Re: [sacm] 答复: new drafts about network infrastructure device's security baseline:

The problem with OVAL is that this is specific to network devices and we'd be asking vendors to implement something else.  They've made an investment in YANG, so we can get traction and support.  OVAL would be great for platforms where there is already support.

Best,
Kathleen 

Sent from my iPhone

> On Sep 12, 2017, at 3:08 AM, Jerome Athias <jerome.athias@protonmail.com> wrote:
> 
> OVAL
> 
> 
>> On Mon, Sep 11, 2017 at 6:35 PM, Nancy Cam-Winget (ncamwing) <ncamwing@cisco.com> wrote:
>> Hi Frank,
>> 
>>  
>> 
>> It is not clear to me why we couldn’t reference the work and attributes already being worked on in NETMOD and perhaps i2nsf?  While I agree that SACM includes network elements as endpoints, I think we can leverage work already being defined by other working groups.
>> 
>>  
>> 
>> Warm regards, Nancy
>> 
>>  
>> 
>>  
>> 
>>  
>> 
>> From: sacm <sacm-bounces@ietf.org> on behalf of "Xialiang (Frank)" <frank.xialiang@huawei.com>
>> Date: Thursday, September 7, 2017 at 7:39 PM
>> To: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>, Panos Kampanakis <pkampana@cisco.com>, "sacm@ietf.org" <sacm@ietf.org>
>> Cc: "Linqiushi (Jessica, SCC)" <linqiushi@huawei.com>, "Zhengguangying (Walker)" <zhengguangying@huawei.com>, "dongyue (D)" <dongyue6@huawei.com>
>> Subject: [sacm] 答复: new drafts about network infrastructure device's security baseline:
>> 
>>  
>> 
>> Hi Dave and Panos,
>> 
>> I think Dave gives a very clear and detailed clarification about the definition of endpoints in SACM and the latest SACM plan, thanks.
>> 
>>  
>> 
>> I will follow the SACM information model and the latest decision to update these drafts.
>> 
>> Any comments are welcome!
>> 
>>  
>> 
>> B.R.
>> 
>> Frank
>> 
>>  
>> 
>> 发件人: Waltermire, David A. (Fed) [mailto:david.waltermire@nist.gov] 
>> 发送时间: 2017年9月8日 3:01
>> 收件人: Panos Kampanakis (pkampana); Xialiang (Frank); sacm@ietf.org
>> 抄送: Linqiushi (Jessica, SCC); Zhengguangying (Walker); dongyue (D)
>> 主题: RE: new drafts about network infrastructure device's security baseline:
>> 
>>  
>> 
>> Panos,
>> 
>>  
>> 
>> At the last IETF meeting we started discussing a charter update. I believe we are currently waiting on the chairs to start this discussion on the list. This will give the working group an opportunity to clarify this issue in the charter.
>> 
>>  
>> 
>> As far as endpoints, the definition that has been used for endpoints in the SACM charter is the one from RFC 5209, which is "Any computing device that can be connected to a network.
>>       Such devices normally are associated with a particular link layer
>> 
>>       address before joining the network and potentially an IP address
>> 
>>       once on the network.  This includes: laptops, desktops, servers,
>> 
>>       cell phones, or any device that may have an IP address."
>> 
>>  
>> 
>> As most network devices are connected to networks, and often expose a management interface that is IP addressable, I’d say they qualify as endpoints. This view is also reflected in the SACM terminology, which states "To further clarify the [RFC5209] definition, an endpoint is any
>>       physical or virtual device that may have a network address.  Note
>>       that, network infrastructure devices (e.g. switches, routers,
>>       firewalls), which fit the definition, are also considered to be
>>       endpoints within this document."
>>  
>> This text squares with my original view of endpoints way back when we were working on the original SACM charter.
>>  
>> Regards,
>> Dave
>>  
>> 
>> From: sacm [mailto:sacm-bounces@ietf.org] On Behalf Of Panos Kampanakis (pkampana)
>> Sent: Thursday, September 07, 2017 2:11 PM
>> To: Xialiang (Frank) <frank.xialiang@huawei.com>; sacm@ietf.org
>> Cc: Linqiushi (Jessica, SCC) <linqiushi@huawei.com>; Zhengguangying (Walker) <zhengguangying@huawei.com>; dongyue (D) <dongyue6@huawei.com>
>> Subject: Re: [sacm] new drafts about network infrastructure device's security baseline:
>> 
>>  
>> 
>> When checking the SACM charter, I do not see any references to network infrastructure or network elements. I believe SACM’s initial focus was on endpoints. Do these three drafts even fall in SACM’s charter as it is right now?
>> 
>> Panos
>> 
>>  
>> 
>>  
>> 
>> From: sacm [mailto:sacm-bounces@ietf.org] On Behalf Of Xialiang (Frank)
>> Sent: Thursday, September 07, 2017 4:05 AM
>> To: sacm@ietf.org
>> Cc: Linqiushi (Jessica, SCC) <linqiushi@huawei.com>; Zhengguangying (Walker) <zhengguangying@huawei.com>; dongyue (D) <dongyue6@huawei.com>
>> Subject: [sacm] new drafts about network infrastructure device's security baseline:
>> 
>>  
>> 
>> Hi all,
>> 
>> We just submit 3 drafts to specify the yang data model of network infrastructure devices (i.e., router, switch, firewall, etc) security posture, or call it security baseline. Each draft covers one of the three planes of network infrastructure devices: data plane, control plane, management plane.
>> 
>> https://tools.ietf.org/html/draft-xia-sacm-nid-dp-security-baseline-00
>> 
>>  
>> 
>> https://tools.ietf.org/html/draft-dong-sacm-nid-cp-security-baseline-00
>> 
>>  
>> 
>> https://tools.ietf.org/html/draft-lin-sacm-nid-mp-security-baseline-00
>> 
>>  
>> 
>> The goal is to facilitate the collection and assessment of the overall security posture of the network infrastructure devices, in order to realize the whole lifecycle security automation for the infrastructure network.
>> 
>> Your comments are warmly welcome!
>> 
>>  
>> 
>> B.R.
>> 
>> Frank
>> 
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm