Subject: Re: [sacm] comments for draft-handt-sacm-alternate-architecture-01

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 1 Aug 2013 12:23:42 +0000

+1 on the concreteness. I like having a practical view into how the architecture can be used.

My only concern is that a concrete architecture might be brittle in the face of evolving technilogical approaches. I believe a hybrid approach brings the best of both worlds. It might be better to present an abstract architecture that may be more broadly applicable and a number of concrete examples to provide illustrations of how it can be used.

Is this an acceptable way forward?

Dave
________________________________________
From: [email-masked] <[email-masked]> on behalf of Chris Inacio <[email-masked]>
Sent: Wednesday, July 31, 2013 9:22 PM
To: [email-masked]
Subject: [sacm] comments for draft-handt-sacm-alternate-architecture-01

I really like the concreteness of the architecture, its easy to think about.  But I feel like this alternative isn't complete enough.  From my comments in the review of the draft-waltermire-sacm-architecture-00 architecture, I really feel like more than just BPD's (which I think is code for IDS/IPS) should be considered to complete the situational awareness (SA) picture.

I believe that we need to include passive asset devices, active vuln scan capability, and machine config management (Windows AD, Red Hat Satellite Server, Puppet, CFEngine, MDM systems, …).  I don't think that is covered in your model.

So after we've done all of this evaluation - what are the protocols used to reconfigure the network to isolate a compromised / at risk machine?  Is that all NETCONF?

--
Chris Inacio
[email-masked]

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm