqiushi (Jessica, SCC); Zhengguangying (Walker); dongyue (D)
主题: Re: [sacm] 答复: new drafts about network infrastructure device's security baseline:

On Mon, Sep 11, 2017 at 11:35 AM, Nancy Cam-Winget (ncamwing) <[email-masked]> wrote:
> Hi Frank,
>
>
>
> It is not clear to me why we couldn’t reference the work and 
> attributes already being worked on in NETMOD and perhaps i2nsf?  While 
> I agree that SACM includes network elements as endpoints, I think we 
> can leverage work already being defined by other working groups.

Yes, I agree with Nancy.  If the work exists already, it should be referenced.  YANG is the preferred method and there appears to be direct copy and paste from IPFIX and other technologies.

Best regards,
Kathleen
> At the last IETF meeting we started discussing a charter update. I 
> believe we are currently waiting on the chairs to start this discussion on the list.
> This will give the working group an opportunity to clarify this issue 
> in the charter.
>
>
>
> As far as endpoints, the definition that has been used for endpoints 
> in the SACM charter is the one from RFC 5209, which is “Any computing 
> device that can be connected to a network.
>
> endpoints. This view is also reflected in the SACM terminology, which 
> states “To further clarify the [RFC5209] definition, an endpoint is 
> any
>
> This text squares with my original view of endpoints way back when we 
> were working on the original SACM charter.
>
>
>
> Regards,
>
> Dave
>
>
>
> From: sacm [mailto:[email-masked]] On Behalf Of Panos 
> Kampanakis
> (pkampana)
> Cc: Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying 
> (Walker) <[email-masked]>; dongyue (D) 
> <[email-masked]>
> infrastructure or network elements. I believe SACM’s initial focus was 
> on endpoints. Do these three drafts even fall in SACM’s charter as it 
> is right now?
>
> Panos
>
>
>
>
>
> Cc: Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying 
> (Walker) <[email-masked]>; dongyue (D) 
> <[email-masked]>
> Subject: [sacm] new drafts about network infrastructure device's 
> security
> baseline:
>
>
>
> Hi all,
>
> posture, or call it security baseline. Each draft covers one of the 
> three planes of network infrastructure devices: data plane, control 
> plane, management plane.
>
> security posture of the network infrastructure devices, in order to 
> realize the whole lifecycle security automation for the infrastructure network.
>

-- 

Best regards,
Kathleen

---

From: Jerome Athias <[email-masked]>
Date: Tue, 12 Sep 2017 03:08:12 -0400

OVAL

On Mon, Sep 11, 2017 at 6:35 PM, Nancy Cam-Winget (ncamwing) <[email-masked]> wrote:

> As far as endpoints, the definition that has been used for endpoints in the SACM charter is the one from RFC 5209, which is "
>
> Any computing device that can be connected to a network.
>
>       cell phones, or any device that may have an IP address."
>
> As most network devices are connected to networks, and often expose a management interface that is IP addressable, I’d say they qualify as endpoints. This view is also reflected in the SACM terminology, which states "
>
> To further clarify the [
> [RFC5209](https://tools.ietf.org/html/rfc5209)
> ] definition, an endpoint is any
>
>       endpoints within this document."
>
>
>
> Cc: Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying (Walker) <[email-masked]>; dongyue (D) <[email-masked]>
> Cc: Linqiushi (Jessica, SCC) <[email-masked]>; Zhengguangying (Walker) <[email-masked]>; dongyue (D) <[email-masked]>

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 12 Sep 2017 09:33:54 -0400

Hello Frank,

Thanks for your response, inline.

> In summary, we want to follow the SACM Information Model and protocol, and extend the YANG push and pub/sub mechanisms to systematically specify the security baseline data model in SACM WG.

Please use the Yangcatalog.org site to identify the YANG modules that
already exist for the data that can be collected.  The next step would
be to figure out if certain information is not available, what YANG
modules should be extended to gather that information.  Or to create
new YANG modules for that purpose.  Since you are talking about
network devices, YANG is the way to go right now as that is where
industry is heading.

