Subject: [sacm] SACM Vulnerability Management

From: "Waltermire, David A." <[email-masked]>
Date: Mon, 19 Aug 2013 00:06:55 +0000

I'm working on updates to the use cases based on feedback received and there is an outstanding question that was not addressed based on what I can find.

Is standardizing IDS/IPS signatures in scope? For network-based tools? For host-based tools?

Any thoughts?

Dave

---

From: Joe Marcus Clarke <[email-masked]>
Date: Mon, 19 Aug 2013 00:29:09 -0400

On 8/18/13 8:06 PM, Waltermire, David A. wrote:
> I’m working on updates to the use cases based on feedback received and
> there is an outstanding question that was not addressed based on what I
> can find.
> 
>  
> 

I mentioned this as a counter argument to what I was trying to raise
asking about vulnerability management.  I was asking more about defining
a common way to describe a vulnerability, remediation, etc for purposes
of interchange.  I don't think trying to come up with a standard IPS
signature definition should be in the initial SACM scope.

Joe

-- 
Joe Marcus Clarke, CCIE #5384,         |          |
SCJP, SCSA, SCNA, SCSECA, VCP        |||||      |||||
Distinguished Services Engineer ..:|||||||||::|||||||||:..
Phone: +1 (919) 392-2867         c i s c o  S y s t e m s
Email: [email-masked]

----------------------------------------------------------------------------

---

From: "Aaron Woland (aawoland)" <[email-masked]>
Date: Mon, 19 Aug 2013 11:58:07 +0000

+1

(Deftly typed with big thumbs and a small keyboard on my iPhone.  Please excuse spelling errors, brevity or words that were "autocorrected" incorrectly!!!) 

On Aug 19, 2013, at 12:29 AM, "Joe Clarke (jclarke)" <[email-masked]> wrote:

> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: Gunnar Engelbach <[email-masked]>
Date: Mon, 19 Aug 2013 10:26:28 -0400

Standardizing IPS/IDS signature definitions is beyond the current scope 
of this WG, but standardizing the ability to communicate a detected IDS 
signature would be very useful in conjunction with known 
vulnerabilities/misconfigured items -- something akin to CVE/CVSS.

Same for routing rules, firewall rule sets, VLAN settings, et al.

I'd like to see a convergence where all of this information can be 
communicated in a standardized way, but I think that's too much for this 
working group right now.

--gun

---

From: "Waltermire, David A." <[email-masked]>
Date: Mon, 19 Aug 2013 14:58:42 +0000

Just to summarize what I am hearing, the following is true:
- Defining a format for IDS/IPS signature is not in scope.
- Supporting format agnostic publication and retrieval of IDS/IPS signatures in a content repository is in scope.
- Supporting the exchange of IDS/IPS signature is in scope allowing any arbitrary model to be used for the exchange.
- Reporting detected IDS/IPS signatures is in scope. Is this true for both network-based AND host-based IDS/IPS components?

Is this correct?

Dave

> -----Original Message-----
> From: Gunnar Engelbach [mailto:[email-masked]]
> Sent: Monday, August 19, 2013 10:26 AM
> To: Joe Marcus Clarke
> Cc: Waltermire, David A.; [email-masked]
> Subject: Re: [sacm] SACM Vulnerability Management
> 
> 
> Standardizing IPS/IDS signature definitions is beyond the current scope of
> this WG, but standardizing the ability to communicate a detected IDS
> >> I'm working on updates to the use cases based on feedback received
> >> and there is an outstanding question that was not addressed based on
> >> what I can find.
> >>
> >>
> >>
> > asking about vulnerability management.  I was asking more about
> > defining a common way to describe a vulnerability, remediation, etc
> > for purposes of interchange.  I don't think trying to come up with a
> > standard IPS signature definition should be in the initial SACM scope.
> >
> > Joe
> >

---

From: Gunnar Engelbach <[email-masked]>
Date: Mon, 19 Aug 2013 14:24:37 -0400

Standardizing the characteristics necessary to identify known IDS/IPS 
events is a reasonable next step beyond identifying configuration items, 
known vulnerabilities, and malware.  And, to me, that certainly falls 
within the purview of "Security Automation and Continuous Monitoring." 
I'd like to see it addressed, but as much as this WG has been whittled 
down to its current focus I don't see it as sensible trying to address 
it at this time.

An abstraction step removed from IPS/IDS signatures is standardizing how 
to communicate detected events with enough information to make security 
decisions.  That would be a good first step, but even that much I'm not 
convinced SACM has the resources to address at this time.

Querying a content repository for signatures is a good point.  I already 
think the query/retrieval mechanism for content repositories needs to be 
very open-ended, so I don't see why they couldn't also be used for 
proprietary content -- as long as the minimal set of SACM requirements 
are also met.

So I guess what I'm saying is that I see all of this as in scope, but 
none of it will be able to be addressed in this iteration.

Anyone else?

---

From: Joe Marcus Clarke <[email-masked]>
Date: Mon, 19 Aug 2013 16:47:37 -0400

> none of it will be able to be addressed in this iteration.

I would agree, but I thought David's question dealt with scope of this
charter?

