Subject: Re: [sacm] [draft-ietf-sacm-terminology] Definition of "Asset" (#1)

From: Jim Schaad <[email-masked]>
Date: Thu, 24 Sep 2015 12:57:07 -0700

I agree that ownership would be a good clarify.

I also wanted to include software packages in the list of asset types.  I was not sure that I thought that guidance was an asset.  Can you clarify why it should be thought of as an asset?

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/1#issuecomment-143032495

---

From: Danny Haynes <[email-masked]>
Date: Fri, 25 Sep 2015 08:01:26 -0700

Just to clarify, when you say "software package", are referring essentially to software before it is installed (i.e. installation media) on the endpoint and becomes a "software component"?

Regarding guidance as an asset, here are some of my thoughts. 

(1)	An asset is "a system resource that is (a) required to be protected by an information system's security policy, (b) intended to be protected by a countermeasure, or (c) required for a system's mission."  I think guidance can satisfy this from a couple perspectives.  First, from a vendor that publishes guidance (their intellectual property) to its customers.  A vendor will want to protect this guidance from being maliciously altered or otherwise corrupted as providing this content to its customers will not be good for business.  Second, from an end-user organization perspective, guidance can be very sensitive and thus required to be protected as it can provide a lot of information that (if in the hands of an attacker) could really hurt the organization.  Think about collection and evaluation guidance which could provide and attacker with information such as the endpoints that are on the network, what software they are running, what kind of security controls they are using and how 
 they are set, etc.

(2)	A system resource is "(I) Data contained in an information system; or a service provided by a system; or a system capacity, such as processing power or communication bandwidth; or an item of system equipment (i.e., hardware, firmware, software, or documentation); or a facility that houses system operations and equipment. (See: system component.)".  I don't think this definition excludes guidance which could probably be classified under data or maybe even system equipment (i.e. machine readable assessment documentation).

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/1#issuecomment-143245997

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 25 Sep 2015 11:09:23 -0400

Hello,

The RFC4949 definition supports information being an asset and this is
common for asset definitions.  Guidance is a type of information that one
might want to protect, so it logically follows.

   $ asset
      (I) A system resource that is (a) required to be protected by an
      information system's security policy, (b) intended to be protected
      by a countermeasure, or (c) required for a system's mission.

I am hoping this can be wrapped up quickly as the discussion on this term
has been going on for a while now.

Thank you,
Kathleen

On Fri, Sep 25, 2015 at 11:01 AM, Danny Haynes <[email-masked]>
wrote:

> Just to clarify, when you say "software package", are referring
> essentially to software before it is installed (i.e. installation media) on
> the endpoint and becomes a "software component"?
>
> (1) An asset is "a system resource that is (a) required to be protected by
> an information system's security policy, (b) intended to be protected by a
> countermeasure, or (c) required for a system's mission." I think guidance
> can satisfy this from a couple perspectives. First, from a vendor that
> publishes guidance (their intellectual property) to its customers. A vendor
> will want to protect this guidance from being maliciously altered or
> otherwise corrupted as providing this content to its customers will not be
> good for business. Second, from an end-user organization perspective,
> guidance can be very sensitive and thus required to be protected as it can
> provide a lot of information that (if in the hands of an attacker) could
> really hurt the organization. Think about collection and evaluation
> guidance which could provide and attacker with information such as the
> endpoints that are on the network, what software they are running, what
> kind of security controls they are using and h ow they are set, etc.
>
> (2) A system resource is "(I) Data contained in an information system; or
> a service provided by a system; or a system capacity, such as processing
> power or communication bandwidth; or an item of system equipment (i.e.,
> hardware, firmware, software, or documentation); or a facility that houses
> system operations and equipment. (See: system component.)". I don't think
> this definition excludes guidance which could probably be classified under
> data or maybe even system equipment (i.e. machine readable assessment
> documentation).
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/1#issuecomment-143245997>
> .
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>
>

-- 

Best regards,
Kathleen