A New Internet-Draft is available from the on-line Internet-Drafts directories.
Title : OVAL and the SACM Information Model
Authors : Matthew Hansbury
Daniel Haynes
Juan Gonzalez
Filename : draft-hansbury-sacm-oval-info-model-mapping-01.txt
Pages : 23
Date : 2015-11-09
Abstract:
The OVAL community has spent more than ten years developing and
employing the OVAL Language. During this time, the community has
made a number of design decisions and learned a number of lessons
that should be leveraged as next generation endpoint posture
assessment is formulated. There are a number of places throughout
the SACM Information Model document that could be fulfilled by
portions of the OVAL Language, either in its current state or, in
some cases, with modifications. Another output of the work executed
under the OVAL project is a number of lessons that are applicable to
the SACM work. These lessons include a clear separation of data
collection and evaluation; a call to focus on ensuring both primary
source vendors and third party security experts feel invited to the
discussion and are empowered to leverage their unique domain
knowledge; and to strive for simplicity and flexibility, where
possible. Finally, the OVAL community has a set of clear
recommendations with respect to which parts of OVAL should be used by
SACM as a means to make best use of the efforts of those that have
worked on and supported OVAL over the past ten years. Those
recommendations are:
o Use the OVAL System Characteristics Model as a base data model for
at least one way to provide data collection.
o Use the OVAL Definitions Model in parts as a base data model for
both evaluation and collection guidance.
o Do not use the OVAL Results Model for a data model to encode
evaluation results.
The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-hansbury-sacm-oval-info-model-mapping/
There's also a htmlized version available at:
https://tools.ietf.org/html/draft-hansbury-sacm-oval-info-model-mapping-01
A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-hansbury-sacm-oval-info-model-mapping-01
Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
_______________________________________________
I-D-Announce mailing list
I-D-Announce@ietf.org
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
