Re: [sacm] Identifying Vulnerability Assessment Code
Bill Munyan <bill.munyan.ietf@gmail.com> Wed, 17 May 2017 18:04 UTC
Return-Path: <bill.munyan.ietf@gmail.com>
X-Original-To: sacm@ietfa.amsl.com
Delivered-To: sacm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E0F4129AF4 for <sacm@ietfa.amsl.com>; Wed, 17 May 2017 11:04:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sffFWaR0W5x0 for <sacm@ietfa.amsl.com>; Wed, 17 May 2017 11:04:11 -0700 (PDT)
Received: from mail-wm0-x22c.google.com (mail-wm0-x22c.google.com [IPv6:2a00:1450:400c:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D461F129510 for <sacm@ietf.org>; Wed, 17 May 2017 10:59:20 -0700 (PDT)
Received: by mail-wm0-x22c.google.com with SMTP id b84so174344497wmh.0 for <sacm@ietf.org>; Wed, 17 May 2017 10:59:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=3SHCu6NiZkVqFFH9kC6jln0n+WAeOv9gXbAylTL4y6I=; b=k3v7JlTF8gVWMk0CEU2uNjFs8B+PgpmQEVS4hnj/Pw3RtnRA7ZJcYClOg7eSQhzBMD qr2RYPvFkGQJqoXSkIy74MXHY8qy0/pO0Q8jx9jHJJ/4tLOe1i5W5xj4AeilojlEOaXL PoJFho0nHbZPEiVp7m8ZaOVbGB/deXrEfIQKl+lS+jPnWfK1lKNj7hQf5zSkQ6TBf1oV RQeBAJ3m8RjaRlEsctsWISVlC6UsNgY3pVIvdXn/ZSbnQWigm3lYdTwJdF5RC1Qtr0CX EqxP9u/tiUC9XUaUacwd1KrSc2b//ypDvT7nxMvuzq2VHso4LvxS09kcuRxDfnMlAojB bdKg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=3SHCu6NiZkVqFFH9kC6jln0n+WAeOv9gXbAylTL4y6I=; b=X8EAfDIxIdWuUyutPihKfNEJMMo3iHJmkwo5vWtgoc7z6Fb3Xsga1/PyBfi24/4ZBw wLHGAa9Clsya486EuwAl/PcBxQPAgf1QMAgoz9d5tAU6SXdQDR55MV4uYSRclTSQa/00 DUGX0JJTVB3h7nQt1IIRliSI5gnj+IEhSktcLw7tLYlgKOGfusl1HmHe8RIzlJX2ZxJu 7ieIXH3A2SK/hX4a15wdcCrDv64r1VEcRhKhkxwgUGq7PuPKODBr5isj+XU47GqHt8jl ouka9QAM//nsarAqhw3NhN+YNTM35hROPNxyy0Efp1+Qss5fh80j/ggDWMvtpFVyaa0e ctfg==
X-Gm-Message-State: AODbwcAIP41+G8aDwf4v2HJGg1y+bZ/3J9OOSXy6k1K7xzUnzAkA5XE0 TS61kmnV5Ivnx0nlDX/+Da/rNEBnig==
X-Received: by 10.28.193.202 with SMTP id r193mr8852wmf.31.1495043959410; Wed, 17 May 2017 10:59:19 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.223.136.227 with HTTP; Wed, 17 May 2017 10:59:18 -0700 (PDT)
In-Reply-To: <CACknUNUV1bNkGN_OS3aY9U5t92YpCGcWTcwfsEAmME-__s4EEQ@mail.gmail.com>
References: <CACknUNWs8_4pBWPJHNyzVjb+aT3mb1=MqWEnyoWPiOzkz7jZEA@mail.gmail.com> <DM5PR09MB1307185DAA5B12D76926FD0CF0E60@DM5PR09MB1307.namprd09.prod.outlook.com> <CACknUNUV1bNkGN_OS3aY9U5t92YpCGcWTcwfsEAmME-__s4EEQ@mail.gmail.com>
From: Bill Munyan <bill.munyan.ietf@gmail.com>
Date: Wed, 17 May 2017 13:59:18 -0400
Message-ID: <CAKUOEQxnMXiYrXbLbQyYshBoJpC3Fj+sXX6TYDNPLD_LfpCRqA@mail.gmail.com>
To: Adam Montville <adam.w.montville@gmail.com>
Cc: "Banghart, Stephen A. (Fed)" <stephen.banghart@nist.gov>, "sacm@ietf.org" <sacm@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c1309281fdbe6054fbc0c0e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/sacm/yShsgzcDlzlv2MC4fXeF0fiWTC0>
Subject: Re: [sacm] Identifying Vulnerability Assessment Code
X-BeenThere: sacm@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: SACM WG mail list <sacm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sacm>, <mailto:sacm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sacm/>
List-Post: <mailto:sacm@ietf.org>
List-Help: <mailto:sacm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sacm>, <mailto:sacm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 May 2017 18:04:13 -0000
