Subject: [sacm] Partially Updated SACM Architecture

From: "Waltermire, David A." <[email-masked]>
Date: Thu, 13 Nov 2014 08:36:19 +0000

The attached SACM architecture draft reflects the work that Lisa and I have been doing to:

*         Expand the level of detail with regards to architectural components

*         Integrate text from the information model that belongs in the architecture

*         Incorporate the concept of an endpoint that is targeted for assessment

*         And a number of other action items

I'll continue to work on this draft tomorrow to fill in placeholder text. I'll include a more comprehensive changelog in the draft before we post it to the datatracker.

Between now and then, it would be good to get feedback from all of you on the direction of the current changes. Do you think this is adequately capturing the concepts we have been discussing? Is the organizational structure moving in a positive direction?

Thanks,
Dave

---

From: Jessica Fitzgerald-McKay <[email-masked]>
Date: Fri, 14 Nov 2014 12:15:57 -0500

Hi, Dave,

I like the direction that you are headed in. I think it is a good start at
making sure the information model and the architecture align. I know you
are still working on it, but I wanted to share a few high-level comments:

1) Section 2.1- I understand what you are going for here. I think, given
our definition of an endpoint ("a network connected device"), it seems
redundant.

2) Section 2.2.1- why are these not security considerations? We need
authentication, authorization, endpoint identification and endpoint
discovery. . . . how we are going to achieve that is yet to be determined.

3) Section 2.3.1, paragraph 4- Is it not the charter of this work group to
define the data models and protocols that we are going to standardize on?

Jess

On Thu, Nov 13, 2014 at 3:36 AM, Waltermire, David A. <
[email-masked]> wrote:

> ·         Expand the level of detail with regards to architectural
> components
>
> ·         Integrate text from the information model that belongs in the
> architecture
>
> ·         Incorporate the concept of an endpoint that is targeted for
> assessment
>
> ·         And a number of other action items
>
>
>
> I’ll continue to work on this draft tomorrow to fill in placeholder text.
> I’ll include a more comprehensive changelog in the draft before we post it
> to the datatracker.
>
>
>
> Between now and then, it would be good to get feedback from all of you on
> the direction of the current changes. Do you think this is adequately
> capturing the concepts we have been discussing? Is the organizational
> structure moving in a positive direction?
>
>
>
> Thanks,
>
> Dave
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>
>

---

From: Merike Kaeo <[email-masked]>
Date: Fri, 14 Nov 2014 10:36:10 -0800

Hello

Some initial thoughts and also comments on what was written below.
2.0 Architectural Overview

There is expanding text on Posture Assessment Information Controller but not Consumer nor Provider.  Should have consistency (also noted that term ‘controller’ not listed in terminology document - should it be there?)

2.2

Sample text: The control plane provides the signaling functions between the three functional components.  The data plane forwards the information between the functional components according to the control plane logic.  (since you are embellishing on these items in subsequent text not sure it needs to be more elaborate than that).

On Nov 14, 2014, at 9:15 AM, Jessica Fitzgerald-McKay <[email-masked]> wrote:

> Hi, Dave,
> 
> I like the direction that you are headed in. I think it is a good start at making sure the information model and the architecture align. I know you are still working on it, but I wanted to share a few high-level comments:
> 
> 1) Section 2.1- I understand what you are going for here. I think, given our definition of an endpoint ("a network connected device"), it seems redundant.

I had made notes to change 'target endpoint' to 'target' as the use of endpoint seemed redundant and superfluous.

> 
> 2) Section 2.2.1- why are these not security considerations? We need authentication, authorization, endpoint identification and endpoint discovery. . . . how we are going to achieve that is yet to be determined.

I'm OK with having these be listed as functions since these are architecturally functions that 'are' part of control plane.   Security considerations to me would be issues arising from any mechanism where there is a possibility for circumvention of security functions for malicious abuse.

For 'identity management' - should there be any statements regarding credentials and how they are tied to assert an identity?  Perhaps this is not necessary in architecture document but I'm still mulling on that.

Both Authenticating and Authorization need wordsmithing to make it clearer what entity is authenticating which component.  I have no wording to add right now but will think on this.

> 
> 3) Section 2.3.1, paragraph 4- Is it not the charter of this work group to define the data models and protocols that we are going to standardize on?

That is what I too would have expected.

In reading this section I was a bit confused about the text that the Provider "may use a standard data model and/or protocol, a non-standard data model and/or protocol, or any combination of standard and non-standard data models and protocols."  as I don't see how this would foster interoperability but as I'm new to following this work in more detail I may have missed some history.

All for now…will be in AM's session…

- merike

> 
> Jess
> 
> On Thu, Nov 13, 2014 at 3:36 AM, Waltermire, David A. <[email-masked]> wrote:
> ·         Expand the level of detail with regards to architectural components
> 
> ·         Integrate text from the information model that belongs in the architecture
> 
> ·         Incorporate the concept of an endpoint that is targeted for assessment
> 
> I’ll continue to work on this draft tomorrow to fill in placeholder text. I’ll include a more comprehensive changelog in the draft before we post it to the datatracker.
> 
>  
>