[sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #4 - Processing Vulnerability Description Information

"Haynes, Dan" <dhaynes@mitre.org> Wed, 18 May 2016 11:49 UTC

From: "Haynes, Dan" <dhaynes@mitre.org>
To: "sacm@ietf.org" <sacm@ietf.org>
Thread-Topic: FOR REVIEW: Vulnerability Assessment Scenario Issue #4 - Processing Vulnerability Description Information
Thread-Index: AdGw9u3Oq/kUu95ZSDejLasK2T+NEg==
Date: Wed, 18 May 2016 11:49:48 +0000
Message-ID: <BY2PR09MB10783B47DD473E171E6AD5C7A5490@BY2PR09MB1078.namprd09.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
spamdiagnosticoutput: 1:23
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_BY2PR09MB10783B47DD473E171E6AD5C7A5490BY2PR09MB1078namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2016 11:49:48.2078 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: c620dc48-1d50-4952-8b39-df4d54d74d82
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR09MB1077
X-OriginatorOrg: mitre.org
Archived-At: <http://mailarchive.ietf.org/arch/msg/sacm/egkY0IHx7NRILhGdzA58bgVtH0o>
Subject: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #4 - Processing Vulnerability Description Information
X-BeenThere: sacm@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: SACM WG mail list <sacm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sacm>, <mailto:sacm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sacm/>
List-Post: <mailto:sacm@ietf.org>
List-Help: <mailto:sacm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sacm>, <mailto:sacm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 May 2016 11:49:57 -0000

During yesterday's virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide's from the meeting can be found here [4].

The fourth issue was around the use of about the processing of vulnerability description information.  Specifically, is the assumption that an enterprise receives vulnerability description information and processes it into a format usable by security tools the same as saying vulnerability description information can be processed into vulnerability detection data?  Furthermore, is this processing related to the assumption that an enterprise has a means of extracting endpoint information into a form that is compatible with the vulnerability description information?

At the meeting, this issue was mostly covered during the discussion around clarifying the definition of vulnerability detection data and the fact there seemed to be agreement around vulnerability detection data representing the instructions generated from the vulnerability description information that can then be used by enterprise security tools.  However, it was noted that we should make sure that the processing of vulnerability description information into vulnerability detection data is covered in the assumptions for the scenario.  Looking at the Vulnerability Assessment Scenario, I believe that this assumption is covered in the first bullet of the "Assumptions" section which states:

"The document begins with the assumption that the enterprise has received vulnerability description data, and that the data has
already been processed into a format that the enterprise's security software tools can understand and use.  In particular, this
document:

      *  Does not discuss how the enterprise identifies potentially
         relevant vulnerability description data.

      *  Does not discuss how the enterprise collects the vulnerability
         description data.

      *  Does not discuss how the enterprise assesses the authenticity
         of the vulnerability description data.

      *  Does not discuss parsing of the vulnerability description data
         into a usable format."

As a result, I think the way forward on this issue is to update the definition of "vulnerability detection data" to make it clear it is the format used by an enterprise's security tools as well as update references to a format that can be used by enterprise tool's to "vulnerability detection data".  We should probably also update the assumption that "The enterprise has a means of extracting relevant information about enterprise endpoints in a form that is compatible with the vulnerability description information" to "...that is compatible with the vulnerability detection data" since security tools will be leveraging vulnerability detection data to carry out assessments.

Does this seem like a reasonable approach for this issue?  Is there anything that I am missing?  If you have any thoughts on this issue, please provide feedback by May 31st.  We are planning to have an updated version of the scenario for June 8th.

Thanks,

Danny

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://github.com/sacmwg/vulnerability-scenario/pull/3
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html
[4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks like the slides are not available just yet, but, I suspect they should be soon)

[sacm] FOR REVIEW: Vulnerability Assessment Scena… Haynes, Dan
Re: [sacm] FOR REVIEW: Vulnerability Assessment S… Jerome Athias
Re: [sacm] FOR REVIEW: Vulnerability Assessment S… Adam Montville
Re: [sacm] FOR REVIEW: Vulnerability Assessment S… Haynes, Dan
Re: [sacm] FOR REVIEW: Vulnerability Assessment S… Bill Munyan
Re: [sacm] FOR REVIEW: Vulnerability Assessment S… Haynes, Dan