Subject: [sacm] Ben Campbell's No Objection on charter-ietf-sacm-02-00: (with COMMENT)

From: Ben Campbell <[email-masked]>
Date: Mon, 13 Nov 2017 00:33:39 -0800

Ben Campbell has entered the following ballot position for
charter-ietf-sacm-02-00: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-sacm/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Editorial Comments:

I find the charter a little hard to understand in places. This may be entirely
due to my lack of familiarity with the subject.

"At its core, posture assessment consists of five basic steps, which the working
group desires to fulfill in an innovative, automated manner capable of avoiding
ad hoc or scheduled assessments:"

I assume the workgroup wants to enable automation of those steps. The language
sounds like the workgroup intends to fulfill it's goals in an automated manner.

"A. Collection. The WG will define a standardized way to provide two types of
imperative guidance to collectors over varying collection mechanisms:"

I don't understand what is meant by "imperative guidance". Is that a term of
art? Is it different than "information"?

"When classified, a set of instructions (such as vulnerability description data,
YANG filter expressions, Windows Management Instrumentation classes, etc.) can
be brokered to the appropriate collectors using the control plane functions
defined by "C. Orchestration and Communication" (below)."

This is the first mention of classification. It would help to mention what sort
of classification is envisioned.

"Detecting and
classifying desired attributes beforehand may require orchestrating functions
that go beyond the set of capabilities a collector can provide, and will inform
the requirements and characteristics for "C. Orchestration and Communication"."

I don't understand the sentence.

"C. Orchestration and Communication. The working group will define a set of
control plane functions to enable the discovery and orchestration between
devices"

Discovery and orchestration of what?

Several of the "specific work items" seem like repetitions of the "lettered"
goals.

(Note that much of the language that I found confusing is repeated in the
"Specific work item" section.

---

From: Karen O'Donoghue <[email-masked]>
Date: Thu, 16 Nov 2017 09:50:01 +0000

Ben,

We have tried to clarify some of the language, and I have submitted an updated charter based on your comments… Below are a few of your specific suggestions addressed… 

Regards,
Karen

> On Nov 13, 2017, at 4:33 PM, Ben Campbell <[email-masked]> wrote:
> 

Clarified as… 
Posture assessment entails the following five steps which the working will create solutions to automate:  

> art? Is it different than "information”?

Imperative guidance is a specific term in the terminology draft; however, it doesn’t add any benefit
In the draft charter so we’ve removed it. 

> of classification is envisioned.

Rewritten as: 
A set of instructions (such as vulnerability description data, YANG filter expressions, Windows Management Instrumentation classes, etc.) can be brokered to the appropriate collectors using the control plane functions defined by "C. Orchestration and Communication" (below). 

> the requirements and characteristics for "C. Orchestration and Communication”."

Rewritten as: 
Element collection from different sources may require orchestrating functions that go beyond the set of capabilities a collector can provide.  This will inform the requirements and characteristics for "C. Orchestration and Communication". 

> Discovery and orchestration of what?

Rewritten as:
C. Orchestration and Communication. The working group will define a set of control plane functions to enable the orchestration between element collectors. These element collectors can then provide the requisite elements sought by posture collectors, posture evaluators, and data repositories.

> "Specific work item" section.

I understand the basic issue you have here. The original ask was the list of specific drafts needed (some already underway), but there is still some uncertainty about the full set of drafts that might be needed - thus the general works items.