Re: [sacm] Components for Vulnerability Assessment

[Adam Montville <[e-mail]>]

Hello Everyone,

After some discussion on this topic, I feel like we've got no real
objection to this proposed list of components. As such, this brings us back
to the second version of the sequence diagram that some of us were working
with not too long ago (see attached PDF vector diagram).

Given that set of components, we can now start talking about the expected
communications between them in an ideal case through the system. Remember
that the VDI (vulnerability information) is assumed to have been
transformed and placed into the VDD (vulnerability detection) Repository.
I've numbered the flows in the attached sequence diagram to show the
proposed order and so that we can talk about each flow by that number.

Does this flow feel right to everyone on the list? What needs to be
different? What alternate flows may exist for the basic case of checking
inventory against a new vulnerability?

Let's carry this discussion on for a week or so. (Do we need longer?)

Kind regards,

Adam

On Tue, Apr 18, 2017 at 8:03 AM Adam Montville <[e-mail]>
wrote:

> Hi All:
>
> We've got a list of components we think we care about for our
> vulnerability assessment scenario (focusing on the narrowest "ideal case"
> through the scenario for the time being.
>
> These are:
>
> * Vulnerability Detection Data Repository
> * Vulnerability Assessor
> * Endpoint Repository
> * Collector
> * Target Endpoint
> * Assessment Results Repository
>
> For reference, see our wiki [1] and/or the slides from IETF 98 [2] and/or
> the minutes from IETF 98 [3]
>
> Question to the WG: Is this an appropriate initial list of components?
>
> Please opine within the next few days (say by end of your day on Thursday,
> wherever you may be), so that we can generate some momentum on this effort.
>
> Kind regards,
>
> Adam
>
> [1]
> https://trac.ietf.org/trac/sacm/wiki/SacmVulnerabilityAssessmentScenario
> [2]
> https://www.ietf.org/proceedings/98/slides/slides-98-sacm-vulnerability-scenario-discussion-00.pdf
>
> [3] https://www.ietf.org/proceedings/98/minutes/minutes-98-sacm-00.txt
>
>
>