Subject: [sacm] I-D Action: draft-ietf-sacm-architecture-01.txt

From: [email-masked]
Date: Wed, 19 Nov 2014 13:22:55 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Security Automation and Continuous Monitoring Working Group of the IETF.

        Title           : Secure Automation and Continuous Monitoring (SACM) Architecture
        Authors         : Nancy Cam-Winget
                          Brian Ford
                          Lisa Lorenzin
                          Ira E McDonald
                          Aaron Woland
	Filename        : draft-ietf-sacm-architecture-01.txt
	Pages           : 16
	Date            : 2014-11-19

Abstract:
   This document describes an architecture for standardization of
   interfaces, protocols and information models related to security
   automation and continuous monitoring.  It describes the basic
   architecture, components and their interfaces defined to enable the
   collection, acquisition and verification of Posture and Posture
   Assessments.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sacm-architecture/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-sacm-architecture-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-sacm-architecture-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Lorenzin, Lisa" <[email-masked]>
Date: Wed, 19 Nov 2014 21:39:33 +0000

Hi folks,

Based on our conversation in the Friday morning F2F, I've taken a crack at updating the architecture draft:

* revised both the original design team architectural diagram and the new communications-model diagram that Dave & I proposed last week
* added a draft problem statement based on the charter and some text from the Information Model draft that we felt was more relevant to the SACM problem overall than to the information model problem
* re-ordered the interfaces based on feedback Friday
* misc copy-editing and small content updates
* added a few TODO notes reflecting action items from previous F2F and interim discussions

I'd love to hear any feedback both on whether these changes (to the diagrams, especially) accurately reflect our discussion Friday morning, and on how the draft is shaping up overall!

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, November 19, 2014 4:23 PM
To: [email-masked]
Cc: [email-masked]
Subject: [sacm] I-D Action: draft-ietf-sacm-architecture-01.txt

Abstract:

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 19 Nov 2014 22:21:54 +0000

I like the changes to the diagrams. I find they better reflect the current level of conceptual understanding based on WG discussions.

I do have some concern about the section 5 text on data stores which was called "repositories" in the last draft. I like the new term better as this syncs better with the same term used in the use cases.

This text defines a data store as both a Producer and Consumer. This I agree with.

It then goes on to say "these repositories interface directly to a Provider or Consumer (and Guidance) but the interfaces used to interact between them is outside the scope of SACM." This last statement is in conflict with the SACM charter which states we will define "a set of standards for interacting with repositories of content related to assessment of endpoint posture." Based on this, the interfaces that we use to interact with data stores is in scope and I would argue is the same interfaces that any Producer and Consumer would use to communicate (i.e., interfaces B and C). Interacting with human creators of Guidance, aside from a store operation, is probably the portion that is not in scope.

Am I misunderstanding something?

Thanks,
Dave

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Lorenzin, Lisa
Sent: Wednesday, November 19, 2014 4:40 PM
To: [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-architecture-01.txt

Hi folks,

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, November 19, 2014 4:23 PM
To: [email-masked]
Cc: [email-masked]
Subject: [sacm] I-D Action: draft-ietf-sacm-architecture-01.txt

Abstract:

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.