draft-ietf-sacm-terminology-15.txt		draft-ietf-sacm-terminology-16.txt
	SACM Working Group H. Birkholz		SACM Working Group H. Birkholz
	Internet-Draft Fraunhofer SIT		Internet-Draft Fraunhofer SIT
	Intended status: Informational J. Lu		Intended status: Informational J. Lu
	Expires: December 15, 2018 Oracle Corporation		Expires: June 17, 2019 Oracle Corporation
	J. Strassner		J. Strassner
	Huawei Technologies		Huawei Technologies
	N. Cam-Winget		N. Cam-Winget
	Cisco Systems		Cisco Systems
	A. Montville		A. Montville
	CIS		CIS
	June 13, 2018		December 14, 2018
	Security Automation and Continuous Monitoring (SACM) Terminology		Security Automation and Continuous Monitoring (SACM) Terminology
	draft-ietf-sacm-terminology-15		draft-ietf-sacm-terminology-16
	Abstract		Abstract
	This memo documents terminology used in the documents produced by		This memo documents terminology used in the documents produced by
	SACM (Security Automation and Continuous Monitoring).		SACM (Security Automation and Continuous Monitoring).
	Status of This Memo		Status of This Memo
	This Internet-Draft is submitted in full conformance with the		This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.		provisions of BCP 78 and BCP 79.
	skipping to change at page 1, line 38 ¶		skipping to change at page 1, line 38 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on December 15, 2018.		This Internet-Draft will expire on June 17, 2019.
	Copyright Notice		Copyright Notice
	Copyright (c) 2018 IETF Trust and the persons identified as the		Copyright (c) 2018 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(https://trustee.ietf.org/license-info) in effect on the date of		(https://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect		carefully, as they describe your rights and restrictions with respect
	to this document. Code Components extracted from this document must		to this document. Code Components extracted from this document must
	include Simplified BSD License text as described in Section 4.e of		include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as		the Trust Legal Provisions and are provided without warranty as
	described in the Simplified BSD License.		described in the Simplified BSD License.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
	2. Terms and Definitions . . . . . . . . . . . . . . . . . . . . 2		2. Terms and Definitions . . . . . . . . . . . . . . . . . . . . 2
	3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22		3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 21
	4. Security Considerations . . . . . . . . . . . . . . . . . . . 22		4. Security Considerations . . . . . . . . . . . . . . . . . . . 21
	5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 22		5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 22
	6. Change Log . . . . . . . . . . . . . . . . . . . . . . . . . 22		6. Change Log . . . . . . . . . . . . . . . . . . . . . . . . . 22
	7. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 26		7. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 26
	8. References . . . . . . . . . . . . . . . . . . . . . . . . . 27		8. References . . . . . . . . . . . . . . . . . . . . . . . . . 27
	8.1. Normative References . . . . . . . . . . . . . . . . . . 28		8.1. Normative References . . . . . . . . . . . . . . . . . . 28
	8.2. Informative References . . . . . . . . . . . . . . . . . 28		8.2. Informative References . . . . . . . . . . . . . . . . . 28
	Appendix A. The Attic . . . . . . . . . . . . . . . . . . . . . 29		Appendix A. The Attic . . . . . . . . . . . . . . . . . . . . . 29
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 29		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 29
	1. Introduction		1. Introduction
	skipping to change at page 3, line 14 ¶		skipping to change at page 3, line 14 ¶
	Data Source, an assertion (and therefore a SACM statement,		Data Source, an assertion (and therefore a SACM statement,
	respectively) of the validity of Statement Metadata can by enabled		respectively) of the validity of Statement Metadata can by enabled
	by including corresponding Integrity Evidence created by the Data		by including corresponding Integrity Evidence created by the Data
	Origin.		Origin.
	Assessment: Defined in [RFC5209] as "the process of collecting		Assessment: Defined in [RFC5209] as "the process of collecting
	posture for a set of capabilities on the endpoint (e.g., host-		posture for a set of capabilities on the endpoint (e.g., host-
	based firewall) such that the appropriate validators may evaluate		based firewall) such that the appropriate validators may evaluate
	the posture against compliance policy."		the posture against compliance policy."
	Asset: Is a system resource, as defined in [RFC4949], that may be
	composed of other assets.
	Examples of Assets include: Endpoints, Software, Guidance, or
	X.509 public key certificates. An asset is not necessarily owned
	by an organization.
	Asset Management: The IT process by which assets are provisioned,
	updated, maintained and deprecated.
	Attribute: Is a data element, as defined in [RFC5209], that is		Attribute: Is a data element, as defined in [RFC5209], that is
	atomic.		atomic.
	In the context of SACM, attributes are "atomic" information		In the context of SACM, attributes are "atomic" information
	elements and an equivalent to attribute-value-pairs. Attributes		elements and an equivalent to attribute-value-pairs. Attributes
	can be components of Subjects.		can be components of Subjects, the basic composite definitions
			that are defined in the SACM Information Model.
	Broken remnant of a term again, but this time left here to show how
	much the last submit of -14 broke the document (this is actually not
	a term definition, apparently, but if you are curious this was
	"Authorization", became a second paragraph of expositional text to
	the definition of Attribute and now became the universal disclaimer
	of "please alter the structure of the document with care") - until
	removal by a less annoyed editor:
	Defined in [RFC4949] as "an approval that is granted to a system
	entity to access a system resource."
	Capability: A set of features that are available from a SACM		Capability: A set of features that are available from a SACM
	Component.		Component.
	See also "capability" in [I-D.ietf-i2nsf-terminology].		See also "capability" in [I-D.ietf-i2nsf-terminology].
