IETF Logo Mail Archive

[sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #7 - Where do vulnerability assessment attributes belong

"Haynes, Dan" <dhaynes@mitre.org> Wed, 18 May 2016 11:58 UTC

Return-Path: <dhaynes@mitre.org>
X-Original-To: sacm@ietfa.amsl.com
Delivered-To: sacm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67CBB12D0FF for <sacm@ietfa.amsl.com>; Wed, 18 May 2016 04:58:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.625
X-Spam-Level:
X-Spam-Status: No, score=-5.625 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.426] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mitre.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3kx7ICV-ZoCv for <sacm@ietfa.amsl.com>; Wed, 18 May 2016 04:58:34 -0700 (PDT)
Received: from smtpvmsrv1.mitre.org (smtpvmsrv1.mitre.org [192.52.194.136]) by ietfa.amsl.com (Postfix) with ESMTP id BC9D512D116 for <sacm@ietf.org>; Wed, 18 May 2016 04:58:29 -0700 (PDT)
Received: from smtpvmsrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 588266C0286 for <sacm@ietf.org>; Wed, 18 May 2016 07:58:29 -0400 (EDT)
Received: from imshyb02.MITRE.ORG (imshyb02.mitre.org [129.83.29.3]) by smtpvmsrv1.mitre.org (Postfix) with ESMTP id 46B896C028A for <sacm@ietf.org>; Wed, 18 May 2016 07:58:29 -0400 (EDT)
Received: from imshyb02.MITRE.ORG (129.83.29.3) by imshyb02.MITRE.ORG (129.83.29.3) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Wed, 18 May 2016 07:58:28 -0400
Received: from gcc01-CY1-obe.outbound.protection.outlook.com (10.140.19.249) by imshyb02.MITRE.ORG (129.83.29.3) with Microsoft SMTP Server (TLS) id 15.0.1130.7 via Frontend Transport; Wed, 18 May 2016 07:58:28 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitre.onmicrosoft.com; s=selector1-mitre-org; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=indzf0cscPGwT1WNe3kXvIJgEZCY9m6+8lUP8IRtgfI=; b=EbvX7MQSk7xgNf+FiTmbQcjD04hhDmWgcp5s+tBwet15Bw3EMiEUSCEg2INjyceyzMo4G3MxE1FNIjJYTx/YcDYTapgL7kRGJvOziqIi3FkNp75eKBzdj3YYlbbFttB2RsiYqzug+urKNsw8FPQSBkNU3CEoXECOhyrd8o8wRrw=
Received: from BY2PR09MB1078.namprd09.prod.outlook.com (10.166.116.10) by BY2PR09MB1079.namprd09.prod.outlook.com (10.166.116.11) with Microsoft SMTP Server (TLS) id 15.1.497.12; Wed, 18 May 2016 11:58:22 +0000
Received: from BY2PR09MB1078.namprd09.prod.outlook.com ([10.166.116.10]) by BY2PR09MB1078.namprd09.prod.outlook.com ([10.166.116.10]) with mapi id 15.01.0497.019; Wed, 18 May 2016 11:58:22 +0000
From: "Haynes, Dan" <dhaynes@mitre.org>
To: "sacm@ietf.org" <sacm@ietf.org>
Thread-Topic: FOR REVIEW: Vulnerability Assessment Scenario Issue #7 - Where do vulnerability assessment attributes belong
Thread-Index: AdGwsrFbv/ibJriWS+udrcyezmAK8g==
Date: Wed, 18 May 2016 11:58:22 +0000
Message-ID: <BY2PR09MB1078EC77BEF34446BA812A56A5490@BY2PR09MB1078.namprd09.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=mitre.org;
x-originating-ip: [192.160.51.87]
x-ms-office365-filtering-correlation-id: 11bf20b7-1509-49ff-3847-08d37f13b5f6
x-microsoft-exchange-diagnostics: 1; BY2PR09MB1079; 5:9l48RTD3Ec+CU4LZSpCpcyAHvluDQsqDbP8FmZwhUOy+OEOwakg8rK4I2zWpy8L756Ak0TrPqmkWnwSp46klFEMXPHGJaGNQyUjw52BJXmyFXFH4Kqr8Pyn5mqn1gmt4P2cJZi/20J2/i1gr0lC60Q==; 24:XoDYit/jhM+TB8KAHnTYj2jz06xny05tmpMH0kbZ6/IC5pvVJ9L4Jjb2FejXn/5ypIDDGDDWKC+xKKf/Uacde8roEyjvZjqqH+PI031W4pQ=; 7:AxmMXDdCscy6TodJGwVlAWBz0L6n0VX/pehFkyA8fZLR19CcW0wefmx6Tk3tZdbtjnyASSmusMtBOS4d8BvSdZFhi2d8hg4nEaQaK6W1PjShm7u1oqzREeZJV7+KPbK1vU31N007dh2U2TvEliTJAwcKg7crAQdbvVa1sW82xYK5mKwMxslNXbMFMz40sK6c
