Subject: [sacm] QUESTION on UCs Section 2.1.2 Regarding Endpoint Discovery/Characterization/Targeting

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 5 Feb 2014 19:24:47 +0000

Gunnar,

I'm changing the subject and trimming the thread to focus on the single point of discussion.

Please find my feedback on your comment below.

Dave

> -----Original Message-----
> From: sacm [mailto:[email-masked]] On Behalf Of Gunnar Engelbach
> Sent: Wednesday, February 05, 2014 1:42 PM
> To: Waltermire, David A.; David Harrington; [email-masked]
> Subject: Re: [sacm] Consensus on QUESTIONS in use-cases-5
> 
> 
> All of this looks good to me, with one additional comment near the bottom...
> 
> 
> --gun
> 
> 
> On 2/5/2014 12:29 PM, Waltermire, David A. wrote:
> >
> > 4) in 2.1.2,
> >
> > Endpoint Discovery:  The purpose of discovery is to determine the
> >           type of endpoint to be posture assessed.
> >
> >           QUESTION: Is it just the type?  Or is it to identify what
> >           endpoint instances to target for assessment using metadata
> > such
> >
> >           as the endpoint's organizationally expected type (e.g.,
> >
> >           expected function/role, etc.)
> >
> > If this is truly endpoint "discovery", then I think this building
> > block discovers the whole set of endpoints it can see in the network -
> > i.e., the whole set of endpoints that might be able to be assessed.
> >
> > In the next step (targeting), that building block selects a subset of
> > the discovered set of endpoints, based on such things as type of
> > endpoint, organizationally expected function/role, version, etc.
> >
> > [DAW: The discussion on the call resulted in the identification of two
> > distinct concepts, Endpoint Discovery and Endpoint Characterization,
> > that are needed to support the identification of what endpoints should
> > be targeted for an assessment. Both of these concepts have been
> > combined in the current "Endpoint Discovery" building block. There was
> > agreement that these two aspects should be broken out into distinct
> > building block items. I took the action to propose some new text.
> > Please let us know if you have any objections or suggested changes to
> > the following proposed
> > change:
> >
> > Endpoint Discovery: To determine the current or historic presence of
> > endpoints in the environment that are available for posture assessment.
> >
> > Endpoint Characterization: The act of acquiring, through automated
> > collection or manual input, and organizing attributes associated with
> > an endpoint (e.g., type, organizationally expected function/role,
> > hardware/software versions) that can be used to evaluate
> > organizational policies that determine what endpoints should be posture
> assessed.
> 
> 
> Just end this definition at the end of the parenthetical expression, which also
> removes the need for the following "Identify Endpoint Targets" definition.
> 
> Classification is for both finding the appropriate content for an endpoint and
> for finding which endpoints content applies to.  Examples for both uses could
> be simply stated, if necessary.
> 

I am fine with dropping the text "that can be used to evaluate organizational policies that determine what endpoints should be posture assessed", since this is somewhat redundant with the modified text under "Identify Endpoint Targets".

The existing text in (-05) includes a definition for "Identify Endpoint Targets". I modified the existing text to tie together the classification and targeting concepts. IMHO this addresses finding which endpoints content applies to. The text under "Collection Content Acquisition" and "Evaluation Content Acquisition" addresses finding the appropriate content for an endpoint for collection and evaluation.

To be more clear about what the change to "Identify Endpoint Targets" entails, here is the original text:

Identify Endpoint Targets:  To identify what potential endpoint
         targets the checklist should apply to based on organizational
         policies.

The new text adds the text in brackets:

Identify Endpoint Targets:  To identify what potential endpoint
         targets the checklist should apply to based on [evaluating] organizational
         policies [against known endpoint attributes].

Based on this discussion the complete text might be modified to:

Endpoint Discovery: To determine the current or historic presence of
         endpoints in the environment that are available for posture assessment.

Endpoint Characterization: The act of acquiring, through automated
         collection or manual input, and organizing attributes associated with
         an endpoint (e.g., type, organizationally expected function/role,
         hardware/software versions).

Identify Endpoint Targets:  To identify what potential endpoint
         targets the checklist should apply to based on evaluating organizational
         policies against known endpoint attributes.

How about this?

---

From: Gunnar Engelbach <[email-masked]>
Date: Wed, 05 Feb 2014 15:02:52 -0500

With that change to "Endpoint Characterization" I find "Identify 
Endpoint Targets" to be redundant.

However, if "Identify Endpoint Targets" is kept, I'd suggest dropping 
the clause

   "...based on evaluating organizational policies against known 
endpoint attributes."

That makes a restrictive assumption about how it can be used.

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 5 Feb 2014 20:11:53 +0000

I don't find the text to be restrictive since any set of endpoint attributes can be used (including aspects of posture). If we kept the text, what would not be supported for targeting?

