Subject: Re: [Nea] [NEA] Proposals for Attribute Categories & Attributes

From: Brian Ford <[email-masked]>
Date: Fri, 29 Aug 2008 10:03:53 -0400

NEA Community,

I suggest that an important Attribute Category would be ³Assessment Method².
This category would include information about how the endpoint was assessed
(method) and be able to be correlated to the time of assessment .

When I think about posture attributes I believe that there are a number of
methods that a policy decision point (PDP) can expect the attributes to have
been collected.  

#1  The operating system on an endpoint reports its attributes.   I refer
to this as Query-Response [QR] case.
#2  Some software added to the endpoint determines and reports attributes.
I call this the Agent [AG] case.
#3  Some other device on the network interacts with an endpoint and reports
attributes. This is a Probe [PR] case.
#4  Some other device on the network does not interact with an endpoint and
reports its attributes. I refer to this as a Passive Probe [PP].
There might be other cases...

I would suggest that these four (and perhaps other) collection models might
be attributes make up an category called Assessment Method.

I think it would be valuable if the PDP could make a decision knowing the
answers for up to all four of these methods for a single endpoint. For
example a PC (Endpoint X) might have an agent installed that provided data
(#2) AND that same PC was probed when it was detected on the network (#3).
Another example might be a network print server (Endpoint Y) that reported
attributes (#1) AND was subjected to a passive probe (#4).

When data arrives at the PDP it could be visualized as a stream:

[ENDPOINT X MAC ADDR], [TIME A], [ASSESSMENT METHOD AG], [DATA SET 1],...
[DATA SET N]
[ENDPOINT Y MAC ADDR], [TIME A+1], [ASSESSMENT METHOD QR], [DATA SET 1],...
[DATA SET N]
[ENDPOINT X MAC ADDR], [TIME A+2], [ASSESSMENT METHOD PR], [DATA SET 1],...
[DATA SET N]
[ENDPOINT Y MAC ADDR], [TIME A+3], [ASSESSMENT METHOD PP], [DATA SET 1],...
[DATA SET N]

The PDP could then build and (temporarily) maintain a data structure about
Endpoint X and Endpoint Y that has information available about all the
endpoints it knows about.

[ENDPOINT X MAC ADDR], [DATA GATHERED AT TIME A], DATA GATHERED AT TIME A+2]

The PDP could then make decisions based on any data in that data structure
that meets it¹s ³freshness² requirements (aging out old data) or if no data
meets those requirements it could call for (as an example) an active probe
[PR] or query the agent [AG].

Note: Writing this data stream described above off to a storage device also
creates a potentially valuable data store.  Later processing of this data
could be used to create a sort of ³batting average² that would report on the
accuracy of the different assessment methods and how well the PDP rules are
working.

Liberty,

Brian

_______________________________________________
Nea mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nea