Re: [sacm] WGLC for draft-ietf-sacm-nea-swima-patnc

["Nancy Cam-Winget (ncamwing)" <[e-mail]>]

Hi,

Not being familiar with SWIDs and trying to get thru this draft,  I will provide initial comments though I’m still only on Section 3.

My general read of this was that it would be a SWIDs mapping to either a particular data model to adhere to SACM and/or that it would use the NEA data model and transfer using PA-TNC and PB-TNC.  Is that correct?  I do not get that impression from Section 3, so am somewhat confused.

Here are some comments thus far:
If indeed the draft is about extending the PA-TNC model to include SWIDs…This can limit the scalability and deployment use cases; per section 2.1.3 of RFC 7632, as it states there is desire to “collect a set of attribute values related to one or more endpoints”.

-	As there are no references to the TNC standards (and those have been absorbed in NEA),
I suggest to remove the last paragraph and Table 1 of Section 1.1

Section 1.1
“The attributes defined in this document are used to
   communicate software inventory evidence, collected from a range of
   possible sources, from the posture collector on the endpoint to the
   posture validator on a NEA Server using the PA-TNC interface, as
   shown in Figure 1 below.”
-	“Posture collector on the endpoint”,  
why does the collector need to be on an endpoint?  

Section 2, specifically 2.1.1 and 2.1.2 If the definition is to define a set of PA-TNC attributes; they are meant to be carried thru the NEA model; as such the recipient MUST be a NEA Server or at minimum a Posture Validator as that is the component that can accept NEA’s Posture Attributes.  I’m not sure these 2 sections are needed as they have to map to the NEA architecture which is described in 2.1.3

Section 2.2: is this section necessary?  There are many more use cases not supported, so would opt to remove this section.

Section 2.3: There must be normative language to make these requirements.  Also, it would be best suited to have this section also set in the context of the SACM requirements and reference the requirements enumerated in the soon to be published https://datatracker.ietf.org/doc/draft-ietf-sacm-requirements/ draft

Section 2.5: What does it mean to “provide reliable delivery”?  Does this imply TCP vs UDP? 

Section 3.2 The beginning of the draft and title infers that this draft is a mapping for NEA, which does define its own data model…so how can these map to “an open set of data models”?

Editorial

Section: Introduction
Awkward sentence: “When reported endpoint
   software installation inventory lists, shortened to "software
   inventories" for the remainder of this document, contain patch level
   data for identified software, further comparison to vulnerability or
   threat alerts can be used to determine an endpoint's exposure to
   attack. “

If I understand the intent, I suggest: “Endpoint software installation 
inventory lists (hereinafter “software inventories”) 
can further be used to determine an endpoint’s 
exposure to attack based on comparison to vulnerability or threat alerts against
identified software’s patch level data.”

Section 1.3 “Software Identifier” has a first reference to SWIMA that should be referenced first;
e.e. Software Inventory Message Attributes (SWIMA). 


More to come soon,
	Nancy

On 7/28/17, 7:40 AM, "sacm on behalf of Karen O'Donoghue" <[e-mail] on behalf of [e-mail]> wrote:

    Folks,
    
    This begins a 3 week working group last call (WGLC) for the following document: 
    
    Software Inventory Message and Attributes (SWIMA) for PA-TNC
    https://datatracker.ietf.org/doc/draft-ietf-sacm-nea-swima-patnc/
    
    We have chosen to do a 3 week WGLC to account for post IETF recovery and August vacations. 
    
    Please review the referenced document and send any comments to the mailing list including your assessment of whether this document is mature enough to proceed to the IESG. Please note that these messages of support for progression to the mailing list will be used to determine WG consensus to proceed. 
    
    Please send all comments in by Friday 18 August 2017.  
    
    Thank you!
    Karen and Adam