[scap_interest] The Context Concept

Jerome Athias <jerome@netpeas.com> Sat, 18 February 2012 19:03 UTC

Return-Path: <jerome@netpeas.com>
X-Original-To: scap_interest@ietfa.amsl.com
Delivered-To: scap_interest@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C82D621E800F for <scap_interest@ietfa.amsl.com>; Sat, 18 Feb 2012 11:03:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.555
X-Spam-Level:
X-Spam-Status: No, score=-0.555 tagged_above=-999 required=5 tests=[AWL=0.184, BAYES_20=-0.74, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PxXlWbjrvos7 for <scap_interest@ietfa.amsl.com>; Sat, 18 Feb 2012 11:03:15 -0800 (PST)
Received: from relay4-d.mail.gandi.net (relay4-d.mail.gandi.net [217.70.183.196]) by ietfa.amsl.com (Postfix) with ESMTP id 09E4E11E8074 for <scap_interest@ietf.org>; Sat, 18 Feb 2012 11:03:14 -0800 (PST)
X-Originating-IP: 217.70.178.131
Received: from mfilter11-d.gandi.net (mfilter11-d.gandi.net [217.70.178.131]) by relay4-d.mail.gandi.net (Postfix) with ESMTP id E89AA1720AB for <scap_interest@ietf.org>; Sat, 18 Feb 2012 20:03:03 +0100 (CET)
X-Virus-Scanned: Debian amavisd-new at mfilter11-d.gandi.net
Received: from relay4-d.mail.gandi.net ([217.70.183.196]) by mfilter11-d.gandi.net (mfilter11-d.gandi.net [10.0.15.180]) (amavisd-new, port 10024) with ESMTP id Q96EnlA-aYQe for <scap_interest@ietf.org>; Sat, 18 Feb 2012 20:03:02 +0100 (CET)
X-Originating-IP: 41.137.25.177
Received: from [127.0.0.1] (dynamic.casap2-177-25-137-41.wanamaroc.com [41.137.25.177]) (Authenticated sender: jerome@netpeas.com) by relay4-d.mail.gandi.net (Postfix) with ESMTPSA id 6BFFD1720A5 for <scap_interest@ietf.org>; Sat, 18 Feb 2012 20:03:00 +0100 (CET)
Message-ID: <4F3FF5E2.2080901@netpeas.com>
Date: Sat, 18 Feb 2012 19:02:58 +0000
From: Jerome Athias <jerome@netpeas.com>
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:10.0.1) Gecko/20120208 Thunderbird/10.0.1
MIME-Version: 1.0
To: "scap_interest@ietf.org" <scap_interest@ietf.org>
Content-Type: multipart/alternative; boundary="------------080509080904030508060701"
Subject: [scap_interest] The Context Concept
X-BeenThere: scap_interest@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Discussion List for IETFers interested in the Security Content Automation Protocol \(SCAP\)." <scap_interest.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/scap_interest>, <mailto:scap_interest-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/scap_interest>
List-Post: <mailto:scap_interest@ietf.org>
List-Help: <mailto:scap_interest-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/scap_interest>, <mailto:scap_interest-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 18 Feb 2012 19:03:15 -0000

In a private discussion I had at ToorCon 9, with Matt Miller (skape);
we came to the conclusion that a key (and unresolved) point of 
automation is the (automatic) definition of the Context in which you are 
where dealing with a vulnerability (threat).
It was also identified (validated?), and introduced by Druid.
And then, the Druid's work was related (validated?) at FRHACK 01 by 
Rodrigo Branco (bsdaemon).

/Situation awareness (http://en.wikipedia.org/wiki/Situation_awareness) 
should be taken into account.
Maybe search for "military situational awareness".

My 2 dirhams
/JA
/