Re: [sacm] Warren Kumari's Yes on draft-ietf-sacm-requirements-16: (with COMMENT)

[Warren Kumari <[e-mail]>]

Excellent, thank you.


W

On Mon, Jun 26, 2017 at 1:45 AM Nancy Cam-Winget (ncamwing) <
[e-mail]> wrote:

> Thanks for the review and comments.  Please see further comments below:
>
> On 6/21/17, 9:32 AM, "Warren Kumari" <[e-mail]> wrote:
>
>     Warren Kumari has entered the following ballot position for
>     draft-ietf-sacm-requirements-16: Yes
>
>     When responding, please keep the subject line intact and reply to all
>     email addresses included in the To and CC lines. (Feel free to cut this
>     introductory paragraph, however.)
>
>
>     Please refer to
> https://www.ietf.org/iesg/statement/discuss-criteria.html
>     for more information about IESG DISCUSS and COMMENT positions.
>
>
>     The document, along with other ballot positions, can be found here:
>     https://datatracker.ietf.org/doc/draft-ietf-sacm-requirements/
>
>
>
>     ----------------------------------------------------------------------
>     COMMENT:
>     ----------------------------------------------------------------------
>
>     I spent a while trying to figure out how to ballot on this - I
> personally see
>     value in requirements, use-cases and similar (informational) documents
> - they
>     help newcomers to the technology understand how and why it is shaped
> as it is.
>     This document is also (kind of) mentioned in the charter ("A document
> or
>     documents describing the SACM Architecture. This will include protocol
>     requirements and their associated use cases as well as a description
> ..." , and
>     so I've decided on Yes
>
>     However, there are still some comments / nits which should be
> addressed,
>     including:
>
>     Abstract:
>     "The requirements and scope are based on the agreed upon use cases."
> -- what
>     use cases / agreed upon by whom? (Missing ref).
> [NCW] The use cases are now in RFC 7632 and its reference has been added.
>
>     1. Introduction
>     "Today’s environment of rapidly-evolving security threats highlights
> the need
>     to automate the sharing of security information (such as posture
> information)
>     while protecting user information as well as the systems that store,
> process,
>     and transmit this information." - "... user information as well as the
> systems"
>     -> "user information and the systems" ? Not sure if this is better....
> [NCW] Yes, it helps and I’ve made the change in the next revision.
>
>     2.  Requirements
>     I got somewhat lost in "A SACM transport protocol is one that runs on
> top of L3
>     protocols such as TCP/IP or L4 protocols such as HTTP, carries
> operations
>     (requests / responses), and moves data." - perhaps "A SACM transport
> protocol
>     is one that runs on top of L3 protocols (such as TCP/IP) or L4
> protocols (such
>     as HTTP), carries operations (requests / responses), and moves data."
> [NCW] I’ve change L3 and L4 to be “transport layer” and “Internet layer”
> as suggested by Carsten.
>
>     3: "With the information model defining assets and attributes to
> facilitate the
>     guidance, collection, and assessment of posture, these are some of the
> tasks
>     that should be considered:" - the "With" and "these" feel unrelated.
> I'm not
>     really sure how they are supposed to tie together, so I cannot suggest
> text.
> [NCW] I’ve changed “these are some of the tasks that should be considered”
> to read
> “tasks that should be considered include”.  Hopefully it ties them as
> tasks to facilitate the
> workflow for “collection”, “guidance” etc…
>
>
>     G-001
>     "2.  The query language MUST allow for general inquiries, as well as
> expression
>     of specific attributes or relationships between attributes to follow;
> the
>     retrieval of specific information ..." -- I don't really understand
> the "to
>     follow"; can it be struck?
> [NCW] Yes, thanks for catching it….
>
>     G-002
>     "Interoperability: The data models, protocols, and transports  must be
>     specified with enough details to ensure interoperability." -- I really
> don't
>     understand the point of saying this - are you expecting that if you
> *didn't*
>     say this that people would intentionally create models without enough
> detail?
>     Is this just a "motherhood and apple pie" statement?
> [NCW] Yes!  There were a couple of proposals that didn’t provide enough
> specificity
> so the WG asked for this requirement to be included.
>
>      G-006
>     "Mechanisms for this protection are unspecified but should include
> industry
>     best practices such as encrypted storage, encrypted transports, data
> checksums,
>     etc. " -- the list of best practices seems harmful;  if you provide a
> list
>     people will implicitly assume it is exhaustive, and industry best
> practices
>     change over time. Also, what is a "data checksum"? I'm assuming you
> mean
>     something "cryptographic checksums" or "secure hash" - a data checksum
> implies
>     something like a simple CRC. I'd suggest just dropping the "such
> as..." list.
> [NCW] Done.
>
>     IM-004
>     "Data Model Identification: The information model MUST provide a means
> to
>     uniquely identify each data model uniquely." - you really really want
> this to
>     be unique, don't you :-P
> [NCW] LoL….2nd uniquely is removed
>
>     5.2.  Privacy Considerations
>     "In addition to identity and SACM capabilities information disclosure,
> the use
>     of time stamps or other attributes that can be used as identifiers
> especially
>     as they are coupled with an identity can be further used to determine
> a target
>     endpoint or user’s behavioral patterns." -- this sentence could use
> some work.
>     I agree with what it is trying to say, but it is long and confusing.
> Perhaps:
>     "In addition to identity and SACM capabilities information disclosure,
> the use
>     of time stamps (or other attributes that can be used as identifiers)
> could be
>     further used to determine a target endpoint or user’s behavioral
> patterns." --
>     I *think* that that maintains the meaning, but is clearer.
> [NCW] Yes, thanks for the improvement.
>
>     "Data confidentiality can provide some level of privacy but may fall
> short
>     where unecessary data is still transmitted." - "unnecessary" (typo)
> [NCW] Fixed.
>
>
>
>
> --
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf