Re: [sacm] [sacmwg/draft-ietf-sacm-information-model] Section 6: No software, no hardware...no endpoint? (#80)

cliffordk <notifications@github.com> Tue, 20 June 2017 18:21 UTC

Date: Tue, 20 Jun 2017 11:21:30 -0700
From: cliffordk <notifications@github.com>
Reply-To: sacmwg/draft-ietf-sacm-information-model <reply+00a6c4d1c410686cec064552fa6109ac3b88af4f29cfbded92cf00000001156129aa92a169ce0e24668d@reply.github.com>
To: sacmwg/draft-ietf-sacm-information-model <draft-ietf-sacm-information-model@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <sacmwg/draft-ietf-sacm-information-model/issues/80/309844991@github.com>
In-Reply-To: <sacmwg/draft-ietf-sacm-information-model/issues/80@github.com>
References: <sacmwg/draft-ietf-sacm-information-model/issues/80@github.com>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--==_mimepart_594967aa66c98_22c043fd61c7bfc3c93350"; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/sacm/6EBbnvc9ARMqrs6gEK4r2dNRme8>
Subject: Re: [sacm] [sacmwg/draft-ietf-sacm-information-model] Section 6: No software, no hardware...no endpoint? (#80)

Hello, Adam.

It’s a fair question.

Not every hardware or software component will have been observed by a SACM sensor.

The paragraph says that an endpoint might have no hardware or software components known to SACM sensors. That’s not quite the same as what you said, Adam.

SACM sensors could know about an endpoint because they see traffic to and from its MAC address. SACM sensors might not know the components of the endpoint at all.

I think it’s useful to model an endpoint even if its components are wholly unknown. Other sensors could respond by probing to learn more about the endpoint, for example.

Best,
                                                Cliff

From: adammontville <notifications@github.com>
Reply-To: sacmwg/draft-ietf-sacm-information-model <reply@reply.github.com>
Date: Tuesday, June 20, 2017 at 12:12 PM
To: sacmwg/draft-ietf-sacm-information-model <draft-ietf-sacm-information-model@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Subject: [sacmwg/draft-ietf-sacm-information-model] Section 6: No software, no hardware...no endpoint? (#80)


The paragraph above figure 15 in section 6 (and figure 15 as well) describes an endpoint as having zero or more hardware components and zero or more software components, where each may have zero or more running instances.

...the make up of an Endpoint asset which contains zero or more hardware components and zero or more software components each of which may have zero or more instances running...

This feels incorrect, because it defines an endpoint as being capable of having neither hardware nor software, but (as mentioned elsewhere in the draft) is network addressable. Is it possible to have an endpoint without hardware and without software? Even if academically so, what place does it have in our information model?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub<https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/80>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AMcywqOQaHwmkdtnU8vAeyCMqZCb02aDks5sF-9ugaJpZM4N_0ew>.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/80#issuecomment-309844991

[sacm] [sacmwg/draft-ietf-sacm-information-model]… adammontville
Re: [sacm] [sacmwg/draft-ietf-sacm-information-mo… cliffordk
Re: [sacm] [sacmwg/draft-ietf-sacm-information-mo… adammontville