Subject: [saag] Side Meeting on Security Automation and Continuous Monitoring (SACM)

From: <[email-masked]>
Date: Wed, 28 Mar 2012 11:51:01 -0400

Hello,

Here is a brief summary from the SACM side meeting held on Sunday from 11AM-1PM.

SACM Side Meeting Summary:
Security Automation and Continuous Monitoring (SACM pronounced sack-em)
    https://www.ietf.org/mailman/listinfo/sacm

The meeting minutes have been posted to the mailing list: 
     http://www.ietf.org/mail-archive/web/sacm/current/msg00176.html.
The group is interested in a use case to automate security assessment and control validation to attain situational awareness.  The idea is to pull together existing efforts (IETF, possibly moving some into the IETF, and new), creating mappings where necessary to first enable continuous monitoring (understand the current environment – systems, devices, etc.) and then risk posture analysis.  

The group will start on a use case document, explaining connections to existing IETF efforts (NEA, MILE, Netconf, IPFIX, SNMP, etc.) and identifying where new work is needed.  Then work on a charter and begin the development of documents to support the use case.  An *initial* cut at the abstract for the use case document from Dave Waltermire is included:

"This draft identifies fundamental use cases, derived functional capabilities and requirements, architectural components, and the supporting standards needed to define the interoperable, automation infrastructure required to support timely, accurate and actionable situational awareness over an organization’s IT infrastructure.  Automation tools implementing a continuous monitoring approach will utilize this infrastructure to provide visibility into the state of assets, user activities and network behavior.  Stakeholders will be able to use these tools to understand the organizations security posture, quantify business risk, and make informed decisions that support organizational objectives while protecting critical information.  Other automation tools will be able to leverage information provided by this infrastructure to enforce policies based on human decisions."
 
The group could benefit from additional IETF help, especially from the security, application, and operation areas.  

Thank you,
Kathleen