Re: [sacm] Components for Vulnerability Assessment

Hi every one, 
I have joined this group recently and want to know more about the discussion topic. It looks like some architecture is being discussed in the thread. 

>From where should I get more information about this so that I can participate and contribute my thoughts as well. 

Thanks. 

Regards,
===============================================
Muhammad Nasir Mumtaz Bhutta, PhD
Assistant Professor,
Information Systems Dept
College of Computer Sciences and Information Technology
King Faisal University
Saudi Arabia 
Alahssa 31982 P.O. Box 400
Tel  + 966 (013) 589 9207
Fax + 966 (013) 589 9236

-----Original Message-----
From: sacm [mailto:sacm-bounces@ietf.org] On Behalf Of Haynes, Dan
Sent: Tuesday, April 18, 2017 5:55 PM
To: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>; Adam Montville <adam.w.montville@gmail.com>; sacm@ietf.org
Subject: Re: [sacm] Components for Vulnerability Assessment

Hi Henk,

The reasoning behind my comment was that in the IETF 98 notes (https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00) it says:

---
Per Slide 7:
Q: (Adam Montville): Is the vulnerability assessor talk to the repository or talking directly to the collector?
A: (Jessica Fitzgerald-McKay): I could see an implementer combining the collector and end-point repository into one.  If we're treating them as functional components I'm not sure we need to be that specific.
A: (Dave Waltermire): We want this architecture to be de-composable.  If we treat the end-point repository as a proxy, we might be making things too complicated. It might be simpler to treat the end-point repository as a data store.
A: (Adam Montville): Agreed.

Q: (Dave Waltermire) Are there any concerns with separating the end-point repository and the collector being the component responsible for collection?
A: <no response>

Comment: (Adam Montville): The "results repository" will now go into the "end-point repository.
---

Given that, I thought there was some consensus around making that change.

Thanks,

Danny

> -----Original Message-----
> From: Henk Birkholz [mailto:henk.birkholz@sit.fraunhofer.de]
> Sent: Tuesday, April 18, 2017 10:49 AM
> To: Haynes, Dan <dhaynes@mitre.org>; Adam Montville 
> <adam.w.montville@gmail.com>; sacm@ietf.org
> Subject: Re: [sacm] Components for Vulnerability Assessment
> 
> Hello Danny,
> 
> the "Assessment Results Repository" and "Endpoint Repository" are two 
> different components with different functions. The "Endpoint Repository"
> of course is the provider for the consumer that is the "Assessment 
> Results Repository".
> 
> Most certainly, both components can be running on the same endpoint or 
> be composed in a single service that merges both components. I suppose 
> that is what you meant?
> 
> For the sake of show-casing how the architecture is working. I would 
> recommend to start with each SACM component instantiated as a separate 
> software component. Despite the fact that it looks simpler to just add 
> the "Assessment Result" to the ""Endpoint Characterization Records"
> retained in an "Endpoint Repository".
> 
> Ultimately, people will want to use existing software and 
> Asset/Inventory Management Software is a big candidate to provide the 
> functions of an "Endpoint Repository". In consequence, I would keep 
> these components instantiated separately in the first iteration.
> 
> What does the group think?
> 
> Viele Grüße,
> 
> Henk
> 
> On 04/18/2017 04:21 PM, Haynes, Dan wrote:
> > Hi Adam,
> >
> >
> >
> > I think this is a good list for me, but, should the assessment 
> > results repository be merged into the endpoint repository?
> >
> > Thanks,
> >
> > Danny
> >
> >
> >
> > *From:*sacm [mailto:sacm-bounces@ietf.org] *On Behalf Of *Adam 
> > Montville
> > *Sent:* Tuesday, April 18, 2017 9:04 AM
> > *To:* sacm@ietf.org
> > *Subject:* [sacm] Components for Vulnerability Assessment
> >
> >
> >
> > Hi All:
> >
> >
> >
> > We've got a list of components we think we care about for our 
> > vulnerability assessment scenario (focusing on the narrowest "ideal 
> > case" through the scenario for the time being.
> >
> >
> >
> > These are:
> >
> >
> >
> > * Vulnerability Detection Data Repository
> >
> > * Vulnerability Assessor
> >
> > * Endpoint Repository
> >
> > * Collector
> >
> > * Target Endpoint
> >
> > * Assessment Results Repository
> >
> >
> >
> > For reference, see our wiki [1] and/or the slides from IETF 98 [2] 
> > and/or the minutes from IETF 98 [3]
> >
> >
> >
> > Question to the WG: Is this an appropriate initial list of components?
> >
> >
> >
> > Please opine within the next few days (say by end of your day on 
> > Thursday, wherever you may be), so that we can generate some 
> > momentum on this effort.
> >
> >
> >
> > Kind regards,
> >
> >
> >
> > Adam
> >
> >
> >
> > [1]
> > https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScen
> > ar
> > io
> >
> > [2]
> > https://www.ietf.org/proceedings/98/slides/slides-98-sacm-vulnerabil
> > it
> > y-scenario-discussion-00.pdf
> >
> > [3] 
> > https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00.txt
> >
> >
> >
> >
> >
> >
> >
> > _______________________________________________
> > sacm mailing list
> > sacm@ietf.org
> > https://www.ietf.org/mailman/listinfo/sacm
> >

_______________________________________________
sacm mailing list
sacm@ietf.org
https://www.ietf.org/mailman/listinfo/sacm