Re: [Panic] Scope Draft is Available

"Panos Kampanakis (pkampana)" <> Thu, 18 May 2017 16:36 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 25CD0129B95 for <>; Thu, 18 May 2017 09:36:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -14.522
X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id q-3aM1grGAhl for <>; Thu, 18 May 2017 09:36:28 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id D46EF129BA1 for <>; Thu, 18 May 2017 09:30:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=4358; q=dns/txt; s=iport; t=1495125008; x=1496334608; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=M50A1gIcod0NA0iCLiiJrBms6azr69y8LLjzaAlzTpM=; b=Q5MfRqRNDAMh0Na/H9Lhd7PJ2xjMHZ1I8RHdki9t/8X8HqdWllSlixBt W4rqGaazowF0c5xF4YOrmtR5PIlAg1uy4+3SVkvKIbE0XzNMdX3LLdCOP fZnXEc04TmMf+4qYbXGD1j8fIoulNzo42xyrwhiuiDu4IkGAuEw1RUlR0 c=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="5.38,359,1491264000"; d="scan'208";a="236657664"
Received: from ([]) by with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 May 2017 16:30:06 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id v4IGU6iw003058 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 18 May 2017 16:30:06 GMT
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 18 May 2017 11:30:05 -0500
Received: from ([]) by ([]) with mapi id 15.00.1210.000; Thu, 18 May 2017 11:30:05 -0500
From: "Panos Kampanakis (pkampana)" <>
To: "Waltermire, David A. (Fed)" <>, "" <>
Thread-Topic: Scope Draft is Available
Thread-Index: AdLNjFoi4UJSdMycRuOkrf0darmESQBj41DwADKpxpAAAE3vkA==
Date: Thu, 18 May 2017 16:30:05 +0000
Message-ID: <>
References: <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [Panic] Scope Draft is Available
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Posture Assessment Through Network Information Collection \(panic\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 18 May 2017 16:36:32 -0000

ACK. Below some proposed text: 

For the Security Considerations Section: 
   Further discussion here will address the threat introduced to the network elements by the posture information collection. There should be protections implemented to prevent the element from being vulnerable to DoS attacks by frequent polling or pushing of posture data. 

For the Introduction Section: 
   ...automation. PANIC aims to reuse available standards for posture assessment where possible. It will avoid redefining info exchange technologies for usecases that have already been defined. 

For the Introduction Section: 
   ...manage those 
   endpoints. Endpoints / Elements include hardware, software of virtual network infrastructure devices. 

hardware, software or virtual (NFV fails in this 
> category)

-----Original Message-----
From: Waltermire, David A. (Fed) [] 
Sent: Thursday, May 18, 2017 10:59 AM
To: Panos Kampanakis (pkampana) <>om>;
Subject: RE: Scope Draft is Available


Thank you for providing feedback on the PANIC scope draft.

Comments are inline below.

> -----Original Message-----
> From: Panos Kampanakis (pkampana) []
> Sent: Thursday, May 18, 2017 10:37 AM
> To: Waltermire, David A. (Fed) <>ov>; 
> Subject: RE: Scope Draft is Available
> Hi David,
> The document is clear.
> One semantic objection I have is about the use of the word endpoint. I 
> believe the term is commonly used for user machines (laptops, cells, 
> tablets) . Network element or element is a little clearer.

I don't have a dog in this fight. I am happy to go either way (e.g., endpoint, network element) if there is a preference in the group for one term or the other. I'd like to hear other opinions on this.

> A susggestion: The security section could mention the importance of 
> not introducing security concerns with the posture info collection. 
> For example a device should not be DoSable by too many polls, or it 
> should not push often enough that would introduce performance concerns etc.

I think this is a good idea. Do you have some text in mind to drop in?

> I think it will also be beneficial to be explicit about the types of 
> network elements. In the broad technologies that exist today, these 
> elements could be hardware, software or virtual (NFV fails in this 
> category). All of those should be in scope for this work.

All of these are in scope in my view.

> Side comment: I would like this standardization effort to try to reuse 
> data formats and transports wherever possible and not come up with new 
> posture information descriptions. I think this is a common goal that 
> SACM has as well.

I share this goal as well. Should we document this in the draft?

> Thanks,
> Panos


> -----Original Message-----
> From: Panic [] On Behalf Of Waltermire, 
> David A. (Fed)
> Sent: Monday, May 15, 2017 11:03 AM
> To:
> Subject: [Panic] Scope Draft is Available
> Welcome to the posture assessment through network information 
> collection
> (PANIC) email list. At the side meeting on March 29th, we started 
> discussing the problem of how to measure the health of network 
> devices. We discussed the need to collect posture information from 
> network devices to support asset, software, vulnerability, and 
> configuration management use cases. We were asked by the group to 
> share a more detailed description of the intended scope for the PANIC 
> effort. The follow draft is an attempt to do
> so:
> We would appreciate review of and comments on this draft. At this 
> point, we want to know if the this scope clearly defines the problem to be solved.
> Please let us know if you have any questions or concerns, or if you 
> think the scope draft is adequate.
> Regards,
> David Waltermire
> _______________________________________________
> Panic mailing list