Subject: [scap_interest] The Context Concept

From: Jerome Athias <[email-masked]>
Date: Sat, 18 Feb 2012 19:02:58 +0000

In a private discussion I had at ToorCon 9, with Matt Miller (skape);
we came to the conclusion that a key (and unresolved) point of 
automation is the (automatic) definition of the Context in which you are 
where dealing with a vulnerability (threat).
It was also identified (validated?), and introduced by Druid.
And then, the Druid's work was related (validated?) at FRHACK 01 by 
Rodrigo Branco (bsdaemon).

/Situation awareness (http://en.wikipedia.org/wiki/Situation_awareness) 
should be taken into account.
Maybe search for "military situational awareness".

My 2 dirhams
/JA
/

---

From: Adam Montville <[email-masked]>
Date: Sat, 18 Feb 2012 19:34:55 +0000

The importance of context extends well beyond threats and vulnerabilities as well.

Regards,

Adam

Jerome Athias <[email-masked]> wrote:

In a private discussion I had at ToorCon 9, with Matt Miller (skape);
we came to the conclusion that a key (and unresolved) point of automation is the (automatic) definition of the Context in which you are where dealing with a vulnerability (threat).
It was also identified (validated?), and introduced by Druid.
And then, the Druid's work was related (validated?) at FRHACK 01 by Rodrigo Branco (bsdaemon).

Situation awareness (http://en.wikipedia.org/wiki/Situation_awareness) should be taken into account.
Maybe search for "military situational awareness".

My 2 dirhams
/JA

---

From: "Chernin, Michael A." <[email-masked]>
Date: Tue, 21 Feb 2012 14:47:30 +0000

I agree that when dealing with "threats" that context matters. However, vulnerabilities alone do not imply or guarantee there is an associated threat or risk.

In my perfect world there would be a threat indicator standard that links to a structured threat standard that then could describe the CVEs used. This would allow us to continue doing vulnerability management by exposure (no threat context) or by specific threat (which provides context).

Aharon

DTCC Non-Confidential (White)
---------------------------------------------------
Michael "Aharon" Chernin
Security Automation Program Manager
Corporate Information Security -Depository Trust & Clearing Corporation
O: 813-470-2173

From: [email-masked] [mailto:[email-masked]] On Behalf Of Jerome Athias
Sent: Saturday, February 18, 2012 2:03 PM
To: [email-masked]
Subject: [scap_interest] The Context Concept

My 2 dirhams
/JA

<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or
entity to whom they are addressed. If you have received this email
in error, please notify us immediately and delete the email and any
attachments from your system. The recipient should check this email
and any attachments for the presence of viruses.  The company
accepts no liability for any damage caused by any virus transmitted
by this email.</FONT>

---

From: Luis Nunez <[email-masked]>
Date: Tue, 21 Feb 2012 13:23:23 -0500

We also need to look at vulnerabilities as it applies an environment.  An inherent vulnerability may have differing levels of exposure depending on what, where and how the node is deployed. 

We maybe able to leverage Asset Identification (AI) to correlate what role the node is playing in the environment (endpoint, Server, Inter-networking Device,..) and determine level of exposure.  The level of risk could also be applied depending on where the node is situated.
	- Directly connected to internet.
	- DMZ controlled 
	- Internal Network
	- Secure enclave

-ln

On Feb 21, 2012, at 9:47 AM, Chernin, Michael A. wrote:

> I agree that when dealing with “threats” that context matters. However, vulnerabilities alone do not imply or guarantee there is an associated threat or risk.
>  
> _____________________________________________________________ 
> DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email._______________________________________________
> scap_interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scap_interest

---

From: "Waltermire, David A." <[email-masked]>
Date: Tue, 21 Feb 2012 13:46:06 -0500

There are a variety of use cases that can benefit from synthesizing asset technical information (e.g., IPs, network address, default gateways, machine accessable asset tags, configurations) with organizational information (e.g., device role, criticality, etc).  For example, if you can generate a network graph of devices and their connections, and combine that with firewall rules and other topology concerns to determine visibility between hosts, you can then perform attack graph analysis to determine at what points a security related change will provide the greatest security benefit.  This can be one method used to prioritize the implementation of various security controls.  As Karen Scarfone pointed out earlier, this is also needed to support host-, network-, and system-oriented metrics starting with things like CVSS and CCSS scores and utilizing the composition of software on hosts and hosts on networks to support roll-up.

This and similar use cases are supported by asset identification, but require greater formalization around asset data management to enable implementation neutral, interoperable approaches.

Sincerely,
David Waltermire

From: [email-masked] [mailto:[email-masked]] On Behalf Of Luis Nunez
Sent: Tuesday, February 21, 2012 1:23 PM
To: Chernin, Michael A.
Cc: [email-masked]
Subject: Re: [scap_interest] The Context Concept

-ln

Aharon

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Jerome Athias
Sent: Saturday, February 18, 2012 2:03 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [scap_interest] The Context Concept

My 2 dirhams
/JA

[email-masked]<mailto:[email-masked]>

---

From: Adam Montville <[email-masked]>
Date: Tue, 21 Feb 2012 18:53:22 +0000

Perhaps we should discuss what "risk" means in the grand scheme of things.  Measuring a level of risk based on location is just one way to do it.  I'm not sure where to start that discussion, but we should be thinking in terms of enabling risk-immature and risk-mature organizations to benefit equally by providing a blend of qualitative and quantitative techniques over a spectrum of risk management capabilities.

