Re: [Panic] Scope Draft is Available

"Panos Kampanakis (pkampana)" <> Thu, 18 May 2017 14:42 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A104F129B84 for <>; Thu, 18 May 2017 07:42:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -14.522
X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id KOL5zNUZPrTJ for <>; Thu, 18 May 2017 07:42:26 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 642E5129B8C for <>; Thu, 18 May 2017 07:37:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=2326; q=dns/txt; s=iport; t=1495118230; x=1496327830; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=tXgL9o3/vBbyhynFpbx12kyYTgtW8x89dsNOY/c97xc=; b=VHnyqkFd11vDikTP7yKGqoMhN/47QHU8eEFDqzc1Y+Bh3ThTSPpZMoaB cu5dS1StkJE2aQnAiNMNOxFilWe6Bb73HtO5WO0Bi3+wMxq3yeO1aaGP/ TAHJ/YdJJWiT9ceePRPmFBRpxWwe0cIKeXNmT7UACwrMfPn+m12GoEsHU s=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="5.38,359,1491264000"; d="scan'208";a="236604264"
Received: from ([]) by with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 May 2017 14:37:09 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id v4IEb9Rx004309 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 18 May 2017 14:37:09 GMT
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 18 May 2017 09:37:08 -0500
Received: from ([]) by ([]) with mapi id 15.00.1210.000; Thu, 18 May 2017 09:37:08 -0500
From: "Panos Kampanakis (pkampana)" <>
To: "Waltermire, David A. (Fed)" <>, "" <>
Thread-Topic: Scope Draft is Available
Thread-Index: AdLNjFoi4UJSdMycRuOkrf0darmESQBj41Dw
Date: Thu, 18 May 2017 14:37:08 +0000
Message-ID: <>
References: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [Panic] Scope Draft is Available
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Posture Assessment Through Network Information Collection \(panic\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 18 May 2017 14:42:28 -0000

Hi David,

The document is clear.

One semantic objection I have is about the use of the word endpoint. I believe the term is commonly used for user machines (laptops, cells, tablets) . Network element or element is a little clearer. 

A susggestion: The security section could mention the importance of not introducing security concerns with the posture info collection. For example a device should not be DoSable by too many polls, or it should not push often enough that would introduce performance concerns etc. 

I think it will also be beneficial to be explicit about the types of network elements. In the broad technologies that exist today, these elements could be hardware, software or virtual (NFV fails in this category). All of those should be in scope for this work.

Side comment: I would like this standardization effort to try to reuse data formats and transports wherever possible and not come up with new posture information descriptions. I think this is a common goal that SACM has as well.


-----Original Message-----
From: Panic [] On Behalf Of Waltermire, David A. (Fed)
Sent: Monday, May 15, 2017 11:03 AM
Subject: [Panic] Scope Draft is Available

Welcome to the posture assessment through network information collection (PANIC) email list. At the side meeting on March 29th, we started discussing the problem of how to measure the health of network devices. We discussed the need to collect posture information from network devices to support asset, software, vulnerability, and configuration management use cases. We were asked by the group to share a more detailed description of the intended scope for the PANIC effort. The follow draft is an attempt to do so:

We would appreciate review of and comments on this draft. At this point, we want to know if the this scope clearly defines the problem to be solved. Please let us know if you have any questions or concerns, or if you think the scope draft is adequate.

David Waltermire

Panic mailing list