Re: [sacm] Components for Vulnerability Assessment

Hi Henk,

The reasoning behind my comment was that in the IETF 98 notes (https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00) it says:

---
Per Slide 7:
Q: (Adam Montville): Is the vulnerability assessor talk to the repository or talking directly to the collector?
A: (Jessica Fitzgerald-McKay): I could see an implementer combining the collector and end-point repository into one.  If we're treating them as functional components I'm not sure we need to be that specific.
A: (Dave Waltermire): We want this architecture to be de-composable.  If we treat the end-point repository as a proxy, we might be making things too complicated. It might be simpler to treat the end-point repository as a data store.
A: (Adam Montville): Agreed.

Q: (Dave Waltermire) Are there any concerns with separating the end-point repository and the collector being the component responsible for collection?
A: <no response>

Comment: (Adam Montville): The "results repository" will now go into the "end-point repository.
---

Given that, I thought there was some consensus around making that change.

Thanks,

Danny

> -----Original Message-----
> From: Henk Birkholz [mailto:henk.birkholz@sit.fraunhofer.de]
> Sent: Tuesday, April 18, 2017 10:49 AM
> To: Haynes, Dan <dhaynes@mitre.org>; Adam Montville
> <adam.w.montville@gmail.com>; sacm@ietf.org
> Subject: Re: [sacm] Components for Vulnerability Assessment
> 
> Hello Danny,
> 
> the "Assessment Results Repository" and "Endpoint Repository" are two
> different components with different functions. The "Endpoint Repository"
> of course is the provider for the consumer that is the "Assessment Results
> Repository".
> 
> Most certainly, both components can be running on the same endpoint or be
> composed in a single service that merges both components. I suppose that is
> what you meant?
> 
> For the sake of show-casing how the architecture is working. I would
> recommend to start with each SACM component instantiated as a separate
> software component. Despite the fact that it looks simpler to just add the
> "Assessment Result" to the ""Endpoint Characterization Records"
> retained in an "Endpoint Repository".
> 
> Ultimately, people will want to use existing software and Asset/Inventory
> Management Software is a big candidate to provide the functions of an
> "Endpoint Repository". In consequence, I would keep these components
> instantiated separately in the first iteration.
> 
> What does the group think?
> 
> Viele Grüße,
> 
> Henk
> 
> On 04/18/2017 04:21 PM, Haynes, Dan wrote:
> > Hi Adam,
> >
> >
> >
> > I think this is a good list for me, but, should the assessment results
> > repository be merged into the endpoint repository?
> >
> > Thanks,
> >
> > Danny
> >
> >
> >
> > *From:*sacm [mailto:sacm-bounces@ietf.org] *On Behalf Of *Adam
> > Montville
> > *Sent:* Tuesday, April 18, 2017 9:04 AM
> > *To:* sacm@ietf.org
> > *Subject:* [sacm] Components for Vulnerability Assessment
> >
> >
> >
> > Hi All:
> >
> >
> >
> > We've got a list of components we think we care about for our
> > vulnerability assessment scenario (focusing on the narrowest "ideal
> > case" through the scenario for the time being.
> >
> >
> >
> > These are:
> >
> >
> >
> > * Vulnerability Detection Data Repository
> >
> > * Vulnerability Assessor
> >
> > * Endpoint Repository
> >
> > * Collector
> >
> > * Target Endpoint
> >
> > * Assessment Results Repository
> >
> >
> >
> > For reference, see our wiki [1] and/or the slides from IETF 98 [2]
> > and/or the minutes from IETF 98 [3]
> >
> >
> >
> > Question to the WG: Is this an appropriate initial list of components?
> >
> >
> >
> > Please opine within the next few days (say by end of your day on
> > Thursday, wherever you may be), so that we can generate some momentum
> > on this effort.
> >
> >
> >
> > Kind regards,
> >
> >
> >
> > Adam
> >
> >
> >
> > [1]
> > https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenar
> > io
> >
> > [2]
> > https://www.ietf.org/proceedings/98/slides/slides-98-sacm-vulnerabilit
> > y-scenario-discussion-00.pdf
> >
> > [3] https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00.txt
> >
> >
> >
> >
> >
> >
> >
> > _______________________________________________
> > sacm mailing list
> > sacm@ietf.org
> > https://www.ietf.org/mailman/listinfo/sacm
> >