Subject: [scap_interest] Operational Aspects

From: Adam Montville <[email-masked]>
Date: Tue, 14 Feb 2012 21:12:51 +0000

While we're all bantering about on security automation, there's another side to the story.  Are there any operational concerns we might address within a WG should one be formed?  For example, we have, in the United States, NVD hosting a repository of information.  CCE identifiers are moderated and assigned by an operational process.  As new enumerations are published and new types of content are conceived, it's easy to imagine the need for some operational standardization.

Should we consider standardizing some of these processes, and if so would the WG we seek to establish be the appropriate place for that work?

Regards,

Adam W. Montville | Security and Compliance Architect

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | Take CONTROL
http://www.tripwire.com

---

From: <[email-masked]>
Date: Tue, 14 Feb 2012 15:32:38 -0600

Adam,

We have more than enough on our plate with the specification / I-D work.  Let's see if we can deal with this in a more appropriate forum. I do not see this as that forum.  My 2cents…

Thanks.

Kent Landfield
Director Content Strategy, Architecture and Standards

McAfee | An Intel Company
5000 Headquarters Dr.
Plano, Texas 75024

Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Adam Montville <[email-masked]<mailto:[email-masked]>>
Date: Tue, 14 Feb 2012 15:12:51 -0600
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [scap_interest] Operational Aspects

Regards,

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | Take CONTROL
http://www.tripwire.com

_______________________________________________
scap_interest mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scap_interest

---

From: Adam Montville <[email-masked]>
Date: Tue, 14 Feb 2012 22:18:14 +0000

Fair enough.  Just throwing things against the wall as they come to mind.

Adam

From: kent_landfield <[email-masked]<mailto:[email-masked]>>
Date: Tue, 14 Feb 2012 15:32:38 -0600
To: Adam Montville <[email-masked]<mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]>>
Subject: Re: [scap_interest] Operational Aspects

Adam,

Thanks.

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

Regards,

Direct: 503 276-7661
Mobile: 360 471-7815

TRIPWIRE | Take CONTROL
http://www.tripwire.com

---

From: Luis Nunez <[email-masked]>
Date: Thu, 16 Feb 2012 12:54:21 -0500

Since you mentioned "NVD" also known as the National Vulnerability Database.  I think at some point the IETF will be helpful in creating a protocol to communicate with these content repositories.  Last I counted was 7 content repositories.
In no particular order and I am sure there are more out there.

-SecPod
-Novell
-NVD
-IT Security Database
-Debian 
-Altx-soft

-ln

On Feb 14, 2012, at 5:18 PM, Adam Montville wrote:

> [email-masked]

---

From: Adam Montville <[email-masked]>
Date: Thu, 16 Feb 2012 17:56:22 +0000

Red Hat might have one for their systems as well.

Also, I think that continuous monitoring has an important role to play
here with their content repository interface specifications.

Adam

On 2/16/12 9:54 AM, "Luis Nunez" <[email-masked]> wrote:

>Since you mentioned "NVD" also known as the National Vulnerability
>Database.  I think at some point the IETF will be helpful in creating a
>protocol to communicate with these content repositories.  Last I counted
>was 7 content repositories.
>> From: kent_landfield
>><[email-masked]<mailto:[email-masked]>>
>> To: Adam Montville
>><[email-masked]<mailto:[email-masked]>>,
>><[email-masked]<mailto:[email-masked]>>
>> We have more than enough on our plate with the specification / I-D
>>work.  Let's see if we can deal with this in a more appropriate forum. I
>>do not see this as that forum.  My 2centsŠ
>> 
>> Thanks.
>> 
>> Kent Landfield
>> From: Adam Montville
>><[email-masked]<mailto:[email-masked]>>
>> To: "[email-masked]<mailto:[email-masked]>"
>><[email-masked]<mailto:[email-masked]>>
>> While we're all bantering about on security automation, there's another
>>side to the story.  Are there any operational concerns we might address
>>within a WG should one be formed?  For example, we have, in the United
>>States, NVD hosting a repository of information.  CCE identifiers are
>>moderated and assigned by an operational process.  As new enumerations
>>are published and new types of content are conceived, it's easy to
>>imagine the need for some operational standardization.
>> 
>> Should we consider standardizing some of these processes, and if so
>>would the WG we seek to establish be the appropriate place for that work?
>> 
>> Regards,
>>

