Subject: Re: [sacm] Draft-ietf-sacm-ecp

From: "Haynes Jr., Dan" <[email-masked]>
Date: Tue, 3 Apr 2018 17:15:33 +0000

Hi Chris,

Some comments inline below. After reading some of them, I also realized you reviewed -00 so some of your comments have been overcome by -01.

Also, I attached some proposed changes based on your comments so you can do a diff with the current version and see if they address your concerns.

Thanks,

Danny

From: Chris Inacio [mailto:[email-masked]]
Sent: Wednesday, March 21, 2018 9:13 PM
To: [email-masked]
Cc: [email-masked]
Subject: Draft-ietf-sacm-ecp

So there are obviously follow-on documents to this document and work that is intended to be brought to the IETF.  Is that correct?

1: "Standadrid collection improves network security by confirming that endpoints are known and

   authrosized, and are compliant with network policy.”  Fix spelling:  Standard and authorized.

[danny] Fixed in -01.

1: "Administrators will query the repository to determine the posture status of an endpoint.”  Maybe administrators can - otherwise we could just say administrators will secure their networks and ensure they have no vulnerable apps installed and be done, right?  :)

[danny] Example was removed in -01. So, I just updated text to say: “Administrators can query….status of an endpoint and take any necessary follow-up actions.”. See revised draft.

1.1: “The value of continuous endpoint posture assessment is well

   established.” Can we cite this statement?

[danny] Reworded this to make it more obvious the references go with this statement about the value of endpoint posture assessment. See revised draft.

1.1: "respectively, of the CIS "20 Critical” please expand Center for Internet Security (CIS) on its first use.

[danny] Fixed.

1.1: "By sharing posture informatino with sensors on the network, ECP aids in the

   detection of attacks on endpoints and drives follow-up actions.”  Spelling for information and I find this statement p

[danny] The spelling was fixed in -01. It also looks like you got cut off mid-sentence. What did you find out about this statement :)?

1.3: "Posture information must be sent over mature, standardized protocols

   to ensure the confidentiality and authenticity of this data while in

   transit.”  An implication of this sentence is that TLS 1.3 is not / will not be secure.  Are we really wanting to say that?

[danny] Removed “mature” from this sentence. Does that help remove this implication?

1.3: "The IETF NEA WG has designed an architecture to support endpoint

   posture assessment.  Figure 1 illustrates the architectural

   components used in the Endpoint Compliance Profile:”

I can’t find mention of a repository in RFC6876 or RFC5209; I can’t find the diagram either, but I’m mostly okay with not finding the diagram.

[danny] I think there is no mention of the repository (or CMDB in original TCG ECP specification) because RFC6876 and RFC5209 are specifically concerned with securely transporting posture data between the endpoint and server rather than what the server does with the posture data once it receives it. Furthermore, there is currently no standard interface between the server and repository.

1.3: Can we please use the same terminology from NEA “Posture Transport Client” instead of remaining things, e.g. “Comms Client”.

[danny] We have to start a conversation around this because NETMOD will not leverage a Posture Transport Client. We also renamed it because the Posture Transport Client and Posture Broker Client have been combined since there is not a standardized interface between the two components.

3.1: "The Endpoint Compliance Profile 1.0 describes how IETF and TNC data

   modles and protocols make”. Models maybe?

[danny] This was fixed in -01.

3.2: "Uses of this data are innumerable--

   vulnerability management, asset management, software asset

   management, and configuration management solutions, analytics tools,…” remove the errant “and” in the middle of the sentence.

[danny] Removed the erroneous “and”.

3.2: I feel like there is some real meat missing here.  Is there more to come?

[danny] Can you clarify what you think is missing? What were you hoping to see in this section?

4.1: "endpoint posture information s and to make it available to other

   authorized parties.” - random “s”.

[danny] This was fixed in -01.

4.2.1: "A network-connected endpoint sends posture information using standard

   schemas an protocols.” “an" should be “and”.

[danny] This was fixed in -01.

4.2.1: "4.  The SWID Posture Collector on the endpoint collects from the SWID

       tag directory on the endpoint.  This data is sent via the NEAC

       and PTC to the server.”   - this assumes a fat client, right.  “Sent via the NEAC and PTC”, would rewording that to “sent via the NEAC over PTC” maybe?

[danny] Yes, a client needs to be on the endpoint. This text was in the “Connected and Compliant” section which was removed in -01. Furthermore, NEAC/NEAS/PBC/PBS/PTC/PTS terminology was removed in -01 because we combined the PBC/PTC and PBS/PTS into single components.

4.2.1: "5.  Once the posture information is received by the PTS, it is

       forwarded to the SWID Posture Validator via the NEAS.  The SWID

       Posture Validator also forwards the posture information to the

       repository.  The posture information is stored along with past

       posture information collected about the endpoint.”   - This is really confusing, not the least of which because none of the names match the names in the diagram.

[danny] This text has been reworded in -01 and the terminology NEAC/NEAS/PBC/PBS/PTC/PTS was removed.

4.2.2: "Because the endpoint posture information was sent in a standards-

   based schema (ISO/IEC 19770-2:2009) over secure, standardized

   protocols, and the SWID tags are stored in a centralized repository

   linked to unique endpoint identifiers, authorized parties are able to

   access the posture information.” - this just seems like a complete non-sequitur.

[danny] A slightly different version of this text is present in “Data Sharing” section in ECP -01 because it was updated to not be specific to SWID tags. In any case, I tried to reword it. Let me know what you think.

4.2.2: "It should be noted that the neither the Endpoint Compliance Profile

   nor the protocols, interfaces, and data models that it references

   provide solutions to the server capabilities listed above.  However,

   these capabilities are useful and solutions for them should be

   pursued in the future.” - doesn’t this make section 3.3 a lot easier to write?

[danny] The “Data Sharing” section was filled in -01. Let me know if you have any feedback on it.

4.2.2.1: These seem out of scope for the document.  It seems like these are either UI requirements; otherwise not sure how this fits.

[danny] Maybe we can just reword these to not include anything about an “administrative interface”? For example, rather than saying “Using the administrative interface on the server, an authorized user can learn:..”, we could just say “Using ECP, an authorized user can learn:…”. Would that help?

4.2.3: Why “Non-Supported” instead of “Unsupported”?

[danny] Not sure. That is just how it was phrased in the original TCG specification.

4.2.3: Pub/Sub: Can this be reworded to read more easily?

[danny] Updated occurrences of this to read “publish and subscribe” instead of “publish/subscribe”. See revised draft.

4.2.4: “Easy to use:”  - I don’t think the IETF wants to get into the user interface standards / recommendations business.  Also, I think this might be a great place where the market can reward a good UI vs. a bad UI especially with consideration of functionality vs. ease of use.

[danny] These profile “requirements” do seem rather subjective. How would people feel about dropping them?

4.2.5: “Certificate provisioning” - this seems to say, enterprises will use certificates to secure an endpoint identity and communications, unless they don’t.  ????

[danny] In ECP, the endpoint identity comes from the certificate and that certificate is also used to establish a connection between the Endpoint and Posture Manager. Does that help clarify?

<stopped reading at section 8>

[danny] That is too bad…section 8 is where it really gets good :)!