Subject: [sacm] [draft-ietf-sacm-information-model] timestamp accuracy principle (#28)

From: Danny Haynes <[email-masked]>
Date: Fri, 25 Sep 2015 05:00:30 -0700

During the 09-04-2015 Endpoint ID Design Team meeting, there was discussion around the fact an enterprise will have different sensors.  Some will detect changes as soon as they occur whereas others will detect them during a periodic scan.  Furthermore, others will be detected on the endpoint and others will be observed off of the endpoint.  The main point is that depending on how sensors operate will depend on how accurate the timestamp associated with the change will be.  For example, if a sensor is only running once every 12 hours, the change probably happened at some point in time prior the scan.  Furthermore, it is then up to the administrator to determine if that accuracy is good enough for their purposes.  Similarly, you don’t know that an endpoint has a vulnerability until someone discovers that the vulnerability actually exists (e.g. a vulnerability researcher is able to exploit it).  With this in mind, the group was in agreement that we need to state this fact (and others we find) as a key principle of SACM in the Information Model before we discuss the constructs in the Information Model and how they are perceived.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/28