Subject: [sacm] comments on the SACM architecture

From: Jessica Fitzgerald-McKay <[email-masked]>
Date: Mon, 10 Nov 2014 15:00:20 -0500

Below are some comments on the SACM architecture. I have attached a set of
slides that represent an attempt to capture a fuller view of the
architecture. Looking forward to hearing comments!

Jess

High-level comments

-------------------------------

The information model seems to be focused on standardizing a few main
activities: how to self-publish information from an endpoint to a posture
repository; how to access configuration guidance from a repository and
ingest it to develop network policy; and how to share posture information
(including reports, assessment results, etc.) across the network. Because
of this, I do not think we can continue to divide the architecture into
just “producers” and “consumers”, with a control plan between them. A
consumer of information (say, and asset management tool, or a policy
engine) can also be a provider (by sharing collected data, or reports, or
configuration instructions, or whatever). Also, many endpoints (for
example, user endpoints like laptops, mobile devices, PCs, etc.) should
likely not be consumers in the manner described here, as this opens up a
number of interesting attack vectors.

We need to be more explicit in our drawings. The drawings I made as a
start, but I know I did not capture the “right ventricle” very well at
all.  I think the words “provider” and “consumer” work well with the right
ventricle, but not with the left. On the left, we have a clear division in
the world, between an endpoint that self-reports, and the repositories that
act as the authorization, identity management, and discovery/registration
component, as well as the party that “consumes” the information from the
endpoint.

The words I included below are from my slides that I sent you last week. I
think they work well for most of the left ventricle work, and gives the
group something to think about for a little while.
Components of the ArchitectureEndpoints and Endpoint Components

The information model focuses on endpoint identification, characterization
and attribute representation, so clearly the endpoint itself must be
represented in the SACM architecture.  All endpoints may be a producer or
consumer of posture information, or both, or neither.

Endpoints that are producers of posture information may self-report certain
data. Per Section 4.2 of the Information model, these endpoints require
aninternal attribute collector. These endpoints must also have a unique
identifier, such as an endpoint credential, which can be used for both
identification and authorization of the endpoint. Self-reporting endpoints
may provide posture information regarding hardware components, and software
unique identifiers.

External Attribute Collectors

Certain posture information could be observed on the network. The
Information Model describes external attribute collectors (Section 4.6)
that collect observable posture information.

Data Repositories

The use cases describe a requirement for data repositories for Guidance and
Attribute data (Section 2.1.1).  Internal and external attribute collectors
should publish to attribute data repositories, and guidance producers
should publish to guidance data repository.

EvaluatorsThe Information Model defines evaluators (Section 4.8) that
consume posture information. These evaluators should be able to access
information in the guidance data repository, and should also be able to
publish reports and evaluation results to authorized recipients.