Subject: [Nea] Comments on Section 2 - Terminology

From: "Susan Thomson \(sethomso\)" <[email-masked]>
Date: Wed, 20 Jun 2007 12:03:47 -0400

General Comment: I find those terms that are defined very generically
e.g. component, session, deployer somewhat confusing, esp. where they
are used to mean different things in different contexts. Have made some
suggestions below.

Re Deployer: I think you use this only in the context of "a deployer of
NEA technology" in which case I think you can say this in the text
without defining a special term.

Re Session: This term is used in different contexts in the draft. I
think this term is best defined in the protocol document itself, rather
than a requirements doc since the definition is protocol-specific.  In
the context of PB layer, rather than use the term session it could be
said to maintain context. In the context of PT layer, we could use the
term connection (where the precise definition would be specific to the
choice of PT), etc.

Re Dialog: Is this really needed? It seems like if we replaced "message
dialog" with "message exchange" in the text it would be clear without
defining a special term. If we retain it, we should specify it more
precisely that it is between NEA client and server and the context e.g.
within a specific instantiation of PT.

Re Owner: May need to loosen this definition a bit to take into account
the fact that certain enterprise may lease (rather than own) their
assets. Also, a small enterprise may hire a 3rd-party to manage their
assets.

Re Component: I think this definition can be omitted without loss of
clarity. It is fine to use this term in the context of the reference
model to refer to posture collector, validator etc. I think it has a
well understood meaning in this context. Where it is used to refer to
the local operating domain from which posture is collected, it is not
clear what is meant by "endpoint components". 

The definitions of assessment, attribute, message, etc could be easily
modified to not include the term component. For example:

Assessment could be modified as follows:
The process of collecting posture from NEA client on the endpoint such
that the NEA server can evaluate the posture against compliance policy. 

Attribute could be modified to be:
Data element including any requisite meta-data  describing an observed
... property of the endpoint that is relevant to a compliance decision,
...

Message: Self-contained unit of communication in the PA layer of the NEA
protocol between a Posture Collector in the NEA client and Posture
Validator in the NEA server.

Posture Attribute: Describes specific characteristic of endpoint posture
e.g. a Posture Attribute might describe the version of an application
installed on the system.

Thanks
Susan

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea