Re: [sacm] Working Group Last Call for draft-ietf-sacm-vuln-scenario

Hello,

a few comments and nits:

- Why is "Endpoint Vulnerability Assessment Capability" only a title of 
section 5 and not in the list of section 2 (or used anywhere else)?

- I would like to see a better differentiation between Endpoint, Target 
Endpoint and SACM component. Mostly the term Endpoint is used for all 
three purposes, I think.

- I would like to see a better mapping of the very general terms in 
section 2 to more specific terms that are aligned with SACM terminology. 
Some of that is already done throughout the Appendices, but is quite 
difficult to find and thereby to understand, I think.

Please have a look at a very naive, probably far from complete, and too 
wordy attempt of illustrating what I try to convey here:

Vulnerability description information: information about 
vulnerabilities, e.g. CVE
=> Vulnerability Description Information
=> Vulnerability Description Information Repository

Vulnerability detection data: guidance on how to detect a vulnerable 
software component on a target endpoint
=> Vulnerability Detection Guidance
=> Vulnerability Detection Guidance Repository

Endpoint management capability: tasks and functions that create and 
provide an updated list of target endpoints in a SACM domain
=> Target Endpoint Information
=> Target Endpoint Information Repository
=> Target Endpoint Discovery Task
=> Target Endpoint Discovery Results
=> Target Endpoint Collection Task (is called "Endpoint Data Collection" 
in B.1.)
=> Target Endpoint Collection Results

Vulnerability management capability: the task of detecting vulnerable 
software components on a target endpoint
=> Vulnerability Detection Task
=> Vulnerability Detection Results

Vulnerability assessment: the work-flow that produces evaluation results 
regarding target endpoints with vulnerable software components
=> Vulnerability Assessment
=> Vulnerability Assessment Results

Viele Grüße,

Henk

On 07/28/2016 04:20 PM, Adam Montville wrote:
> This message starts a Working Group Last Call for the Internet-Draft
> ‘SACM Vulnerability Assessment Scenario’
> — https://datatracker.ietf.org/doc/draft-ietf-sacm-vuln-scenario/.
>  Please send your comments, questions, and edit proposals to the WG mail
> list until August 5, 2016.  If you believe the document is ready to be
> submitted to the IESG for consideration as an Informational RFC, please
> send a short message stating so.
>
> Kind regards,
>
> Adam
>
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
>