[sacm] Component Communication Sequence (Was - Re: Components for Vulnerability Assessment)

[Adam Montville <[e-mail]>]

Has anyone had time to take a look at the communication sequence here? I
know we've not yet completely settled on goals, but I feel like we should
still be able to have this discussion as well.

Thanks for your time.

Adam

On Fri, Apr 21, 2017 at 8:00 AM Adam Montville <[e-mail]>
wrote:

> Hello Everyone,
>
> After some discussion on this topic, I feel like we've got no real
> objection to this proposed list of components. As such, this brings us back
> to the second version of the sequence diagram that some of us were working
> with not too long ago (see attached PDF vector diagram).
>
> Given that set of components, we can now start talking about the expected
> communications between them in an ideal case through the system. Remember
> that the VDI (vulnerability information) is assumed to have been
> transformed and placed into the VDD (vulnerability detection) Repository.
> I've numbered the flows in the attached sequence diagram to show the
> proposed order and so that we can talk about each flow by that number.
>
> Does this flow feel right to everyone on the list? What needs to be
> different? What alternate flows may exist for the basic case of checking
> inventory against a new vulnerability?
>
> Let's carry this discussion on for a week or so. (Do we need longer?)
>
> Kind regards,
>
> Adam
>
> On Tue, Apr 18, 2017 at 8:03 AM Adam Montville <[e-mail]>
> wrote:
>
>> Hi All:
>>
>> We've got a list of components we think we care about for our
>> vulnerability assessment scenario (focusing on the narrowest "ideal case"
>> through the scenario for the time being.
>>
>> These are:
>>
>> * Vulnerability Detection Data Repository
>> * Vulnerability Assessor
>> * Endpoint Repository
>> * Collector
>> * Target Endpoint
>> * Assessment Results Repository
>>
>> For reference, see our wiki [1] and/or the slides from IETF 98 [2] and/or
>> the minutes from IETF 98 [3]
>>
>> Question to the WG: Is this an appropriate initial list of components?
>>
>> Please opine within the next few days (say by end of your day on
>> Thursday, wherever you may be), so that we can generate some momentum on
>> this effort.
>>
>> Kind regards,
>>
>> Adam
>>
>> [1]
>> https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario
>> [2]
>> https://www.ietf.org/proceedings/98/slides/slides-98-sacm-vulnerability-scenario-discussion-00.pdf
>>
>> [3] https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00.txt
>>
>>
>>