[sacm] FOR REVIEW: SACM I-D Roadmap

["Haynes, Dan" <[e-mail]>]

Hi Everyone,



Today at the virtual interim we discussed, the following I-D roadmap. The idea is that this roadmap will help the WG prioritize which documents we work on. To provide a little more context on the table below, here is a brief description for each column.



*         Importance: The importance of completing a particular I-D.  This is based on the need for consensus around an I-D for the WG to make progress, whether or not other I-Ds are dependent on it, criticality to satisfy the SACM Vulnerability Assessment Scenario, etc.

*         I-D: Name of the I-D.

*         Description: Describes what the I-D is and how it relates back to the SACM Vulnerability Assessment Scenario I-D [1].  It also includes bullet points for key milestones that we need to achieve with respect to the particular I-D.

*         Next Delivery: When we anticipate the next revision (or first in the case of a new I-D) will be published.

*         Projected WGLC: When we would like to have a WGLC issued for the I-D.  This will be highly dependent on WG feedback and discussion.





Importance


I-D


Description


Next Delivery


Projected WGLC


TBD


draft-ietf-sacm-architecture [2]


The current Architecture I-D has been parked in order to gain a better understanding of the solutions being developed by the WG.  This revised Architecture I-D will better align the SACM architecture with these solutions.



Key Milestones:

*         Clarify the distinction and interaction between the collection and aggregation of information from endpoints by a central server and the consumption of this endpoint information by distributed SACM consumers.

*         Capture architectural information needs in the Information Model I-D.

*         Define specific requirements for capabilities outlined in the SACM Vulnerability Assessment Scenario I-D.




TBD


TBD


TBD


draft-ietf-sacm-information-model [3]


This I-D will capture the specific information needs for SACM with a current focus on the SACM Vulnerability Assessment Scenario I-D.



Key Milestones:

*         Distinguish between the information needs required to express endpoint information and the information needs required to exchange endpoint information and other data between SACM consumers.

*         Capture software inventory information, configuration information, and other information required to support the SACM Vulnerability Assessment Scenario I-D.  SWID and OVAL should be used as a starting point for identifying these information needs.




TBD


TBD


TBD

draft-coffin-sacm-nea-swid-patnc [4]




This I-D specifies a protocol for transporting software inventory information from the endpoint to server.  It currently supports SWID expressed as XML.  Software inventory information is critical to determining whether or not an endpoint is in a vulnerable state.



Key Milestones:

*         Make the I-D more data model independent.

*         Identify the mandatory-to-implement aspects of the selected data model (if any).




TBD


TBD


TBD


Data Model for Endpoint

Configuration Information*


This I-D specifies a data model for representing endpoint configuration information based on the lessons learned from OVAL. This I-D will support the collection of configuration information from an endpoint which is necessary to support situations in the SACM Vulnerability Assessment Scenario I-D where software inventory information is not enough to determine whether or not an endpoint is in a vulnerable state.



Key Milestones:

*         Experiment with various data formats and select an initial data format for the data model.

*         Develop a basic data model for expressing the values of configuration information from an endpoint using the selected data format.

*         Develop a basic data model for expressing which configuration information to collect or monitor from an endpoint.

*         Get WG review.

*         Determine if the WG wants to adopt this document.




TBD


TBD


TBD


PA-TNC Extension for Endpoint

Configuration Information*


This I-D extends the PA-TNC protocol to support the collection and transport of endpoint configuration information from the endpoint to the server.



Key Milestones:

*         Using SWID M&A as a template, develop an I-D that supports messages and attributes associated with endpoint configuration information as described above in "Data Model for Endpoint Configuration Information".

*         Get WG review.

*         Determine if the WG wants to adopt this document.




TBD


TBD


TBD


draft-birkholz-sacm-coswid [5]


This I-D specifies a lightweight data model for representing software inventory information using the CBOR data format.  This I-D will provide an additional data format in which to transport software inventory information over SWID M&A.  Software inventory is a critical component of the SACM Vulnerability Assessment Scenario.



Key Milestones:

*         Get WG review.

*         Determine if the WG wants to adopt this document.




TBD


TBD




We will need to work together to determine the following.



*         Are there any I-Ds missing from the roadmap? I should add that we will update this as necessary to accommodate new work. We don't need to capture everything that we may want to work.



*         Is the roadmap missing any key milestones?



*         Does the following proposal for the I-D "Importance" column seem reasonable?

1.       draft-ietf-sacm-architecture

2.       draft-ietf-sacm-information-model

3.       draft-coffin-sacm-nea-swid-patnc

4.       Data Model for Endpoint Configuration Information

5.       PA-TNC Extension for Endpoint Configuration Information

6.       draft-birkholz-sacm-coswid



*         Do you have thoughts on dates for the "Next Delivery" and the "Project WGLC" columns?



Please provide any feedback by Monday 9/19. It would be great to wrap this up by next Tuesday.



Also, please let me know if you have any questions.



Thanks,

Danny



[1] https://datatracker.ietf.org/doc/draft-ietf-sacm-vuln-scenario/

[2] https://datatracker.ietf.org/doc/draft-ietf-sacm-architecture/

[3] https://datatracker.ietf.org/doc/draft-ietf-sacm-information-model/

[4] https://datatracker.ietf.org/doc/draft-coffin-sacm-nea-swid-patnc/

[5] https://datatracker.ietf.org/doc/draft-birkholz-sacm-coswid/

* No I-D is currently available, but, one will be developed.