[hackathon] Security Telemetry based on SACM Vulnerability Assessments and YANG Subscribed Notifications

Henk Birkholz <henk.birkholz@sit.fraunhofer.de> Mon, 16 October 2017 22:34 UTC

To: hackathon@ietf.org, SACM WG <sacm@ietf.org>, NETCONF WG <netconf@ietf.org>
CC: Adam Montville <adam.w.montville@gmail.com>, "Eric Voit (evoit)" <evoit@cisco.com>
From: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>
Message-ID: <5a81d677-1b58-fab9-a2af-1299c7f2cf42@sit.fraunhofer.de>
Date: Tue, 17 Oct 2017 00:34:35 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/hackathon/ttjVXxX_ZJPk9O3qBSsjEEWRWGY>
Subject: [hackathon] Security Telemetry based on SACM Vulnerability Assessments and YANG Subscribed Notifications
Precedence: list

Hi all,

we would like to announce a Hackathon project that is based on the 
output created by the SACM and NETCONF WG at the Hackathon in Prague @ 
the IETF 99 meeting. The project is focused on providing security 
posture assessments based on the collection of fresh and trustworthy 
device characteristics.

Viele Grüße,

Henk


Project Summary:

This Hackathon project is intended to provide a place for individuals 
interested in driving forward NETCONF WG Yang Push work in conjunction 
with SACM WG Continuous Monitoring work.

## Vulnerability Assessment

SACM has defined a vulnerability assessment (VA) scenario:

> https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario

This project intends to advance the VA prototype created during the IETF 
99 Hackathon meeting as well as extend the capabilities of collecting 
and assessing endpoint attributes (device characteristics) in a secure 
and reliable fashion.

##  Event Streams and Orchestration via YANG Push & YANG Subscribed 
Notifications

The output of the last combined Hackathon project was:

> https://github.com/netconf-wg/yang-push/blob/master/IETF99_SACM-YANG-Push_Hackathon-Minutes.pdf
> https://datatracker.ietf.org/doc/draft-birkholz-sacm-yang-content/

The corresponding goals in respect to YANG Push are to improve 
integration with the VA usage scenario and extend the implemented 
work-flow by introducing control-plane functions, such as orchestration, 
capability discovery, and target-endpoint discovery, as well as the 
appropriate distribution of imperative guidance for security posture 
collection (i.e. YANG filter expressions to SACM collectors).

Orchestration of control-plane functions as well as the secure 
distribution of security-related information is based on:

> https://datatracker.ietf.org/doc/draft-ietf-mile-xmpp-grid/


For more details see:

> https://github.com/sacmwg/vulnerability-scenario/tree/master/ietf_hackathon

Contributions to this project are orchestrated via:

> https://github.com/sacmwg/vulnerability-scenario/projects/2

Virtual Hackathon-Preparation meetings via WebEx are scheduled twice a week:

On Tuesday:> 
https://mailarchive.ietf.org/arch/msg/sacm/B4Uo1nbTvzhHuBpHONUxFCObkTk/?qid=364e90e0bff4f0df3ca2fa86c698b711
> https://ietf.webex.com/ietf/j.php?MTID=me634ee1548b0df8c75ba7036dc7f05f1
> Meeting Number: 644 210 539
> Meeting Password: N93Bh5Th

and on Thursday:> 
https://mailarchive.ietf.org/arch/msg/sacm/R_Lv5o3oZv0mqpGIEuqVu98BK8Y/?qid=364e90e0bff4f0df3ca2fa86c698b711> 
https://ietf.webex.com/ietf/j.php?MTID=m0f5ac7b5c453298a56841f613796f81c> 
Meeting Number: 648 256 352
> Meeting Password: Vx7fcdxD

Everybody interested in our combined effort is - of course - welcome to 
chime in!

[hackathon] Security Telemetry based on SACM Vuln… Henk Birkholz