Dave

> From: Gunnar Engelbach [mailto:[email-masked]]
> Sent: Wednesday, February 05, 2014 3:03 PM
> Subject: Re: QUESTION on UCs Section 2.1.2 Regarding Endpoint
> Discovery/Characterization/Targeting
> 
> 
> 
> With that change to "Endpoint Characterization" I find "Identify Endpoint
> Targets" to be redundant.
> 
> However, if "Identify Endpoint Targets" is kept, I'd suggest dropping the
> clause
> 
>    "...based on evaluating organizational policies against known endpoint
> attributes."
> 
> >>>            endpoint instances to target for assessment using
> >>> metadata such
> >>>
> >>> block discovers the whole set of endpoints it can see in the network
> >>> - i.e., the whole set of endpoints that might be able to be assessed.
> >>>
> >>> In the next step (targeting), that building block selects a subset
> >>> of the discovered set of endpoints, based on such things as type of
> >>> [DAW: The discussion on the call resulted in the identification of
> >>> two distinct concepts, Endpoint Discovery and Endpoint
> >>> Characterization, that are needed to support the identification of
> >>> what endpoints should be targeted for an assessment. Both of these
> >>> concepts have been combined in the current "Endpoint Discovery"
> >>> building block. There was agreement that these two aspects should be
> >>> broken out into distinct building block items. I took the action to propose
> some new text.
> >>> Please let us know if you have any objections or suggested changes
> >>> to the following proposed
> >>> change:
> >>>
> >>> collection or manual input, and organizing attributes associated
> >>> with an endpoint (e.g., type, organizationally expected
> >>> function/role, hardware/software versions) that can be used to
> >>> evaluate organizational policies that determine what endpoints
> >>> should be posture
> >> assessed.
> >>
> >>
> >> Just end this definition at the end of the parenthetical expression,
> >> which also removes the need for the following "Identify Endpoint
> Targets" definition.
> >>
> >> Classification is for both finding the appropriate content for an
> >> endpoint and for finding which endpoints content applies to.
> >> Examples for both uses could be simply stated, if necessary.
> >>
> >
> > I am fine with dropping the text "that can be used to evaluate
> assessed", since this is somewhat redundant with the modified text under
> "Identify Endpoint Targets".
> >
> > The existing text in (-05) includes a definition for "Identify Endpoint
> Targets". I modified the existing text to tie together the classification and
> targeting concepts. IMHO this addresses finding which endpoints content
> applies to. The text under "Collection Content Acquisition" and "Evaluation
> Content Acquisition" addresses finding the appropriate content for an
> endpoint for collection and evaluation.
> >

---

From: Gunnar Engelbach <[email-masked]>
Date: Wed, 05 Feb 2014 19:10:27 -0500

How about:

Identify Endpoint Targets:  Using target attributes to determine the 
applicability of each to a given content item(s).

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 6 Feb 2014 00:25:44 +0000

I just noticed that I dropped some of the original text for this entry. How about the following that adds this text back in?

Identify Endpoint Targets:  Determine the candidate endpoint target(s)
                against which to perform the assessment. Depending on the assessment trigger, a
                single endpoint or multiple endpoints may be targeted based on characterized
                endpoint attributes. Content may describe the applicable targets for assessment. In
                this case the Content Query and/or Content Retrieval building blocks (see section
                XXX) may be used to acquire this content for processing.

Dave

> Sent: Wednesday, February 05, 2014 7:10 PM
> > I don't find the text to be restrictive since any set of endpoint attributes
> can be used (including aspects of posture). If we kept the text, what would
> not be supported for targeting?
> >
> > Dave
> >
> with

---

From: Ira McDonald <[email-masked]>
Date: Wed, 5 Feb 2014 19:31:11 -0500

Hi Dave,

I like this Identify Endpoint Targets text better.

Cheers,
- Ira

On Wed, Feb 5, 2014 at 7:25 PM, Waltermire, David A. <
[email-masked]> wrote:

> I just noticed that I dropped some of the original text for this entry.
> How about the following that adds this text back in?
>
> the
> endpoint
> > >>> I'm changing the subject and trimming the thread to focus on the
> single
> > >> point of discussion.
> > >>>
> > >>>            targets the checklist should apply to based on
> [evaluating]
> > >> organizational
> > >>>            endpoints in the environment that are available for
> posture
> > >> assessment.
> > >>>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Gunnar Engelbach <[email-masked]>
Date: Wed, 05 Feb 2014 19:53:02 -0500

> I like this Identify Endpoint Targets text better.

I second that, but I wonder if somebody new to this would have further 
questions.

For example:

"Content may describe the applicable targets for assessment"

Does that say that the content will have something like a list of the 
target IP addresses?