Adam, I'm planning on contributing components for collection (of endpoint characteristics), vulnerability assessment (evaluation of endpoint characteristics vs. expected state), and an assessment results repository to the hackathon. Once further components are identified, I would be happy to help develop the "interaction goop" (aka: glue) that will allow for the components to interface. Cheers, -Bill M. On Tue, May 16, 2017 at 1:17 PM, Adam Montville <adam.w.montville@gmail.com> wrote: > Great, thanks! > > On Tue, May 16, 2017 at 11:50 AM Banghart, Stephen A. (Fed) < > stephen.banghart@nist.gov> wrote: > >> Adam, >> >> >> >> I’m planning on bringing a ROLIE implementation with me to the Hackathon >> that could fill the Vulnerability Detection Data Repository component. The >> ROLIE implementation could also provide arbitrary data to any component >> along the pipeline in order to simulation data input/output. I intend to >> pre-load the ROLIE server implementation with sample NVD data and sample >> SWID tags so that we have something for the other components to work with >> if need be. >> >> >> >> Regards, >> >> Stephen Banghart >> >> >> >> *From:* sacm [mailto:sacm-bounces@ietf.org] *On Behalf Of *Adam Montville >> *Sent:* Tuesday, May 16, 2017 9:07 AM >> *To:* sacm@ietf.org >> *Subject:* [sacm] Identifying Vulnerability Assessment Code >> >> >> >> All: >> >> >> >> Last week a list of goals were sent to this list [1]. I did see some >> back-channel conversation, but nothing that made its way to the list. Then, >> those are our stated goals, and it is now time to start considering what >> code may already exist for our agreed upon components. Once again, these >> components are listed at [2] and repeated here: >> >> >> >> * Vulnerability Detection Data Repository >> >> * Vulnerability Assessor >> >> * Endpoint Repository >> >> * Collector >> >> * Target Endpoint >> >> * Assessment Results Repository >> >> >> >> We need to drive this to some conclusion relatively quickly. If you have >> or know of components filling these roles, please respond by the end of >> this week. Note that the target endpoint component will likely be >> determined based on which real-world vulnerability(ies) we choose to deal >> with as part of this exercise. >> >> >> >> Kind regards, >> >> >> >> Adam >> >> >> >> >> >> [1] https://mailarchive.ietf.org/arch/msg/sacm/ >> LskQ7tj9Wvy1-0DSlEN_VakYj64 >> >> [2] https://mailarchive.ietf.org/arch/msg/sacm/w_ >> kL2vzDBPk0NN9N1WQcpb3Qwfw >> > > _______________________________________________ > sacm mailing list > sacm@ietf.org > https://www.ietf.org/mailman/listinfo/sacm > >
- [sacm] Identifying Vulnerability Assessment Code Adam Montville
- Re: [sacm] Identifying Vulnerability Assessment C… Banghart, Stephen A. (Fed)
- Re: [sacm] Identifying Vulnerability Assessment C… Adam Montville
- Re: [sacm] Identifying Vulnerability Assessment C… Bill Munyan
- Re: [sacm] Identifying Vulnerability Assessment C… Adam Montville
- Re: [sacm] Identifying Vulnerability Assessment C… Adam Montville
- Re: [sacm] Identifying Vulnerability Assessment C… Waltermire, David A. (Fed)
- Re: [sacm] Identifying Vulnerability Assessment C… Adam Montville