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY2PR09MB1079;
x-microsoft-antispam-prvs: <BY2PR09MB107996F0B617256641E7EA16A5490@BY2PR09MB1079.namprd09.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:;
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026); SRVR:BY2PR09MB1079; BCL:0; PCL:0; RULEID:; SRVR:BY2PR09MB1079;
x-forefront-prvs: 0946DC87A1
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(478694002)(5383002)(5004730100002)(2906002)(790700001)(450100001)(1220700001)(66066001)(586003)(102836003)(5008740100001)(5002640100001)(3280700002)(87936001)(9686002)(8676002)(3846002)(6116002)(19617315012)(74316001)(11100500001)(5640700001)(5630700001)(229853001)(2351001)(33656002)(3660700001)(19625215002)(86362001)(5003600100002)(92566002)(16236675004)(2900100001)(50986999)(54356999)(122556002)(99286002)(77096005)(76576001)(1730700003)(81166006)(107886002)(189998001)(8936002)(15975445007)(10400500002)(110136002)(19580395003)(19300405004)(2501003); DIR:OUT; SFP:1101; SCL:1; SRVR:BY2PR09MB1079; H:BY2PR09MB1078.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en;
spamdiagnosticoutput: 1:23
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_BY2PR09MB1078EC77BEF34446BA812A56A5490BY2PR09MB1078namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2016 11:58:22.2665 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: c620dc48-1d50-4952-8b39-df4d54d74d82
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR09MB1079
X-OriginatorOrg: mitre.org
Archived-At: <http://mailarchive.ietf.org/arch/msg/sacm/mg5QjUx1YSlwDHD43Xqt0Wr6ZFk>
Subject: [sacm] FOR REVIEW: Vulnerability Assessment Scenario Issue #7 - Where do vulnerability assessment attributes belong
X-BeenThere: sacm@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: SACM WG mail list <sacm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sacm>, <mailto:sacm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sacm/>
List-Post: <mailto:sacm@ietf.org>
List-Help: <mailto:sacm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sacm>, <mailto:sacm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 May 2016 11:58:37 -0000

During yesterday's virtual interim meeting, we discussed various open issues with respect to the Vulnerability Assessment Scenario [1] as a result of feedback that we received on the draft which you can see here [2][3].  The slide's from the meeting can be found here [4].

One issue that we didn't have a chance to discuss, because we ran out of time, is where do vulnerability assessment attributes belong?  In Appendix D.2 of the Vulnerability Assessment Scenario, there is a list of definitions that describe the various attributes necessary to support the scenario.  Since these definitions really identify information needs for SACM, we would like to propose that we move these attributes to the IM in the form of information elements.

Does this seem like a reasonable approach?  Are there any objections to this approach?  If you have any thoughts on this issue, please provide any feedback by May 31st.  We are planning to have an updated version of the scenario for June 8th.

Thanks,

Danny

[1] https://datatracker.ietf.org/doc/draft-coffin-sacm-vuln-scenario/
[2] https://github.com/sacmwg/vulnerability-scenario/pull/3
[3] https://www.ietf.org/mail-archive/web/sacm/current/msg03958.html
[4] https://datatracker.ietf.org/doc/slides-interim-2016-sacm-3-1/ (looks like the slides are not available just yet, but, I suspect they should be soon)

v2.23.0 | Report a Bug | By Email