Adam, thank you for taking the time to make such extensive edits. The
document flows a lot better now, and is much easier to read. Danny, Charles
and I collaborated on our review, and made some additional edits to your
work. They are attached to this email.There are some edits we would like to
call out for particular attention by the group:

   - We got ourselves confused by the definition for Vulnerability
   Management Capability. We added some clarifying (to us) text, so the
   definition now reads: "an enterprise IT capability managing endpoint
   vulnerabilities and associated metadata on an ongoing bases *by
   ingesting vulnerability description information and vulnerability detection
   data, and performing a vulnerability assessment*".
   - Throughout the document, we made changes to clarify when we were
   talking about vulnerability detection information and vulnerability
   detection data.
   - We added a definition for Target Collection (referenced in Section 5
   and previously undefined). It reads: "The task of collecting specific
   endpoint information from the target endpoint in order to make a
   determination about that endpoint (vulnerability status, identification,
   etc.)". We're not sure we are happy with it, though. See open issue #3.
   - We added some clarifying words to the beginning of Section 4.
   - In section 4.2, we changed "vulnerability assessment flow" to
   "vulnerability assessment". They seemed equivalent the way they were being
   used in this document, and "vulnerability assessment flow" didn't appear
   anywhere else in the document.
   - We clarified the text in Section 5 regarding vulnerability detection.
   Previously, it read: Vulnerability detection may be done in a number of
   ways, depending upon the specific vulnerability", followed by a bulleted
   list of endpoint information that may be used to detect a vulnerability. It
   now reads:  Vulnerability detection relies on the examination of
   different endpoint information depending on the nature of a specific
   vulnerability. Common endpoint information used to detect a vulnerability
   includes:", followed by the same bulleted list.
   - We reworded the fourth paragraph in Section 5 (beginning, "The breadth
   of information required. . ." for clarity.
   - In Section 5, paragraph 5, we substituted "vulnerability assessment
   capability" for "vulnerability assessment mechanism".

There are still questions remaining after our review. We would like to get
the work groups feedback on the edits list above, as well as on the
following open issues:

1) We need to determine which items in Section 2 ("Terminology") should be
pulled from the Vulnerability Assessment Scenario and included in the
SACM-wide Terminology draft. Those terms which are only used in the
Vulnerability Assessment Scenario should be defined in this document;
however, any of these terms that will be reused in other SACM documents
should be defined in the Terminology draft.

2) In Section 2 ("Terminology"), vulnerability detection data is defined as
"a representation of vulnerability description information describing
specific mechanisms of vulnerability detection". We interpret this to mean
that vulnerability detection data is a representation of vulnerability
description information that can be used by network tools that participate
in the vulnerability assessment process. Does the group agree that is the
case? If so, is vulnerability detection data a type of guidance, as
described in the SACM Information Model?

3) Regarding the definition of Targeted Collection:
     a) Does targeted collection refer to a server explicitly requesting
additional information from the endpoint to supplement automated
collection? Should the definition be more precise?
     b) Is "targeted collection" even the right term to use in Section 5?
It makes other forms of collection sound un-targeted. Would "supplemental
collection" be a better term?

4) In Section 3, the first bullet states that vulnerability description
[information]  is processed "into a format that the enterprise's security
software tools can understand and use". Is that the equivalent of saying
that the vulnerability description information can be processed into
vulnerability detection data? And is this also equivalent to what we are
trying to say in the third bullet, when we say "The enterprise has a means
of extracting relevant information about enterprise endpoints in a form
that is compatible with the
​ ​
vulnerability description information"?

5) Section 5, paragraph 5 states: "the information beyond that which is
available in the endpoint management
​ ​
capability can be pushed to the vulnerability assessment capability by the
endpoint whenever that information changes". However, we feel this must
necessarily be an information pull, not a push, since the endpoint cannot
know what information is needed until the server requests it. Does the
group agree?

6) Appendix B, paragraph 2 states: "Moreover, the scenario incorporates
long-term storage of collected data, vulnerability description information,
and
​ ​
assessment results in order to facilitate meaningful and ongoing reassessment."
At the SACM side-meeting, there was tentative agreement that SACM was
concerned with data-in-motion, not data-at-rest. Is clarifying language
needed here to address that concern?

​7) Appendix D.2 seems more appropriate for the information model, rather
than this document. Does the group agree?​

We're looking forward to hearing everyone's feedback.

Jess

On Fri, Apr 8, 2016 at 12:06 PM, adammontville <notifications@github.com>
wrote:

> I should also disclose that while I referenced the data table, I did not
> take the time to update the column headers of that table or to add to it,
> if necessary. Personally, I like the idea of referencing the data table,
> but I understand that others may view the world differently.
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly or view it on GitHub
> <https://github.com/sacmwg/vulnerability-scenario/issues/4#issuecomment-207495214>
>
> _______________________________________________
> sacm mailing list
> sacm@ietf.org
> https://www.ietf.org/mailman/listinfo/sacm
>
>