Re: [sacm] Components for Vulnerability Assessment

[Adam Montville <[e-mail]>]

+1, thanks Danny.

On Wed, Apr 19, 2017 at 7:34 AM Haynes, Dan <[e-mail]> wrote:

> Hi Muhammad,
>
> You will want to check out the Vulnerability Assessment Scenario first
> which can be found here (
> https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario).
> You can also find additional information in this thread (
> https://www.ietf.org/mail-archive/web/sacm/current/msg04698.html).
>
> Hope this helps!
>
> Thanks,
>
> Danny
>
> > -----Original Message-----
> > From: Muhammad Nasir Mumtaz Bhutta [mailto:[e-mail]]
> > Sent: Wednesday, April 19, 2017 1:50 AM
> > To: Haynes, Dan <[e-mail]>; Henk Birkholz
> > <[e-mail]>; Adam Montville
> > <[e-mail]>; [e-mail]
> > Subject: RE: [sacm] Components for Vulnerability Assessment
> >
> > Hi every one,
> > I have joined this group recently and want to know more about the
> discussion
> > topic. It looks like some architecture is being discussed in the thread.
> >
> > From where should I get more information about this so that I can
> participate
> > and contribute my thoughts as well.
> >
> > Thanks.
> >
> >
> > Regards,
> > ===============================================
> > Muhammad Nasir Mumtaz Bhutta, PhD
> > Assistant Professor,
> > Information Systems Dept
> > College of Computer Sciences and Information Technology King Faisal
> University
> > Saudi Arabia Alahssa 31982 P.O. Box 400 Tel  + 966 [phone]
> <+966%2013%20589%209207> Fax + 966
> > [phone]
> >
> >
> >
> > -----Original Message-----
> > From: sacm [mailto:[e-mail]] On Behalf Of Haynes, Dan
> > Sent: Tuesday, April 18, 2017 5:55 PM
> > To: Henk Birkholz <[e-mail]>; Adam Montville
> > <[e-mail]>; [e-mail]
> > Subject: Re: [sacm] Components for Vulnerability Assessment
> >
> > Hi Henk,
> >
> > The reasoning behind my comment was that in the IETF 98 notes
> > (https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00) it
> says:
> >
> > ---
> > Per Slide 7:
> > Q: (Adam Montville): Is the vulnerability assessor talk to the
> repository or talking
> > directly to the collector?
> > A: (Jessica Fitzgerald-McKay): I could see an implementer combining the
> > collector and end-point repository into one.  If we're treating them as
> functional
> > components I'm not sure we need to be that specific.
> > A: (Dave Waltermire): We want this architecture to be de-composable.  If
> we
> > treat the end-point repository as a proxy, we might be making things too
> > complicated. It might be simpler to treat the end-point repository as a
> data
> > store.
> > A: (Adam Montville): Agreed.
> >
> > Q: (Dave Waltermire) Are there any concerns with separating the end-point
> > repository and the collector being the component responsible for
> collection?
> > A: <no response>
> >
> > Comment: (Adam Montville): The "results repository" will now go into the
> "end-
> > point repository.
> > ---
> >
> > Given that, I thought there was some consensus around making that change.
> >
> > Thanks,
> >
> > Danny
> >
> > > -----Original Message-----
> > > From: Henk Birkholz [mailto:[e-mail]]
> > > Sent: Tuesday, April 18, 2017 10:49 AM
> > > To: Haynes, Dan <[e-mail]>; Adam Montville
> > > <[e-mail]>; [e-mail]
> > > Subject: Re: [sacm] Components for Vulnerability Assessment
> > >
> > > Hello Danny,
> > >
> > > the "Assessment Results Repository" and "Endpoint Repository" are two
> > > different components with different functions. The "Endpoint
> Repository"
> > > of course is the provider for the consumer that is the "Assessment
> > > Results Repository".
> > >
> > > Most certainly, both components can be running on the same endpoint or
> > > be composed in a single service that merges both components. I suppose
> > > that is what you meant?
> > >
> > > For the sake of show-casing how the architecture is working. I would
> > > recommend to start with each SACM component instantiated as a separate
> > > software component. Despite the fact that it looks simpler to just add
> > > the "Assessment Result" to the ""Endpoint Characterization Records"
> > > retained in an "Endpoint Repository".
> > >
> > > Ultimately, people will want to use existing software and
> > > Asset/Inventory Management Software is a big candidate to provide the
> > > functions of an "Endpoint Repository". In consequence, I would keep
> > > these components instantiated separately in the first iteration.
> > >
> > > What does the group think?
> > >
> > > Viele Grüße,
> > >
> > > Henk
> > >
> > > On 04/18/2017 04:21 PM, Haynes, Dan wrote:
> > > > Hi Adam,
> > > >
> > > >
> > > >
> > > > I think this is a good list for me, but, should the assessment
> > > > results repository be merged into the endpoint repository?
> > > >
> > > > Thanks,
> > > >
> > > > Danny
> > > >
> > > >
> > > >
> > > > *From:*sacm [mailto:[e-mail]] *On Behalf Of *Adam
> > > > Montville
> > > > *Sent:* Tuesday, April 18, 2017 9:04 AM
> > > > *To:* [e-mail]
> > > > *Subject:* [sacm] Components for Vulnerability Assessment
> > > >
> > > >
> > > >
> > > > Hi All:
> > > >
> > > >
> > > >
> > > > We've got a list of components we think we care about for our
> > > > vulnerability assessment scenario (focusing on the narrowest "ideal
> > > > case" through the scenario for the time being.
> > > >
> > > >
> > > >
> > > > These are:
> > > >
> > > >
> > > >
> > > > * Vulnerability Detection Data Repository
> > > >
> > > > * Vulnerability Assessor
> > > >
> > > > * Endpoint Repository
> > > >
> > > > * Collector
> > > >
> > > > * Target Endpoint
> > > >
> > > > * Assessment Results Repository
> > > >
> > > >
> > > >
> > > > For reference, see our wiki [1] and/or the slides from IETF 98 [2]
> > > > and/or the minutes from IETF 98 [3]
> > > >
> > > >
> > > >
> > > > Question to the WG: Is this an appropriate initial list of
> components?
> > > >
> > > >
> > > >
> > > > Please opine within the next few days (say by end of your day on
> > > > Thursday, wherever you may be), so that we can generate some
> > > > momentum on this effort.
> > > >
> > > >
> > > >
> > > > Kind regards,
> > > >
> > > >
> > > >
> > > > Adam
> > > >
> > > >
> > > >
> > > > [1]
> > > > https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScen
> > > > ar
> > > > io
> > > >
> > > > [2]
> > > > https://www.ietf.org/proceedings/98/slides/slides-98-sacm-vulnerabil
> > > > it
> > > > y-scenario-discussion-00.pdf
> > > >
> > > > [3]
> > > > https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00.txt
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > sacm mailing list
> > > > [e-mail]
> > > > https://www.ietf.org/mailman/listinfo/sacm
> > > >
> >
> > _______________________________________________
> > sacm mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/sacm
>