Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

["Haynes, Dan" <[e-mail]>]

I just updated the “Vulnerability Description Information” section in the Vulnerability Assessment Scenario wiki [1] to include the following statement.

“The enterprise is responsible for determining the sources of vulnerability description information as well as which vulnerability description information is converted into vulnerability detection data.”

Jerome, I think this should address your comment about giving the enterprise the flexibility to determine which of the vulnerability description information is converted into vulnerability detection data. Let me know if it is missing anything or if there is anything that could be improved.

Thanks,

Danny

[1] https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario

From: sacm [mailto:[e-mail]] On Behalf Of Haynes, Dan
Sent: Friday, May 19, 2017 9:07 AM
To: Adam Montville <[e-mail]>; Jerome Athias <[e-mail]>
Cc: [e-mail]
Subject: Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

Yeah, I can update it next week.

Thanks,

Danny

From: Adam Montville [mailto:[e-mail]]
Sent: Wednesday, May 17, 2017 4:21 PM
To: Haynes, Dan <[e-mail]<mailto:[e-mail]>>; Jerome Athias <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

Yes, I think so. Any chance you can update?
On Wed, May 17, 2017 at 10:35 AM Haynes, Dan <[e-mail]<mailto:[e-mail]>> wrote:
Maybe this should be noted in the wiki somewhere?

Thanks,

Danny

From: sacm [mailto:[e-mail]<mailto:[e-mail]>] On Behalf Of Adam Montville
Sent: Wednesday, May 03, 2017 4:46 PM
To: Jerome Athias <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

That seems like it could be a reasonable optimization, provide the VDI had enough information and structure. I'm not sure they always do and I would suspect that some organizations just take a look at what's been defined in, say, the OVAL repository (a VDD source) and work optimizations from there.

Other thoughts?


On Wed, May 3, 2017 at 2:06 AM Jerome Athias <[e-mail]<mailto:[e-mail]>> wrote:
Hi,

For now what is unclear for me is when/where it is determined that a VDI/VDD is interesting for me (applies to my endpoints).

For example:
I am retrieving everyday the latest CVE content from NVD.
Option 1: (apparently the current one) each new CVE/VDI is transformed and inserted in the VDD repository, which will trigger the flow. So for each and every CVE, I would enter the flow, and it will get/evaluate if I have endpoints that need to be evaluated before the assessment. - not optimized because they are more vulnerabilities released -not- affecting my endpoints than applicable ones

Option 2: (the one I'm using) each new CVE/VDI is evaluated by my Endpoint Manager (assets inventory/portfolio/cmdb) and ONLY IF it is relevant, it will be transformed and inserted in the VDD repository, which will trigger the flow. - more optimized, I will just assess what is relevant

Note that #2 could be assumed to be done up front, but imho would be nice to mention it.


Would this make sense?

Best regards

-------- Original Message --------
Subject: [sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)
Local Time: May 3, 2017 12:42 AM
UTC Time: May 2, 2017 9:42 PM
From: [e-mail]<mailto:[e-mail]>
To: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>

Has anyone had time to take a look at the communication sequence here? I know we've not yet completely settled on goals, but I feel like we should still be able to have this discussion as well.

Thanks for your time.

Adam

On Fri, Apr 21, 2017 at 8:00 AM Adam Montville <[e-mail]<mailto:[e-mail]>> wrote:
Hello Everyone,

After some discussion on this topic, I feel like we've got no real objection to this proposed list of components. As such, this brings us back to the second version of the sequence diagram that some of us were working with not too long ago (see attached PDF vector diagram).

Given that set of components, we can now start talking about the expected communications between them in an ideal case through the system. Remember that the VDI (vulnerability information) is assumed to have been transformed and placed into the VDD (vulnerability detection) Repository. I've numbered the flows in the attached sequence diagram to show the proposed order and so that we can talk about each flow by that number.

Does this flow feel right to everyone on the list? What needs to be different? What alternate flows may exist for the basic case of checking inventory against a new vulnerability?

Let's carry this discussion on for a week or so. (Do we need longer?)

Kind regards,

Adam

On Tue, Apr 18, 2017 at 8:03 AM Adam Montville <[e-mail]<mailto:[e-mail]>> wrote:
Hi All:

We've got a list of components we think we care about for our vulnerability assessment scenario (focusing on the narrowest "ideal case" through the scenario for the time being.

These are:

* Vulnerability Detection Data Repository
* Vulnerability Assessor
* Endpoint Repository
* Collector
* Target Endpoint
* Assessment Results Repository

For reference, see our wiki [1] and/or the slides from IETF 98 [2] and/or the minutes from IETF 98 [3]

Question to the WG: Is this an appropriate initial list of components?

Please opine within the next few days (say by end of your day on Thursday, wherever you may be), so that we can generate some momentum on this effort.

Kind regards,

Adam

[1] https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario
[2] https://www.ietf.org/proceedings/98/slides/slides-98-sacm-vulnerability-scenario-discussion-00.pdf
[3] https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00.txt