How about:

"Content may contain instructions or references used to determine its 
applicability."

"In this case the Content Query and/or Content Retrieval building blocks 
(see section XXX) may be used to acquire this content for processing."

Is that to say that the content may refer to other content, which must 
be retrieved and applied in order to determine applicability?  And 
therefore that referenced content could also contain content references 
that need to be resolved?

Is it also possible for this content to be entirely self-contained in 
that it also contains all the instructions necessary for determining its 
own applicability?

If that's what's covered in section XXX then.....cool!

>
>
> On Wed, Feb 5, 2014 at 7:25 PM, Waltermire, David A.
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     I just noticed that I dropped some of the original text for this
>     entry. How about the following that adds this text back in?
>
>      > From: Gunnar Engelbach [mailto:[email-masked]
>     <mailto:[email-masked]>]
>     <mailto:[email-masked]>
>      > >> From: Gunnar Engelbach
>     [mailto:[email-masked]
>     <mailto:[email-masked]>]
>     <mailto:[email-masked]>
>      > >>> I'm changing the subject and trimming the thread to focus on
>     the single
>      > >> point of discussion.
>      > >>>
>      > >>>> From: sacm [mailto:[email-masked]
>     <mailto:[email-masked]>] On Behalf Of Gunnar
>      > >>>> Engelbach
>     <mailto:[email-masked]>
>      > >>>> All of this looks good to me, with one additional comment
>     near the
>      > >> bottom...
>      > >>>>
>      > >>>>
>      > >>>> --gun
>      > >>>>
>      > >>>>
>      > >>>>> building block. There was agreement that these two aspects
>     should
>      > be
>      > >>>>> broken out into distinct building block items. I took the
>     action to
>      > propose
>      > >> some new text.
>      > >>> To be more clear about what the change to "Identify Endpoint
>     Targets"
>      > >> entails, here is the original text:
>      > >>>
>      > >>>            endpoints in the environment that are available
>     for posture
>      > >> assessment.
>      > >>>
>     evaluating
>     [email-masked] <mailto:[email-masked]>

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 6 Feb 2014 01:02:09 +0000

How about a slight refinement of that:

"Content describing the assessment to be performed may contain instructions or references used to determine the applicable assessment targets."

> Sent: Wednesday, February 05, 2014 7:53 PM
> To: Ira McDonald; Waltermire, David A.
> Cc: David Harrington; [email-masked]
> Subject: Re: [sacm] QUESTION on UCs Section 2.1.2 Regarding Endpoint
> Does that say that the content will have something like a list of the target IP
> addresses?
> 
> 
> How about:
>

---

From: Gunnar Engelbach <[email-masked]>
Date: Wed, 05 Feb 2014 20:53:30 -0500

> "Content describing the assessment to be performed may contain instructions or references used to determine the applicable assessment targets."

Works for me.

---

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 6 Feb 2014 01:56:38 +0000

Here is the updated text for the modified building block entries in section 2.1.2:

   Endpoint Discovery:  To determine the current or historic presence of
         endpoints in the environment that are available for posture
         assessment.

   Endpoint Characterization:  The act of acquiring, through automated
         collection or manual input, and organizing attributes
         associated with an endpoint (e.g., type, organizationally
         expected function/role, hardware/software versions).

   Identify Endpoint Targets:  Determine the candidate endpoint
         target(s) against which to perform the assessment.  Depending
         on the assessment trigger, a single endpoint or multiple
         endpoints may be targeted based on characterized endpoint
         attributes.  Content describing the assessment to be performed
         may contain instructions or references used to determine the
         applicable assessment targets.  In this case the Content Query
         and/or Content Retrieval building blocks (see section 2.1.1)
         may be used to acquire this content.

Any additional concerns with this text?

Thanks,
Dave

> Sent: Wednesday, February 05, 2014 8:54 PM
> To: Waltermire, David A.; Ira McDonald
> > "Content describing the assessment to be performed may contain
> instructions or references used to determine the applicable assessment
> targets."
> 
> 
> Works for me.
> 
> 
> 
> 
> >
> >> I second that, but I wonder if somebody new to this would have
> >> further questions.
> >>
> >> For example:
> >>
> >> "In this case the Content Query and/or Content Retrieval building
> >> blocks (see section XXX) may be used to acquire this content for
> processing."
> >>
> >> Is that to say that the content may refer to other content, which
> >> must be retrieved and applied in order to determine applicability?
> >> And therefore that referenced content could also contain content
> >> references that need to be resolved?
> >>
> >> that it also contains all the instructions necessary for determining
> >> its own applicability?
> >>
> >>
> >>>       > >> assessed", since this is somewhat redundant with the modified
> text
> >>>       > under