[sacm] Proposed additions to problem statement of SACM information model I-D

"Kahn, Clifford" <cliffordk@pulsesecure.net> Tue, 14 October 2014 02:59 UTC

From: "Kahn, Clifford" <cliffordk@pulsesecure.net>
To: "sacm@ietf.org" <sacm@ietf.org>
Thread-Topic: Proposed additions to problem statement of SACM information model I-D
Thread-Index: Ac/nWnsYETrfzYURRCqvCQxuINbvLg==
Date: Tue, 14 Oct 2014 02:59:29 +0000
Message-ID: <fc3eda38566c4a0c995486d90261b89b@BN1PR06MB200.namprd06.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/sacm/KAYfYewzS3hENw2naih0tGQIM78
Subject: [sacm] Proposed additions to problem statement of SACM information model I-D
Precedence: list

The following additions motivate the core concept of the "endpoint attribute assertion".

2.2 Referring to an Endpoint

How to refer to an endpoint is problematic. Ideally, an endpoint would have a unique identifier. These identifiers would have a one-to-one relationship with endpoints. Every observation of an endpoint, or inference about an endpoint would be labeled with its identifier.

However:
- An external posture attribute collector typically cannot observe the unique identifier directly. An external posture attribute collector should be able to report exactly what it has observed, unembellished. It should not have to *infer* which endpoint it has observed; that inference should be leavable to other SACM components. So, SACM cannot require that every observation include the unique endpoint identifier.

- Internal posture attribute collectors are not present on all endpoints. They are not present on "dumb" devices such as Internet of Things (IoT) devices, or on Bring Your Own Device (BYOD) devices. In these cases, *no* observers have direct access to the unique endpoint identifier.

- An endpoint identifier is generally subject to cloning, when a system image is cloned. Then it is no longer unique.

- Suppose the endpoint identifier is highly clone resistant -- such a unique certificate within a trusted platform module (TPM). Even so, it is possible to replace all of the software -- for example, changing a Windows machine to a Linux machine. Is it still the same endpoint? For SACM purposes, it isn't really the same endpoint.

So SACM components must be able to put disparate observations together and form a picture of an endpoint -- somewhat like a detective. The SACM information model must facilitate this.

2.3 Dealing with Uncertainty

With many information models, the information is considered certain. So it is OK to blur the difference between the representation and the thing represented.

In SACM, information is not certain. Attackers may develop countermeasures to fool some SACM components. Attackers may compromise some SACM components.

So the model must let SACM components and humans reason with uncertainty. Therea are no facts, only assertions.

SACM components must be able to cross check observations and inferences against each other. They should be able to give weight if an observation or inference is corroborated by more than one method.

SACM components must be able to consider the reputation of the observer or inferer. That reputation should account for the method of observing or inferring, the implementer of the SACM component that made the observation or inference, and the compliance status of the endpoint on which the observation or inference was made. For example, if some observers are found to be vulnerable to a Day 1 exploit, observations from those observers deserve less weight.

Clifford Kahn
Principal Engineer/Technical Lead

[sacm] Proposed additions to problem statement of… Kahn, Clifford