Re: [sacm] Warren Kumari's Yes on draft-ietf-sacm-requirements-16: (with COMMENT)

["Nancy Cam-Winget (ncamwing)" <[e-mail]>]

Thanks for the review and comments.  Please see further comments below:

On 6/21/17, 9:32 AM, "Warren Kumari" <[e-mail]> wrote:

    Warren Kumari has entered the following ballot position for
    draft-ietf-sacm-requirements-16: Yes
    
    When responding, please keep the subject line intact and reply to all
    email addresses included in the To and CC lines. (Feel free to cut this
    introductory paragraph, however.)
    
    
    Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
    for more information about IESG DISCUSS and COMMENT positions.
    
    
    The document, along with other ballot positions, can be found here:
    https://datatracker.ietf.org/doc/draft-ietf-sacm-requirements/
    
    
    
    ----------------------------------------------------------------------
    COMMENT:
    ----------------------------------------------------------------------
    
    I spent a while trying to figure out how to ballot on this - I personally see
    value in requirements, use-cases and similar (informational) documents - they
    help newcomers to the technology understand how and why it is shaped as it is.
    This document is also (kind of) mentioned in the charter ("A document or
    documents describing the SACM Architecture. This will include protocol
    requirements and their associated use cases as well as a description ..." , and
    so I've decided on Yes
    
    However, there are still some comments / nits which should be addressed,
    including:
    
    Abstract:
    "The requirements and scope are based on the agreed upon use cases." -- what
    use cases / agreed upon by whom? (Missing ref).
[NCW] The use cases are now in RFC 7632 and its reference has been added.
    
    1. Introduction
    "Today’s environment of rapidly-evolving security threats highlights the need
    to automate the sharing of security information (such as posture information)
    while protecting user information as well as the systems that store, process,
    and transmit this information." - "... user information as well as the systems"
    -> "user information and the systems" ? Not sure if this is better....
[NCW] Yes, it helps and I’ve made the change in the next revision.
    
    2.  Requirements
    I got somewhat lost in "A SACM transport protocol is one that runs on top of L3
    protocols such as TCP/IP or L4 protocols such as HTTP, carries operations
    (requests / responses), and moves data." - perhaps "A SACM transport protocol
    is one that runs on top of L3 protocols (such as TCP/IP) or L4 protocols (such
    as HTTP), carries operations (requests / responses), and moves data."
[NCW] I’ve change L3 and L4 to be “transport layer” and “Internet layer” as suggested by Carsten.
    
    3: "With the information model defining assets and attributes to facilitate the
    guidance, collection, and assessment of posture, these are some of the tasks
    that should be considered:" - the "With" and "these" feel unrelated. I'm not
    really sure how they are supposed to tie together, so I cannot suggest text.
[NCW] I’ve changed “these are some of the tasks that should be considered” to read
“tasks that should be considered include”.  Hopefully it ties them as tasks to facilitate the 
workflow for “collection”, “guidance” etc…

    
    G-001
    "2.  The query language MUST allow for general inquiries, as well as expression
    of specific attributes or relationships between attributes to follow; the
    retrieval of specific information ..." -- I don't really understand the "to
    follow"; can it be struck?
[NCW] Yes, thanks for catching it….
    
    G-002
    "Interoperability: The data models, protocols, and transports  must be
    specified with enough details to ensure interoperability." -- I really don't
    understand the point of saying this - are you expecting that if you *didn't*
    say this that people would intentionally create models without enough detail?
    Is this just a "motherhood and apple pie" statement?
[NCW] Yes!  There were a couple of proposals that didn’t provide enough specificity
so the WG asked for this requirement to be included.
    
     G-006
    "Mechanisms for this protection are unspecified but should include industry
    best practices such as encrypted storage, encrypted transports, data checksums,
    etc. " -- the list of best practices seems harmful;  if you provide a list
    people will implicitly assume it is exhaustive, and industry best practices
    change over time. Also, what is a "data checksum"? I'm assuming you mean
    something "cryptographic checksums" or "secure hash" - a data checksum implies
    something like a simple CRC. I'd suggest just dropping the "such as..." list.
[NCW] Done.
    
    IM-004
    "Data Model Identification: The information model MUST provide a means to
    uniquely identify each data model uniquely." - you really really want this to
    be unique, don't you :-P
[NCW] LoL….2nd uniquely is removed
    
    5.2.  Privacy Considerations
    "In addition to identity and SACM capabilities information disclosure, the use
    of time stamps or other attributes that can be used as identifiers especially
    as they are coupled with an identity can be further used to determine a target
    endpoint or user’s behavioral patterns." -- this sentence could use some work.
    I agree with what it is trying to say, but it is long and confusing. Perhaps:
    "In addition to identity and SACM capabilities information disclosure, the use
    of time stamps (or other attributes that can be used as identifiers) could be
    further used to determine a target endpoint or user’s behavioral patterns." --
    I *think* that that maintains the meaning, but is clearer.
[NCW] Yes, thanks for the improvement.
    
    "Data confidentiality can provide some level of privacy but may fall short
    where unecessary data is still transmitted." - "unnecessary" (typo)
[NCW] Fixed.