	In the context of SACM, the extent of a SACM component's ability		In the context of SACM, the extent of a SACM component's ability
	is enabled by the functions it is composed of. Capabilities are		is enabled by the functions it is composed of. Capabilities are
	registered at a SACM broker (potentially also at a proxy or a		registered at a SACM broker (potentially also at a proxy or a
	repository component if it includes broker functions) by a SACM		repository component if it includes broker functions) by a SACM
	skipping to change at page 26, line 20 ¶		skipping to change at page 26, line 8 ¶
	o Pruned some commonly understood terms.		o Pruned some commonly understood terms.
	o Narrowing term labels per their definitions.		o Narrowing term labels per their definitions.
	o In some cases, excised expositional text.		o In some cases, excised expositional text.
	o Where expositional text was left intact, it has been separated		o Where expositional text was left intact, it has been separated
	from the actual definition of a term.		from the actual definition of a term.
			Changes from version 14 to version 16:
			o moved obsolete definitions into the Appendix (attic).
	7. Contributors		7. Contributors
	David Waltermire		David Waltermire
	National Institute of Standards and Technology		National Institute of Standards and Technology
	100 Bureau Drive		100 Bureau Drive
	Gaithersburg, MD 20877		Gaithersburg, MD 20877
	USA		USA
	Email: david.waltermire@nist.gov		Email: david.waltermire@nist.gov
	Adam W. Montville		Adam W. Montville
	skipping to change at page 28, line 21 ¶		skipping to change at page 28, line 21 ¶
	[RFC6933] Bierman, A., Romascanu, D., Quittek, J., and M.		[RFC6933] Bierman, A., Romascanu, D., Quittek, J., and M.
	Chandramouli, "Entity MIB (Version 4)", RFC 6933,		Chandramouli, "Entity MIB (Version 4)", RFC 6933,
	DOI 10.17487/RFC6933, May 2013,		DOI 10.17487/RFC6933, May 2013,
	<https://www.rfc-editor.org/info/rfc6933>.		<https://www.rfc-editor.org/info/rfc6933>.
	8.2. Informative References		8.2. Informative References
	[I-D.ietf-i2nsf-terminology]		[I-D.ietf-i2nsf-terminology]
	Hares, S., Strassner, J., Lopez, D., Xia, L., and H.		Hares, S., Strassner, J., Lopez, D., Xia, L., and H.
	Birkholz, "Interface to Network Security Functions (I2NSF)		Birkholz, "Interface to Network Security Functions (I2NSF)
	Terminology", draft-ietf-i2nsf-terminology-05 (work in		Terminology", draft-ietf-i2nsf-terminology-06 (work in
	progress), January 2018.		progress), July 2018.
	[I-D.ietf-netmod-entity]		[I-D.ietf-netmod-entity]
	Bierman, A., Bjorklund, M., Dong, J., and D. Romascanu, "A		Bierman, A., Bjorklund, M., Dong, J., and D. Romascanu, "A
	YANG Data Model for Hardware Management", draft-ietf-		YANG Data Model for Hardware Management", draft-ietf-
	netmod-entity-08 (work in progress), January 2018.		netmod-entity-08 (work in progress), January 2018.
	[I-D.ietf-sacm-vuln-scenario]		[I-D.ietf-sacm-vuln-scenario]
	Coffin, C., Cheikes, B., Schmidt, C., Haynes, D.,		Coffin, C., Cheikes, B., Schmidt, C., Haynes, D.,
	Fitzgerald-McKay, J., and D. Waltermire, "SACM		Fitzgerald-McKay, J., and D. Waltermire, "SACM
	Vulnerability Assessment Scenario", draft-ietf-sacm-vuln-		Vulnerability Assessment Scenario", draft-ietf-sacm-vuln-
	skipping to change at page 29, line 11 ¶		skipping to change at page 29, line 11 ¶
	[RFC6192] Dugal, D., Pignataro, C., and R. Dunn, "Protecting the		[RFC6192] Dugal, D., Pignataro, C., and R. Dunn, "Protecting the
	Router Control Plane", RFC 6192, DOI 10.17487/RFC6192,		Router Control Plane", RFC 6192, DOI 10.17487/RFC6192,
	March 2011, <https://www.rfc-editor.org/info/rfc6192>.		March 2011, <https://www.rfc-editor.org/info/rfc6192>.
	[X.1252] "ITU-T X.1252 (04/2010)", n.d..		[X.1252] "ITU-T X.1252 (04/2010)", n.d..
	Appendix A. The Attic		Appendix A. The Attic
	The following terms are stashed for now and will be updated later:		The following terms are stashed for now and will be updated later:
			Asset: Is a system resource, as defined in [RFC4949], that may be
			composed of other assets.
			Examples of Assets include: Endpoints, Software, Guidance, or
			X.509 public key certificates. An asset is not necessarily owned
			by an organization.
			Asset Management: The IT process by which assets are provisioned,
			updated, maintained and deprecated.
	Asset Characterization: Asset characterization is the process of		Asset Characterization: Asset characterization is the process of
	defining attributes that describe properties of an identified		defining attributes that describe properties of an identified
	asset.		asset.
	Asset Targeting: Asset targeting is the use of asset identification		Asset Targeting: Asset targeting is the use of asset identification
	and categorization information to drive human-directed, automated		and categorization information to drive human-directed, automated
	decision making for data collection and analysis in support of		decision making for data collection and analysis in support of
	endpoint posture assessment.		endpoint posture assessment.
	Client: An architectural component receiving services from another		Client: An architectural component receiving services from another
End of changes. 10 change blocks.
	29 lines changed or deleted		24 lines changed or added
This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/