---

From: Gunnar Engelbach <[email-masked]>
Date: Thu, 16 Feb 2012 13:14:45 -0500

That's an addition well worth pursuing further.  What jumps out 
immediately to me as a prerequisite is the need to be able to validate 
the authenticity of a benchmark -- that lingering benchmark signing issue.

I would also suggest considering including client validation as part of 
such a protocol.  That could easily be considered outside the scope of 
this, but some of these repositories are commercial, something I'd be 
happy to see more of, so I'd like to see a standardized method for 
validating client access.

A bit early to be going into detail on anything, but I think there are 
two things that could apply multiple places and thus should be fleshed 
out early on.

--gun

On 2/16/2012 12:54 PM, Luis Nunez wrote:
>> From: kent_landfield<[email-masked]<mailto:[email-masked]>>
>> To: Adam Montville<[email-masked]<mailto:[email-masked]>>,<[email-masked]<mailto:[email-masked]>>
>> From: Adam Montville<[email-masked]<mailto:[email-masked]>>
>> To: "[email-masked]<mailto:[email-masked]>"<[email-masked]<mailto:[email-masked]>>

---

From: <[email-masked]>
Date: Thu, 16 Feb 2012 12:46:19 -0600

I see the topic of Content Repository interfaces as very important item that really should be worked here.  We have been talking about this topic for over two years now as you both are aware.  I am including the presentation that was given at SCAP Winter Developer Days last March that may help frame the issues.

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

From: Luis Nunez <[email-masked]<mailto:[email-masked]>>
Date: Thu, 16 Feb 2012 11:54:21 -0600
To: Adam Montville <[email-masked]<mailto:[email-masked]>>
Cc: Kent Landfield <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [scap_interest] Operational Aspects

-SecPod
-Novell
-NVD
-IT Security Database
-Debian
-Altx-soft

-ln

Fair enough.  Just throwing things against the wall as they come to mind.
Adam
From: kent_landfield <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
Date: Tue, 14 Feb 2012 15:32:38 -0600
To: Adam Montville <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
Subject: Re: [scap_interest] Operational Aspects
Adam,
We have more than enough on our plate with the specification / I-D work.  Let's see if we can deal with this in a more appropriate forum. I do not see this as that forum.  My 2cents…
Thanks.
Kent Landfield
Director Content Strategy, Architecture and Standards
McAfee | An Intel Company
5000 Headquarters Dr.
Plano, Texas 75024
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>
From: Adam Montville <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
Date: Tue, 14 Feb 2012 15:12:51 -0600
To: "[email-masked]<mailto:[email-masked]><mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]><mailto:[email-masked]>>
Subject: [scap_interest] Operational Aspects
While we're all bantering about on security automation, there's another side to the story.  Are there any operational concerns we might address within a WG should one be formed?  For example, we have, in the United States, NVD hosting a repository of information.  CCE identifiers are moderated and assigned by an operational process.  As new enumerations are published and new types of content are conceived, it's easy to imagine the need for some operational standardization.
Should we consider standardizing some of these processes, and if so would the WG we seek to establish be the appropriate place for that work?
Regards,
Adam W. Montville | Security and Compliance Architect
Direct: 503 276-7661
Mobile: 360 471-7815
TRIPWIRE | Take CONTROL
http://www.tripwire.com
_______________________________________________
scap_interest mailing list
[email-masked]<mailto:[email-masked]><mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scap_interest
_______________________________________________
scap_interest mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scap_interest

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 16 Feb 2012 14:02:04 -0500

We are continuing to work on this and I am very interested in developing standards in this area.  I am currently working on developing an open source prototype that can be used to evaluate standardized approaches to this problem.  I haven't published the latest code on this yet, but the original work we started can be found at:

http://code.google.com/p/security-automation-content-repository/

The companion presentation to Kent's from March can be found here:

http://scap.nist.gov/events/2011/saddsp/presentations/Security_Automation_Content_Repository_Demo.pdf

Dave

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Thursday, February 16, 2012 1:46 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [scap_interest] Operational Aspects

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

-SecPod
-Novell
-NVD
-IT Security Database
-Debian
-Altx-soft

-ln

Fair enough.  Just throwing things against the wall as they come to mind.
Adam
From: kent_landfield <[email-masked]<mailto:[email-masked]><mailto:[email-masked]><mailto:[email-masked]%3e>>
Date: Tue, 14 Feb 2012 15:32:38 -0600
To: Adam Montville <[email-masked]<mailto:[email-masked]><mailto:[email-masked]><mailto:[email-masked]%3e>>, <[email-masked]<mailto:[email-masked]><mailto:[email-masked]><mailto:[email-masked]%3e>>
Subject: Re: [scap_interest] Operational Aspects
Adam,
We have more than enough on our plate with the specification / I-D work.  Let's see if we can deal with this in a more appropriate forum. I do not see this as that forum.  My 2cents...
Thanks.
Kent Landfield
Director Content Strategy, Architecture and Standards
McAfee | An Intel Company
5000 Headquarters Dr.
Plano, Texas 75024
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>
From: Adam Montville <[email-masked]<mailto:[email-masked]><mailto:[email-masked]><mailto:[email-masked]%3e>>
Date: Tue, 14 Feb 2012 15:12:51 -0600
To: "[email-masked]<mailto:[email-masked]><mailto:[email-masked]><mailto:[email-masked]%3e>" <[email-masked]<mailto:[email-masked]><mailto:[email-masked]><mailto:[email-masked]%3e>>
Subject: [scap_interest] Operational Aspects
While we're all bantering about on security automation, there's another side to the story.  Are there any operational concerns we might address within a WG should one be formed?  For example, we have, in the United States, NVD hosting a repository of information.  CCE identifiers are moderated and assigned by an operational process.  As new enumerations are published and new types of content are conceived, it's easy to imagine the need for some operational standardization.
Should we consider standardizing some of these processes, and if so would the WG we seek to establish be the appropriate place for that work?
Regards,
Adam W. Montville | Security and Compliance Architect
Direct: 503 276-7661
Mobile: 360 471-7815
TRIPWIRE | Take CONTROL
http://www.tripwire.com
_______________________________________________
scap_interest mailing list
[email-masked]<mailto:[email-masked]><mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scap_interest
_______________________________________________
scap_interest mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scap_interest

________________________________
No virus found in this message.
Checked by AVG - www.avg.com<http://www.avg.com>
Version: 2012.0.1913 / Virus Database: 2112/4813 - Release Date: 02/16/12

---

From: Adam Montville <[email-masked]>
Date: Thu, 16 Feb 2012 23:43:42 +0000

I'd like to contribute to this as well – as much as I can anyway.

From: "Waltermire, David A." <[email-masked]<mailto:[email-masked]>>
Date: Thu, 16 Feb 2012 14:02:04 -0500
To: kent_landfield <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Adam Montville <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: [scap_interest] Operational Aspects

We are continuing to work on this and I am very interested in developing standards in this area.  I am currently working on developing an open source prototype that can be used to evaluate standardized approaches to this problem.  I haven’t published the latest code on this yet, but the original work we started can be found at:

The companion presentation to Kent’s from March can be found here:

Dave

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of [email-masked]<mailto:[email-masked]>
Sent: Thursday, February 16, 2012 1:46 PM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [scap_interest] Operational Aspects

Kent Landfield

Direct: +1.972.963.7096
Mobile: +1.817.637.8026

-SecPod
-Novell
-NVD
-IT Security Database
-Debian
-Altx-soft

-ln

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 16 Feb 2012 21:48:57 -0500

I will take you up on that when the time comes. ;-)

Dave

> -----Original Message-----
> From: Adam Montville [mailto:[email-masked]]
> Sent: Thursday, February 16, 2012 6:44 PM
> To: Waltermire, David A.; kent_landfield; [email-masked]
> I'd like to contribute to this as well - as much as I can anyway.
> 
> From: "Waltermire, David A."
> <[email-masked]<mailto:[email-masked]>>
> To: kent_landfield
> <[email-masked]<mailto:[email-masked]>>,
> "[email-masked]<mailto:[email-masked]>"
> <[email-masked]<mailto:[email-masked]>>, Adam Montville
> Cc: "[email-masked]<mailto:[email-masked]>"
> We are continuing to work on this and I am very interested in
> developing standards in this area.  I am currently working on
> developing an open source prototype that can be used to evaluate
> standardized approaches to this problem.  I haven't published the
> latest code on this yet, but the original work we started can be found
> at:
> 
> From: [email-masked]<mailto:scap_interest-
> [email-masked]> [mailto:[email-masked]] On Behalf Of
> [email-masked]<mailto:[email-masked]>
> To: [email-masked]<mailto:[email-masked]>;
> [email-masked]<mailto:[email-masked]>
> I see the topic of Content Repository interfaces as very important item
> that really should be worked here.  We have been talking about this
> topic for over two years now as you both are aware.  I am including the
> presentation that was given at SCAP Winter Developer Days last March
> that may help frame the issues.
> 
> Kent Landfield
> From: Luis Nunez
> <[email-masked]<mailto:[email-masked]>>
> Cc: Kent Landfield
> <[email-masked]<mailto:[email-masked]>>,
> "[email-masked]<mailto:[email-masked]>"
> protocol to communicate with these content repositories.  Last I
> counted was 7 content repositories.
> <[email-masked]<mailto:[email-masked]><mailto:ken
> [email-masked]><mailto:[email-masked]%3e>>
> <[email-masked]<mailto:[email-masked]><mailto:amontvi
> [email-masked]><mailto:[email-masked]%3e>>,
> <[email-masked]<mailto:[email-masked]><mailto:scap_inte
> [email-masked]><mailto:[email-masked]%3e>>
> Subject: Re: [scap_interest] Operational Aspects Adam, We have more
> than enough on our plate with the specification / I-D work.  Let's see
> if we can deal with this in a more appropriate forum. I do not see this
> as that forum.  My 2cents... Thanks.
> Kent Landfield
> Director Content Strategy, Architecture and Standards McAfee | An Intel
> Company
> 5000 Headquarters Dr.
> Plano, Texas 75024
> Direct: +1.972.963.7096
> Mobile: +1.817.637.8026
> <[email-masked]<mailto:[email-masked]><mailto:amontvi
> [email-masked]><mailto:[email-masked]%3e>>
> To:
> "[email-masked]<mailto:[email-masked]><mailto:scap_inte
> [email-masked]><mailto:[email-masked]%3e>"
> <[email-masked]<mailto:[email-masked]><mailto:scap_inte
> [email-masked]><mailto:[email-masked]%3e>>
> Subject: [scap_interest] Operational Aspects While we're all bantering
> about on security automation, there's another side to the story.  Are
> there any operational concerns we might address within a WG should one
> be formed?  For example, we have, in the United States, NVD hosting a
> repository of information.  CCE identifiers are moderated and assigned
> by an operational process.  As new enumerations are published and new
> types of content are conceived, it's easy to imagine the need for some
> operational standardization.

---

From: "Chandrashekhar B" <[email-masked]>
Date: Fri, 17 Feb 2012 17:42:02 +0530

I highlighted the interfaces to be standardized in the recent ITSAC,

http://scap.nist.gov/events/2011/itsac/presentations/day3/Basavanna%20-%20SC
AP%20Content%20Repository.pdf

Search interfaces for all SCAP elements need to be standardized along with
Client validation as Gunnar noted already. We currently have API's to do the
searches, we are considering giving an external interface through WSDL.

