Re: [Rats] Implementation report

[Kathleen Moriarty <[e-mail]>]

Thank you for your comments!

I'd also like to see next steps include the reporting of compliance to a
set of configuration requirements (e.g. Benchmark) by using the attestation
set draft model. I am hoping we have a revision of that draft ready for
Brisbane and need to touch base with the co-authors who have volunteered.

A couple of notes, I have moved on from CIS and do remain very interested
in the larger picture of attestation and its intersection with supply chain
management with SBOMs. I'm in process of developing a course aimed at
vendors that will be Georgetown accredited to help support the needs of
small and medium businesses using these standards in use cases aligned to
their needs. In terms of additional projects, it likely won't happen
through CIS, however I could assist in leading such efforts elsewhere as a
consultant. I won't be in Brisbane, but would appreciate a sync on
potential efforts and future direction as this work is all very promising.

Another note: last I spoke with John Schmidt, who implemented the project
under my guidance, he was working on another MS degree and available for an
internship or full time position. It might be helpful to this list as the
base knowledge required takes a bit to gain.

Best regards,
Kathleen

On Thu, Feb 22, 2024 at 1:54 PM Laffey, Tom (HPE Aruba) <[e-mail]>
wrote:

> Hi Yogesh,
>
> Regarding Hardware BOM, TCG has a specification under public review at
> https://trustedcomputinggroup.org/wp-content/uploads/TCG-Platform-Certificate-Profile-Version-2.0-Revision-38_2February24.pdf.
> Comments on the specification can be addressed to
> [e-mail].
>
> The earlier (v1.1) version of this specification is supported by a number
> of hardware manufacturers.
>
> Regards,
> Tom
>
>
>
> -----Original Message-----
> From: RATS <[e-mail]> On Behalf Of Yogesh Deshpande
> Sent: Wednesday, February 21, 2024 3:31 AM
> To: Henk Birkholz <[e-mail]>; Kathleen Moriarty <
> [e-mail]>; rats <[e-mail]>; John Schmidt <
> [e-mail]>; Sean Turner <[e-mail]>
> Cc: Allan Friedman <[e-mail]>
> Subject: Re: [Rats] Implementation report
>
> Hi Henk,
>
> What you mentioned below, is a perfect use case which is frequently been
> discussed across multiple groups.
> i.e. how remote attestation can assist getting access to deeper insight
> into authenticity of secure software supply chain.
>
> For this process to move forward, we not only need SBOM but also HBOM (
> https://www.cisa.gov/sites/default/files/2023-09/A Hardware Bill of
> Materials Framework for Supply Chain Risk Management (508).pdf )
>
> Hardware Profile is been discussed in SPDX community also, and linking
> various Bill of Materials can assist in visibility of overall end point
> security via remote attestation.
>
> I would be quite keen to promote this discussion during coming IETF
> (though attending remotely).
>
> Regards,
> Yogesh Deshpande
>
> -----Original Message-----
> From: RATS <[e-mail]> On Behalf Of Henk Birkholz
> Sent: Wednesday, February 21, 2024 11:11 AM
> To: Kathleen Moriarty <[e-mail]>; rats <
> [e-mail]>; John Schmidt <[e-mail]>; Sean Turner <
> [e-mail]>
> Cc: Allan Friedman <[e-mail]>
> Subject: Re: [Rats] Implementation report
>
> Hi Kathleen,
>
> thank you for the pointers! Will you be in Brisbane?
>
> Looking at your last link, I am wondering if there are plans for future
> projects. Say... remote attestation based authenticity assurance in the
> software supply chain chain: and I am thinking along the lines of
> "Trustworthy SBOMs", which would be scenario that would combine various
> building blocks and that is definitely still in demand of more standards
> consolidation.
>
> Because
> https://learn.cisecurity.org/built-in-security-scale-hardware-support
> cited https://www.cisa.gov/securebydesign , I am reeling Alan into this
> reply. So that he is aware that we could do something meaningful here :-)
>
>
> Viele Grüße,
>
> Henk
>
> On 13.02.24 15:58, Kathleen Moriarty wrote:
> > Greetings!
> >
> > Last year, I introduced my team to RATS work and pulled together a
> > project that was a lead in to the attestation sets draft, implementing
> > largely what's described in
> > https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/
> > <https://datatracker.ietf.org/doc/draft-ietf-rats-endorsements/ >
> >
> > It took some time to complete due to some hyperscaler environments not
> > having a TPM or access to it from the container orchestration platform
> > or virtual server host. Once we secured an environment where this was
> > possible, through use of the IMA libraries (created for this purpose
> > and previously proven by RedHat), positive results were demonstrated.
> > The objective was to test assurance to CIS Benchmarks as that was my
> > employer at the time. We hope you find this report useful.
> >
> > https://www.rsaconference.com/Library/blog/automated-assurance-on-a-pa
> > th-to-becoming-practical
> > <https://www.rsaconference.com/Library/blog/automated-assurance-on-a-p
> > ath-to-becoming-practical>
> >
> > This was done at the same time other team members were researching the
> > prevalence of TPMs and TEEs in infrastructure. The purpose of that
> > work was to signal that hardware support is increasingly available and
> > should be used to ease configuration management and posture assurance
> capabilities.
> >
> > https://www.cisecurity.org/insights/white-papers/built-in-security-at-
> > scale-through-hardware-support
> > <https://www.cisecurity.org/insights/white-papers/built-in-security-at
> > -scale-through-hardware-support>
> >
> > The timeline could include more data points, we included key points.
> >
> > I am copying John Schmidt who did the work. Sean Turner joined the
> > project in September and assisted with key management, application of
> > cryptography, and validation. Thank you both for your great work to
> > successfully implement this PoC!
> >
> > --
> >
> > Best regards,
> > Kathleen
> >
> > _______________________________________________
> > RATS mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/rats
>
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
>


-- 

Best regards,
Kathleen