[Rats] Use case document -05

[Kathleen Moriarty <[e-mail]>]

Hi Michael,

I just did a quick review and sent one nit separately before coming up with some more clarification questions/suggestions.

Nit in 5.1.4:

The
      infrastructure is in control of a single operator and is already trusted.

I think you meant “is in the control”.  

Otherwise, we are in trouble. :-)

Also, what is being validated?  The running and configured software from root of trust and/or the software from vendors as provided?

5.1.5
Would each system really do the assessments themselves?  Wouldn’t it be easier to have a relying party (management station/repository) of collected information from each administrative domain?  How do you scale the interactions in a highly complex data center scenario with virtualized systems that are also isolating tenants in container clusters for instance?

5.1.6 - my question above spills into this one.
Also note the typo of having medium in this one.

5.5 critical infrastructure 
Are you providing protection from malware by only allowing specific signers or specific attested code  or both forms of white listing?  Or something else?  I’m assuming both forms of white listing and it would be good to explain that if it’s the case.

Excellent work on this document!  I think we should formally adopt it.

Best regards,
Kathleen 



Sent from my mobile device