Subject: Re: [sacm] [sacmwg/draft-ietf-sacm-terminology] Need to clarify "attribute" vs. "posture attributes" (#67)

From: Charles Schmidt <[email-masked]>
Date: Thu, 01 Mar 2018 13:16:12 -0800

In doing the review for SWIMA I noted that the definition of "attribute" appears internally inconsistent. 

SACM states: "attribute: Is a data element, as defined in RFC5209, that is atomic. In the context of SACM, attributes are "atomic" information elements and an equivalent to attribute-value-pairs.""

RFC 5209 (the NEA Architecture) states "Attribute - Data element including any requisite meta-data describing an observed, expected, or the operational status of an endpoint feature (e.g., anti-virus software is currently in use). Attributes are exchanged as part of the NEA protocols (see section
5.2)."

The bottom lines is that, by my reading, "attribute" as used by SACM is a single piece of information, such as might be conveyed in a single name-value-pair. Attribute as used by NEA is a multi-field structure meant to convey information about a single subject via multiple related pieces of information. In particular, a SWIMA attribute can contain a couple dozen fields including timestamps, software locations, software unique ID, software record unique ID, software record, and other things. This use is consistent with the NEA use of attribute, but not with the SACM use of attribute. (At least as I understand it.)

I have no problem with SACM defining "attribute" to mean an atomic piece of information, but if we go that route we should remove the reference to RFC 5209.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/67#issuecomment-369733459