Subject: [sacm] Several basic edits recommended for SACM Use Cases 05

From: "Cockrell, Erik" <[email-masked]>
Date: Wed, 14 Aug 2013 07:39:12 -0700

Hi all -

I would like to introduce myself.  I am a member of the Polycom Product Security Office. I have met several of you over the past couple of years (very) briefly at that OVAL Dev Days at MITRE. I have also been attending the IT Security Automation Conference the past few years and in fact presented a demo at the ThreatGuard exhibit booth last year showing how Polycom is using SCAP to assess our video endpoints and UC infrastructure.

I have also been subscribed to SACM mailing list for the past year.  I viewed the recorded SACM sessions from Berlin and have read both architecture docs as well as the use cases 05 doc.

I noticed a few (very) basic edits for the use cases 05 doc and Dave asked that I post these to the mailing list. I purely mean this to be helpful and not critical in any way. If these edits have already been addressed, I apologize. I very much look forward to becoming more involved with SACM in the future.

Basic edits/feedback for use cases 05:
Terms and Definitions -
- Relative to monitoring of Cloud based applications, it is not clear to me how VM's are classified - can they be called out whether they are asset, endpoint or system resource (or all 3)?

Asset Management -
- 4.1.1 - misspells
-- "bradcast" should be broadcast
-- "determing" should be determining
- 4.1.7 - typo -- should delete "the" in first paragraph, second sentence
- 4.3.4 - misspell - "analysts" should be analyst
- 4.4 - Why is "policy attribute collection" left on a line by itself? Is this a typo?
- 4.4.1 - misspells
-- "associated" should be associated
-- "initates" should be initiates
- [page 13] - typo -
"An asset identifier SHOULD be able to represented in a
simple unambiguous manner"
-- should add "be" before "represented"
- 4.5 [page 14]
-- can "provenance" be added to terms and definitions?
-- can "entailment" be added to terms and definitions?
- [page 17] typo - "Waltmire's" should be Waltermire's

Thanks very much!

Erik Cockrell, Senior Staff Product Security & Automation Engineer, Polycom Product Security Office
The holy grail of security is airtight input validation.
7700 West Parmer Lane, Bldg. C, Suite 100, Austin, TX 78730 | t: 512.372.7155 | c: 512.739.4250 | f: 512.372.7142

---

From: Adam Montville <[email-masked]>
Date: Wed, 14 Aug 2013 15:01:43 +0000

Erik,

Thank you for these, and future, contributions!  Welcome, and we look forward to your continued involvement, especially as you represent an important piece of the (IMO) underrepresented enterprise in terms of what we typically consider a "traditional" endpoint.

To address your question pertaining to how VMs are viewed, they are considered an endpoint.  We had a (brief) discussion about this on the list, and I believe the general consensus was: 1) Yes, a VM is an endpoint, and 2) this fact would be explicitly added to the "endpoint" definition.  Others on the list can add/correct as needed.

Regards,

Adam

________________________________
From: [email-masked] [[email-masked]] on behalf of Cockrell, Erik [[email-masked]]
Sent: Wednesday, August 14, 2013 7:40 AM
To: [email-masked]
Subject: [sacm] Several basic edits recommended for SACM Use Cases 05

Hi all –

Basic edits/feedback for use cases 05:
Terms and Definitions -
- Relative to monitoring of Cloud based applications, it is not clear to me how VM's are classified – can they be called out whether they are asset, endpoint or system resource (or all 3)?

Asset Management -
- 4.1.1 - misspells
-- “bradcast” should be broadcast
-- “determing” should be determining
- 4.1.7 - typo -- should delete "the" in first paragraph, second sentence
- 4.3.4 - misspell – “analysts” should be analyst
- 4.4 - Why is "policy attribute collection" left on a line by itself? Is this a typo?
- 4.4.1 - misspells
-- “associated” should be associated
-- “initates” should be initiates
- [page 13] - typo -
“An asset identifier SHOULD be able to represented in a
simple unambiguous manner”
-- should add "be" before "represented"
- 4.5 [page 14]
-- can "provenance" be added to terms and definitions?
-- can "entailment" be added to terms and definitions?
- [page 17] typo – “Waltmire's” should be Waltermire's

Thanks very much!

...

. . .