Adam

From: "Waltermire, David A." <[email-masked]<mailto:[email-masked]>>
Date: Tue, 21 Feb 2012 13:46:06 -0500
To: Luis Nunez <[email-masked]<mailto:[email-masked]>>, "Chernin, Michael A." <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [scap_interest] The Context Concept

Sincerely,
David Waltermire

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Luis Nunez
Sent: Tuesday, February 21, 2012 1:23 PM
To: Chernin, Michael A.
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [scap_interest] The Context Concept

-ln

Aharon

My 2 dirhams
/JA

_______________________________________________ scap_interest mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/scap_interest

---

From: David Solin <[email-masked]>
Date: Tue, 21 Feb 2012 23:28:00 -0600

Isn't this exactly what CIM is for?  CIM makes it possible to organize 
assets across many dimensions, including customer-defined "service" 
dimensions, that could easily serve as references for targeting 
purposes.  I can imagine mapping services with profiles, or more 
generally, CIM graph queries with profiles.

I've never understood what purpose AI is supposed to serve when CIM has 
been around for much longer, is already fairly well-adopted by CMDB 
vendors, and addresses the asset management problem domain quite well.

Anyway, just my $.02.

Regards,
--David Solin

-- 

jOVAL.org: OVAL implemented in Java.
/Scan any machine from any machine. For free!/
Learn More <http://www.joval.org> | Features 
<http://www.joval.org/features/> | Download 
<http://www.joval.org/download/>

On 2/21/2012 12:46 PM, Waltermire, David A. wrote:
>
> There are a variety of use cases that can benefit from synthesizing 
> asset technical information (e.g., IPs, network address, default 
> gateways, machine accessable asset tags, configurations) with 
> organizational information (e.g., device role, criticality, etc).  For 
> example, if you can generate a network graph of devices and their 
> connections, and combine that with firewall rules and other topology 
> concerns to determine visibility between hosts, you can then perform 
> attack graph analysis to determine at what points a security related 
> change will provide the greatest security benefit.  This can be one 
> method used to prioritize the implementation of various security 
> controls.  As Karen Scarfone pointed out earlier, this is also needed 
> to support host-, network-, and system-oriented metrics starting with 
> things like CVSS and CCSS scores and utilizing the composition of 
> software on hosts and hosts on networks to support roll-up.
>
> This and similar use cases are supported by asset identification, but 
> require greater formalization around asset data management to enable 
> implementation neutral, interoperable approaches.
>
> Sincerely,
>
> David Waltermire
>
> *From:[email-masked] 
> [mailto:[email-masked]] *On Behalf Of *Luis Nunez
> *Sent:* Tuesday, February 21, 2012 1:23 PM
> *To:* Chernin, Michael A.
> *Cc:* [email-masked]
> *Subject:* Re: [scap_interest] The Context Concept
>
> We also need to look at vulnerabilities as it applies an environment. 
>  An inherent vulnerability may have differing levels of exposure 
> depending on what, where and how the node is deployed.
>
> We maybe able to leverage Asset Identification (AI) to correlate what 
> role the node is playing in the environment (endpoint, Server, 
> Inter-networking Device,..) and determine level of exposure.  The 
> level of risk could also be applied depending on where the node is 
> situated.
>
> I agree that when dealing with "threats" that context matters. 
> However, vulnerabilities alone do not imply or guarantee there is an 
> associated threat or risk.
>
> In my perfect world there would be a threat indicator standard that 
> links to a structured threat standard that then could describe the 
> CVEs used. This would allow us to continue doing vulnerability 
> management by exposure (no threat context) or by specific threat 
> (which provides context).
>
> Aharon
>
> *From:[email-masked] 
> <mailto:[email-masked]>[mailto:[email-masked]]*On 
> Behalf Of*Jerome Athias
> *Sent:*Saturday, February 18, 2012 2:03 PM
> *To:[email-masked] <mailto:[email-masked]>
> *Subject:*[scap_interest] The Context Concept
>
> automation is the (automatic) definition of the Context in which you 
> are where dealing with a vulnerability (threat).
> /Situation awareness 
> (http://en.wikipedia.org/wiki/Situation_awareness) should be taken 
> into account.//
> /Maybe search for "military situational awareness"./
>
> /My 2 dirhams/
> //JA//
>
>
> entity to whom they are addressed. If you have received this email in 
> error, please notify us immediately and delete the email and any 
> and any attachments for the presence of viruses. The company accepts 
> no liability for any damage caused by any virus transmitted by this 
> email._______________________________________________
> [email-masked] <mailto:[email-masked]>
> _______________________________________________