Joe

>> - Supporting format agnostic publication and retrieval of IDS/IPS
>> signatures in a content repository is in scope.
>> - Supporting the exchange of IDS/IPS signature is in scope allowing
>> any arbitrary model to be used for the exchange.
>> - Reporting detected IDS/IPS signatures is in scope. Is this true for
>> both network-based AND host-based IDS/IPS components?
>>
>> Is this correct?
>>
>> Dave
>>

---

From: "Waltermire, David A." <[email-masked]>
Date: Mon, 19 Aug 2013 20:52:32 +0000

That was the intent of my questions.  I am trying to work out what we want to capture use cases around in the area of vulnerability management. I am trying to develop a sense of what aspect of the use cases are in scope for the current charter and what should be documented in the use case draft.

Dave

> From: Joe Marcus Clarke [mailto:[email-masked]]
> Sent: Monday, August 19, 2013 4:48 PM
> To: Gunnar Engelbach
> > events is a reasonable next step beyond identifying configuration
> > items, known vulnerabilities, and malware.  And, to me, that certainly
> > falls within the purview of "Security Automation and Continuous
> Monitoring."
> > An abstraction step removed from IPS/IDS signatures is standardizing
> > how to communicate detected events with enough information to make
> > security decisions.  That would be a good first step, but even that
> > much I'm not convinced SACM has the resources to address at this time.
> >
> > Querying a content repository for signatures is a good point.  I
> > already think the query/retrieval mechanism for content repositories
> > needs to be very open-ended, so I don't see why they couldn't also be
> > used for proprietary content -- as long as the minimal set of SACM
> > requirements are also met.
> >
> >
> >>> Standardizing IPS/IDS signature definitions is beyond the current
> >>> scope of this WG, but standardizing the ability to communicate a
> >>> detected IDS signature would be very useful in conjunction with
> >>> known vulnerabilities/misconfigured items -- something akin to
> >>> CVE/CVSS.
> >>>
> >>> communicated in a standardized way, but I think that's too much for
> >>> this working group right now.
> >>>
> >>>
> >>> --gun
> >>>
> >>>
> >>>>> and there is an outstanding question that was not addressed based
> >>>>> on what I can find.
> >>>>>
> >>>>>
> >>>>>
> >>>>> Is standardizing IDS/IPS signatures in scope? For network-based
> tools?
> >>>>> For host-based tools?
> >>>>>
> >>>>>
> >>>>>
> >>>>> Any thoughts?
> >>>>
> >>>> I mentioned this as a counter argument to what I was trying to
> >>>> raise asking about vulnerability management.  I was asking more
> >>>> about defining a common way to describe a vulnerability,
> >>>> remediation, etc for purposes of interchange.  I don't think trying
> >>>> to come up with a standard IPS signature definition should be in the
> initial SACM scope.
> >>>>
> >>>> Joe
> >>>>

---

From: Joe Marcus Clarke <[email-masked]>
Date: Mon, 19 Aug 2013 16:56:49 -0400

> That was the intent of my questions.  I am trying to work out what we want to capture use cases around in the area of vulnerability management. I am trying to develop a sense of what aspect of the…

Then to answer your question speaking for myself, I would say that the
points in your email are in scope for both host and network IPS/IDS
(noting that the first item in your list around defining a format is out
of scope).

Joe

---

From: Chris Inacio <[email-masked]>
Date: Tue, 20 Aug 2013 13:21:12 +0000

--
Chris Inacio
[email-masked]

> - Defining a format for IDS/IPS signature is not in scope.

Not in scope.  This is a huge project/effort unto itself.

> - Supporting the exchange of IDS/IPS signature is in scope allowing any arbitrary model to be used for the exchange.

I still think that we should be defining the exchange only;  How / if there is a repository is up to implementors.

> - Reporting detected IDS/IPS signatures is in scope. Is this true for both network-based AND host-based IDS/IPS components?
Yes & Yes.

---

From: Stephen Hanna <[email-masked]>
Date: Tue, 20 Aug 2013 13:31:36 +0000

+1

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Chris Inacio
> Sent: Tuesday, August 20, 2013 9:21 AM
> To: Waltermire, David A.
> Cc: Gunnar Engelbach; Joe Marcus Clarke; [email-masked]
> I still think that we should be defining the exchange only;  How / if
> there is a repository is up to implementors.
> 
> scope of
> on
> raise

---

From: Joe Marcus Clarke <[email-masked]>
Date: Tue, 20 Aug 2013 11:04:13 -0400

> I still think that we should be defining the exchange only;  How / if there is a repository is up to implementors.

I think I'm seeing a repository as a natural extension of the exchange
(i.e., there may be a collection of these things in a common place from
which the exchange takes place).

Joe

---

From: Chris Inacio <[email-masked]>
Date: Wed, 21 Aug 2013 13:42:28 +0000

+1

Exactly my thought.

But, the braindead implementation doesn't have a repository and always answers back "I don't know."  Presumably, the market doesn't want that solution…but, I'm not the market.

--
Chris Inacio
[email-masked]

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Wed, 21 Aug 2013 16:37:26 +0200

If you are looking for an implementation of vulnerability models and a
repository where keeps all the vulnerability, we already have a running
system. But I am not quite sure how this can be helpful.

Hosnieh

> >>> - Supporting format agnostic publication and retrieval of IDS/IPS
signatures
> in a content repository is in scope.
any
> arbitrary model to be used for the exchange.
> >>
there is a
> repository is up to implementors.
> >
> > (i.e., there may be a collection of these things in a common place
> > from which the exchange takes place).
> >
> > Joe
> >
> 
> +1
> 
> Exactly my thought.
> 
> But, the braindead implementation doesn't have a repository and always
> answers back "I don't know."  Presumably, the market doesn't want that
> solution.but, I'm not the market.
> 
> --
> Chris Inacio
> [email-masked]
> 
> 
>