Subject: [sacm] AD review of Use Cases draft

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 5 Nov 2014 11:22:41 -0500

Hello,

The current version of the use cases draft is excellent, thanks for
all of your work on this.  I do have a few nits and also would like to
see a pointer to another draft for security and privacy
considerations.  Once this is ready, and the shepherd (Dan) gives the
okay, we can kick off last call.

Here is my writeup:

Section 2.1.3 & 2.1.4:

Nit: Shouldn't #3 just be:
"Scheduled or ad hoc collection task."

Section 2.2.8

Is this a placeholder that is meant to be removed?  If so, it should
get removed before IETF last call.

Security & Privacy considerations
Are theses covered in the requirements and architecture draft?  If so,
you'll need to add a pointer as that being the appropriate location.

Access, collection, and storage of posture information has security
implications that will need to be discussed.  The types of attacks
that are possible with this data should be included.  Then, privacy
risks will need to be discussed, especially if you have system owner
and user information that can be accessed on end point assessments.
If end point assessments are able to gather information on host
behavior (described in a use case - what apps are on a system and *if
history can be gathered to profile a user*), it will be really
important to include this before it gets to the IESG review.

A pointer to this in another draft is probably preferred since this is
information and may be a better fit with in the draft with
requirements.

The privacy RFC to review to gather ideas on current concerns in this
space is RFC6973.  It's a good and helpful read.

Thanks!

-- 

Best regards,
Kathleen

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 5 Nov 2014 18:55:27 +0000

Kathleen,

Your review and feedback is appreciated. All of your suggestions look reasonable to me. I am working on a list of edits for an 08 revision based on your feedback.

I think in general it is a good idea to reference Security & Privacy considerations defined in the requirements and architecture documents instead of speaking to them in this document. This would allow the discussion to be in the context of the larger set of requirements and the defined architecture.

If we do this, will that create a RFC publication timing dependency on the requirements and architecture drafts for finalizing this draft since the reference will be to a draft not a published RFC?

Thanks,
Dave

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
Sent: Wednesday, November 05, 2014 11:23 AM
To: [email-masked]
Subject: [sacm] AD review of Use Cases draft

Hello,

The current version of the use cases draft is excellent, thanks for all of your work on this.  I do have a few nits and also would like to see a pointer to another draft for security and privacy considerations.  Once this is ready, and the shepherd (Dan) gives the okay, we can kick off last call.

Here is my writeup:

Section 2.1.3 & 2.1.4:

Section 2.2.8

Is this a placeholder that is meant to be removed?  If so, it should get removed before IETF last call.

Security & Privacy considerations
Are theses covered in the requirements and architecture draft?  If so, you'll need to add a pointer as that being the appropriate location.

Access, collection, and storage of posture information has security implications that will need to be discussed.  The types of attacks that are possible with this data should be included.  Then, privacy risks will need to be discussed, especially if you have system owner and user information that can be accessed on end point assessments.
If end point assessments are able to gather information on host behavior (described in a use case - what apps are on a system and *if history can be gathered to profile a user*), it will be really important to include this before it gets to the IESG review.

A pointer to this in another draft is probably preferred since this is information and may be a better fit with in the draft with requirements.

The privacy RFC to review to gather ideas on current concerns in this space is RFC6973.  It's a good and helpful read.

Thanks!

-- 

Best regards,
Kathleen

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 5 Nov 2014 14:42:45 -0500

Sent from my iPhone

> On Nov 5, 2014, at 1:55 PM, "Waltermire, David A." <[email-masked]> wrote:
> 
> Kathleen,
> 

Great, thanks.
> If we do this, will that create a RFC publication timing dependency on the requirements and architecture drafts for finalizing this draft since the reference will be to a draft not a published RFC?

The use case draft is informative, do the reference can be informative.  That makes it ok to reference a draft that has not been published yet.

Thanks & safe travels!
Kathleen