Subject: [sacm] #4 (use-cases): use-cases-07 - 4 - need security & privacy considerations

From: "sacm issue tracker" <[email-masked]>
Date: Fri, 14 Nov 2014 02:03:36 -0000

#4: use-cases-07 - 4 - need security & privacy considerations

 From AD review -

 Security & Privacy considerations
 Are theses covered in the requirements and architecture draft?  If so,
 you'll need to add a pointer as that being the appropriate location.

 Access, collection, and storage of posture information has security
 implications that will need to be discussed.  The types of attacks that
 are possible with this data should be included.  Then, privacy risks will
 need to be discussed, especially if you have system owner and user
 information that can be accessed on end point assessments. If end point
 assessments are able to gather information on host behavior (described in
 a use case - what apps are on a system and *if history can be gathered to
 profile a user*), it will be really important to include this before it
 gets to the IESG review.

 A pointer to this in another draft is probably preferred since this is
 information and may be a better fit with in the draft with requirements.

 The privacy RFC to review to gather ideas on current concerns in this
 space is RFC6973.  It's a good and helpful read.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:
  [email-masked]          |  [email-masked]
     Type:  defect                   |     Status:  new
 Priority:  blocker                  |  Milestone:
Component:  use-cases                |    Version:
 Severity:  Waiting for Shepherd     |   Keywords:
  Writeup                            |
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/sacm/trac/ticket/4>
sacm <http://tools.ietf.org/sacm/>