Chandra.

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Waltermire, David A.
Sent: Friday, February 17, 2012 12:32 AM
To: [email-masked]; [email-masked];
[email-masked]
Cc: [email-masked]
Subject: Re: [scap_interest] Operational Aspects

We are continuing to work on this and I am very interested in developing
standards in this area.  I am currently working on developing an open source
prototype that can be used to evaluate standardized approaches to this
problem.  I haven't published the latest code on this yet, but the original
work we started can be found at:

http://scap.nist.gov/events/2011/saddsp/presentations/Security_Automation_Co
ntent_Repository_Demo.pdf

Dave

From: [email-masked] [mailto:[email-masked]]
On Behalf Of [email-masked]
Sent: Thursday, February 16, 2012 1:46 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [scap_interest] Operational Aspects

I see the topic of Content Repository interfaces as very important item that
really should be worked here.  We have been talking about this topic for
over two years now as you both are aware.  I am including the presentation
that was given at SCAP Winter Developer Days last March that may help frame
the issues.   

Kent Landfield

Direct: +1.972.963.7096 
Mobile: +1.817.637.8026
Web: www.mcafee.com <http://www.mcafee.com/> 

From: Luis Nunez <[email-masked]>
Date: Thu, 16 Feb 2012 11:54:21 -0600
To: Adam Montville <[email-masked]>
Cc: Kent Landfield <[email-masked]>, "[email-masked]"
<[email-masked]>
Subject: Re: [scap_interest] Operational Aspects

Since you mentioned "NVD" also known as the National Vulnerability Database.
I think at some point the IETF will be helpful in creating a protocol to
communicate with these content repositories.  Last I counted was 7 content
repositories.

-SecPod

-Novell

-NVD

-IT Security Database

-Debian 

-Altx-soft

-ln

Adam

From: kent_landfield
<[email-masked]<mailto:[email-masked]
<mailto:[email-masked]%3e> >>

To: Adam Montville <[email-masked]<mailto:[email-masked]
<mailto:[email-masked]%3e> >>,
<[email-masked]<mailto:[email-masked]
<mailto:[email-masked]%3e> >>

Adam,

We have more than enough on our plate with the specification / I-D work.
Let's see if we can deal with this in a more appropriate forum. I do not see
this as that forum.  My 2cents.

Thanks.

Kent Landfield

5000 Headquarters Dr.

Plano, Texas 75024

Direct: +1.972.963.7096

Mobile: +1.817.637.8026

From: Adam Montville <[email-masked]<mailto:[email-masked]
<mailto:[email-masked]%3e> >>

To: "[email-masked]<mailto:[email-masked]
<mailto:[email-masked]%3e> >"
<[email-masked]<mailto:[email-masked]
<mailto:[email-masked]%3e> >>

While we're all bantering about on security automation, there's another side
to the story.  Are there any operational concerns we might address within a
WG should one be formed?  For example, we have, in the United States, NVD
hosting a repository of information.  CCE identifiers are moderated and
assigned by an operational process.  As new enumerations are published and
new types of content are conceived, it's easy to imagine the need for some
operational standardization.

Should we consider standardizing some of these processes, and if so would
the WG we seek to establish be the appropriate place for that work?

Regards,

Direct: 503 276-7661

Mobile: 360 471-7815

TRIPWIRE | Take CONTROL

http://www.tripwire.com

[email-masked]

 

  _____  

No virus found in this message.
Checked by AVG - www.avg.com
Version: 2012.0.1913 / Virus Database: 2112/4813 - Release Date: 02/16/12

---

From: Jerome Athias <[email-masked]>
Date: Sat, 18 Feb 2012 15:59:14 +0000

Hi there,

are you using capirca?
http://code.google.com/p/capirca/

Cheers
/JA