Thank you,
Kathleen

-- 

Best regards,
Kathleen

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Wed, 13 Sep 2017 00:41:35 +0000

Hi Kathleen,
Thanks for your suggestion, we will do this work in next step!

B.R.
Frank

-----邮件原件-----
发件人: sacm [mailto:[email-masked]] 代表 Kathleen Moriarty
发送时间: 2017年9月12日 21:34
收件人: Xialiang (Frank)
抄送: Linqiushi (Jessica, SCC); [email-masked]; Nancy Cam-Winget (ncamwing); Zhengguangying (Walker); Waltermire, David A. (Fed); dongyue (D); Panos Kampanakis (pkampana)
主题: Re: [sacm] 答复: 答复: new drafts about network infrastructure device's security baseline:

Hello Frank,

On Mon, Sep 11, 2017 at 10:01 PM, Xialiang (Frank) <[email-masked]> wrote:
> 1. Our objective is to specify the security posture (we call it 
> security baseline in the documents) of network devices, like router, 
> switch or maybe FW. By collecting and evaluating them, to meet the SACM requirements on network device as endpoint. We only focus on the security baseline information; 2. Current -00 version of drafts do not have the contents about: how to encapsulate the security baseline information into SACM Information Model, how to send them to the collector by YANG push and pub/sub mechanisms, and how to adapt these information into SACM protocol, we will address these issues in following updated versions; 3. we do find that some YANG model has been defined in IETF WGs like netmod, i2rs, i2nsf, etc. But we also observe that: there are still some YANG model related with device security baseline are not defined yet (i.e., URPF, CPU defend, Keychain, Remote Login Security, etc); Even some YANG model (i.e., BGP, OSPF, SNMP, etc) has been defined in IETF, their security configuration and status part are not completed and have potential room for improvement. If we find the existing contents as you pointed, we'd like to reference them and will not reinvent the wheel.
>

Please use the Yangcatalog.org site to identify the YANG modules that already exist for the data that can be collected.  The next step would be to figure out if certain information is not available, what YANG modules should be extended to gather that information.  Or to create new YANG modules for that purpose.  Since you are talking about network devices, YANG is the way to go right now as that is where industry is heading.

Thank you,
Kathleen
> 抄送: Xialiang (Frank); Waltermire, David A. (Fed); Panos Kampanakis 
> (pkampana); [email-masked]; Linqiushi (Jessica, SCC); Zhengguangying 
> (Walker); dongyue (D)
>> attributes already being worked on in NETMOD and perhaps i2nsf?  
>> While I agree that SACM includes network elements as endpoints, I 
>> think we can leverage work already being defined by other working groups.
>
>> Cc: "Linqiushi (Jessica, SCC)" <[email-masked]>, 
>> "Zhengguangying (Walker)" <[email-masked]>, "dongyue (D)"
>> <[email-masked]>
>> When checking the SACM charter, I do not see any references to 
>> network infrastructure or network elements. I believe SACM’s initial 
>> focus was on endpoints. Do these three drafts even fall in SACM’s 
>> charter as it is right now?
>>
>> Panos
>>
>>
>>
>>
>>
>> https://tools.ietf.org/html/draft-dong-sacm-nid-cp-security-baseline-
>> 0
>> 0
>>
>>
>>
>> The goal is to facilitate the collection and assessment of the 
>> overall security posture of the network infrastructure devices, in 
>> order to realize the whole lifecycle security automation for the infrastructure network.
>>

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 12 Sep 2017 20:55:30 -0400

The problem with OVAL is that this is specific to network devices and we'd be asking vendors to implement something else.  They've made an investment in YANG, so we can get traction and support.  OVAL would be great for platforms where there is already support.

Best,
Kathleen 

Sent from my iPhone

> On Sep 12, 2017, at 3:08 AM, Jerome Athias <[email-masked]> wrote:
> 
> OVAL
> 
> 
>> As far as endpoints, the definition that has been used for endpoints in the SACM charter is the one from RFC 5209, which is "Any computing device that can be connected to a network.
>> As most network devices are connected to networks, and often expose a management interface that is IP addressable, I’d say they qualify as endpoints. This view is also reflected in the SACM terminology, which states "To further clarify the [RFC5209] definition, an endpoint is any