Fwd: NEA requirements (was Re: Fwd: [Nea] Re: use of a design team to develop requirements)

["Mike Fratto" <mfratto at gmail.com>]

To: Alan DeKok <aland at deployingradius.com>


>   In fact, the NEA server has little use for that information to make
> any decision independent of the manufacturer of product X.  If the NEA
> server gets told product X is at version Y, what does that mean?  Is it
> a good thing?  Is that version vulnerable?  Is it newer than the version
> the NEA server knows about?

So what does an NEA server make a decision on? It can't make a
decision in a vacuum. Reporting product X, version y, update
DD-MM-YYYY-hh:mm:ss, tells the NEA server the current status of that
piece of software. This is used to make a decision based on local
policy. The NEA server doesn't need to know about vulns or exploits.
The human administring the local policy does, however. Some person has
to say that products prior to version Z are unacceptable and configure
a policy decision.

That could be a query/response or it could be notification mechanism,
though the latter is highly inflexible and severly limiting. Now ask
me why.

_______________________________________________
Nea mailing list
Nea at ietf.org
https://www1.ietf.org/mailman/listinfo/nea