[sacm] Initial comments on ECP draft

[Adam Montville <[e-mail]>]

Now that the ECP draft has been marked as adopted, I'd like to make some
comments.

The draft seems primarily concerned with endpoint software inventory rather
than collection of generic attribute state. The abstract doesn't limit the
draft to software inventory, but other (obvious) statements in the draft
certainly do. To me, this draft needs to more clearly articulate how other
categories of endpoint state can be collected (doesn't SWIMA handle the
software attributes a bit anyway)?

For example, see the first bullet in 4.2.3. (non use cases). It seems that,
given we have the SWIMA draft, that we should evolve ECP to be about the
framework for collection - we should entertain collection of other types of
posture information in this draft.

Additionally, the last bullet in 4.2.3 talks about a pub/sub repository
interface. I would like the group (perhaps as part of our IETF 100
hackathon efforts) to consider how XMPP grid may support this notion.

Please change the reference to SANS "20 Critical Security Controls" to the
current CIS Controls.

Finally, 5.2 mentions: "Any PC used in an Endpoint Compliance Profile
solution MUST be conformant with [IF-IMC]; an Internet-Draft, under
development, that is a subset of the TCG TNC Integrity Measurement
Collector interface [IF-IMC] and will be submitted in the near future."
Which Internet-Draft is being referenced? If not yet available, I'd like to
see this sooner rather than later, because it's going to be hard to fully
evaluate ECP otherwise. Also, does the same apply for IF-IMV?

Kind regards,

Adam