Subject: [sacm] Suggested revisions to SACM requirements G-007 and REQ-007

From: Lisa Lorenzin <[email-masked]>
Date: Mon, 5 May 2014 20:11:39 +0000

Greetings!

During last week's virtual F2F, I took an action item to suggest
revised text for a couple of the requirements based on our
conversation there.  Here is my pass at revising REQ-007 and
G-007 based on that discussion.  (I also tried to implement
Adam's very helpful suggestion to put the functional requirement
first, followed by the explanation and use case tie-in.

G-007 from -03.txt:
    To address security and privacy considerations, the data
    model, protocols and transport must consider authorization based on
    roles to only allow authorized requestors and publishers to access
    the information being requested or published.

G-007 proposed revision (may become a security consideration instead):
    To address security and privacy considerations, the data model,
    protocols and transport must consider authorization based on requestor
    function and privileges, to only allow authorized requestors and
    publishers to access specific information being requested or published.
    To enable federation across multiple entities (such as across
    organizational or geographic boundaries) authorization must also extend
    to infrastructure elements themselves, such as central controllers /
    brokers / data repositories.

REQ-007 from -03.txt:
    Use Cases 2.1.3, 2.1.4 and 2.1.5 describe the need for the
    data model to support the means for the information to be published
    asynchronously.  Similarly, the data model must support the means
    for a requestor to obtain updates or change modifications
    asynchronously.  Like the query operation, these update
    notifications can be set up with a filter to allow for only a subset
    of posture assessment information to be obtained.

REQ-007 proposed revision:
    The SACM data model must support the means for publishers to publish
    information either unsolicited (asynchronously) or in response to a
    query (synchronously).  For asynchronous publication, publishers must
    be able to publish to specific recipients - either directly or via a
    multicast-type mechanism - as well as to publish information to the
    ecosystem with no knowledge of the recipients.  Similarly, the data
    model must support the means for a requestor to obtain updates or
    change modifications asynchronously.  Like the query operation, these
    update notifications can be set up with a filter to allow for only a
    subset of posture assessment information to be obtained. (Use Cases
    2.1.3, 2.1.4 and 2.1.5)

These probably need further wordsmithing, but I believe they reflect the
changes we discussed on the call, so I just wanted to get them out there
to give us something to shoot at. :)

                                                Regards,

                                                                Lisa

--
Lisa Lorenzin  /  919-384-7275  /  [email-masked]
Principal Solutions Architect - Security & Mobility
Juniper Networks  /  http://www.juniper.net/