Subject: [sacm] Endpoint ID Design Team Notes: 2015-09-04

From: "Haynes, Dan" <[email-masked]>
Date: Fri, 4 Sep 2015 17:18:08 +0000

Hi Everyone,

Here are the notes from the Endpoint ID Design Team Meeting (EID-DT).

Attendees

*         Ron Colvin

*         Joe Wolfkiel

*         Henk Birkholz

*         Dave Waltermire

*         Lisa Lorenzin

*         Danny Haynes

Note Well

Agenda

*         Further discuss the triple example with updates

*         Discuss how it could be integrated into the Information Model

*         Next steps

Materials

*         Slides from meeting (see attached)

Notes

*         An update was provided on the triple example.  Henk is currently working to figure out how subject, predicate, object, and relationship can be described in generic terms so as not to imply a container, graph, or any other implementation.  This came out of the discussion at last week's meeting where there was agreement that we should abstract out these concepts and describe them in an inclusive manner.

*         There was agreement that the Information Model be prescriptive on content.  That is, describe the various constructs that we need, describe the relationships between those constructs, and then explain how they can be combined.

*         There was a question about how the group arrived at using triples.  It was explained how this was just a proposal that would serve as input into the broader working group and is not a final decision.  Furthermore, with this proposal and the Information Model in general, we are trying to build a vocabulary that solves SACM's goals.

*         It was also explained how there was a concern that triples would be able to handle provenance-related metadata (data origin, sensor, timestamp, etc.).  It was mentioned that this could be a result of the implementation.

*         A question was asked about how you graphically represent triples (e.g. with a UML diagram).  It was explained how you could use UML class diagrams, but, the IETF format makes it a bit difficult because while you can use images, you would also have to create the corresponding ASCII art.

*         Another question was asked as to whether or not we could consider the use of DMTF CIM, and if so, how to go about doing that.  It was explained that we could consider it and the way to do it is to propose it to the group on the list and help work on a solutions draft for it.  Of course, any IPR-related considerations must be addressed before it can be contributed to the group.

*         There was discussion around the fact an enterprise will have different sensors.  Some will detect changes as soon as they occur whereas others will detect them during a periodic scan.  Furthermore, others will be detected on the endpoint and others will be observed off of the endpoint.  The main point is that depending on how sensors operate will depend on how accurate the timestamp associated with the change will be.  For example, if a sensor is only running once every 12 hours, the change probably happened at some point in time prior the scan.  Furthermore, it is then up to the administrator to determine if that accuracy is good enough for their purposes.  Similarly, you don't know that an endpoint has a vulnerability until someone discovers that the vulnerability actually exists (e.g. a vulnerability researcher is able to exploit it).  With this in mind, the group was in agreement that we need to state this fact (and others we find) as a key principle of SACM in the Information Model before we discuss the constructs in the Information Model and how they are perceived.  A GitHub issue will be created for this item.

*         It was suggested that, in addition to adding an issue to GitHub, a message be sent to this list.  This is due to the fact the messages, from GitHub to the list, don't make it easy to follow the discussion and to address concerns that issues aren't being worked out on the list.  The group was in agreement about this.

*         It was also suggested that confidence is something that should be addressed prior to shifting focus from the core working group documents to solution drafts.

*         Next steps were discussed.  We need to continue to discuss the changes, but more importantly, propose the changes to the broader group to get their input.  The group was in agreement that we should work to get the changes in the Information Model by the virtual interim meeting on 9/24.

Action Items

*         Continue to update the example of using triples and annotate the example so it can be shared with the list. (Henk Birkholz)

*         Share links, on the list, to IETF documents that may demonstrate how we can represent triples in the SACM Information Model. (Dave Waltermire)

*         Provide a possible definition for "network interface" on the list.  (Henk Birkholz)

*         Review the diff between revisions 01 and 02 of the IM to determine what text, if any, is missing. (???)

*         Add a GitHub issue regarding the accuracy of timestamp data and raise with the list.  (Danny Haynes)

*         If positive consensus is reached, make the changes and include a sentence or two to describe what information goes in each new section.  Update on GitHub. (Danny Haynes)

Please let me know if I missed anything, got anything wrong, or if you have any questions.

Adam will post the recordings when he returns.

Have a great weekend.

Thanks,

Danny