Subject: [sacm] Use Case: Asynchronous Assessment

From: Gunnar Engelbach <[email-masked]>
Date: Fri, 16 Aug 2013 12:46:31 -0400

I put together the following use case description to highlight the 
unique challenges we've had accommodating some customers:

         -------------===========================-------------
Asynchronous Compliance/Vulnerability Assessment at Ice Station Zebra

A university team receives a grant to do research at a government
facility in the arctic.  The only network communications will be via an
intermittent low-speed high-latency high-cost satellite link.  During
their extended expedition they will need to show continue compliance
with the security policies of the university, the government, and the
provider of the satellite network as well as keep current on
vulnerability testing.  Interactive assessments are therefore not
reliable, and since the researchers have very limited funding they need
to minimize how much money they spend on network data.

Prior to departure they register all equipment with an asset management
system owned by the university, which will also initiate and track
assessments.

On a periodic basis -- either after a maximum time delta or when the
content repository has received a threshold level of new vulnerability
definitions -- the university uses the information in the asset
management system to put together a collection request for all of the
deployed assets that encompasses the minimal set of artifacts necessary
to evaluate all three security policies as well as vulnerability testing.

In the case of new critical vulnerabilities this collection request
consists only of the artifacts necessary for those vulnerabilities and
collection is only initiated for those assets that could potentially
have a new vulnerability.

[Optional] Asset artifacts are cached in a local CMDB.  When new
vulnerabilities are reported to the content repository, a request to the
live asset is only done if the artifacts in the CMDB are incomplete
and/or not current enough.

The collection request is queued for the next window of connectivity.
The deployed assets eventually receive the request, fulfill it, and
queue the results for the next return opportunity.

The collected artifacts eventually make it back to the university where
the level of compliance and vulnerability expose is calculated and asset
characteristics are compared to what is in the asset management system
for accuracy and completeness.

----------------------------------------
I brought up this scenario because it highlights a few requirements:

* A measured reaction to updates to the content repository
* Unable to do collection interactively
* Minimize total network traffic (enhanced by use of CMDB)
* Active network discovery infeasible:  using asset management system
instead
* A single collection is used for multiple policies
* Multiple policies may apply, depending on current context of asset