Draft: draft-ietf-sacm-terminology

Commentary: Point to the editors copy and to the diff of the rfcs .
Asset targeting is the use of asset identification and
categorization information to drive human-directed, automated
decision making for data collection and analysis in support of
endpoint posture assessment.
An entity providing and/or connecting services on the behalf of
other architectural components.  Within the SACM Architecture, for
example, a broker may provide authorization services and find,
upon request, entities providing requested services.
For SACM, a building block is a unit of functionality that may
apply to more than one use case and can be supported by different
components of an architectural model.
The extent of an architectural component's ability.  For example,
a Posture Information Provider may only provide endpoint
management data, and then only a subset of that data.
An architectural component receiving services from another
architectural component.
The process by which posture attributes or values are collected.
A standard SACM component providing and/or connecting services on
the behalf of other SACM components via the control plane.  Within
the SACM Architecture, for example, a broker may provide
authorization services and find, upon request, SACM components
providing requested services.
For SACM, a building block is a unit of functionality that is used
to compose SACM components.  It contains functions and may apply
to one or more use cases.  A Building Block can have interfaces on
the data plane, the control plane, or on the management plane.
The extent of an SACM component's ability enabled by the building
blocks it is composed of.  For example, a Posture Information
Provider may only provide endpoint management data, and then only
a subset of that data.
The task by which endpoint attributes and/or corresponding
attribute values are collected.
One or more properties that enable a SACM component to identify an
Endpoint that is claimed to be the original source of received
data.
A historical record of the origins and evolution of data that is
influenced by inputs, entities, functions and processes.
The process by which posture attributes are evaluated.
The endpoint of interest.
The process by which an endpoint can be identified.
A behavioral aspect of a particular architectural component, which
belies that component's purpose.  For example, the Management
Plane can provide a brokering function to other SACM architectrual
components.
An information model is an abstract representation of data, their
properties, relationships between data and the operations that can
be performed on the data.  While there is some overlap with a data
model, RFC3444 distinguished an information model as being
protocol and implementation neutral whereas a data model would
provide such details.
The task by which endpoint attributes are evaluated.
A behavioral aspect or capacity of a particular building block,
which belies that building blocks's purpose.  For example, a
building block on the control plane can provide a brokering
function to other SACM components.  On the data plane, a function
can act as a provider and/or as a consumer of information.
An information model is an abstract representation of data, their
properties, relationships between data and the operations that can
be performed on the data.  While there is some overlap with a data
model, RFC3444 distinguishes an information model as being
protocol and implementation neutral whereas a data model would
provide such details.
This term is used within the scope of this document to represent
the state information that is collected from an endpoint (e.g.
software/hardware inventory, configuration settings).  The state
information may constitute one to many Posture Attributes.
This term is used within the scope of SACM to represent the
configuration and state information that is collected from an
endpoint (e.g. software/hardware inventory, configuration
settings, dynamically assigned addresses).  This information may
constitute one to many Posture Attributes.
Within this document this term represents a specific assertion
about endpoint state (e.g. configuration setting, installed
software, hardware).  The phrase "features of the endpoint" refers
to installed software or software components.
Within this document this term represents a specific assertion
about endpoint configuration or state (e.g. configuration setting,
installed software, hardware).  The phrase "features of the
endpoint" refers to installed software or software components.
A label representing a collection of functions provided by a
particular architectural component.
A label representing a collection of building blocks (containing
functions and composing SACM components) residing on a particular
endpoint.  If a particular endpoint does not contain any SACM
components it takes on the role of a target endpoint unless
indicated otherwise.
A composition of building blocks that contain control plane, data
plane or management plane functions.  SACM defines a set of
standard components (e.g. a collector, a broker, or a data store).
A SACM component MUST contain at least a basic set of control
plane building blocks and MAY contain data plane and managment
plane building blocks.  A SACM component residing on an endpoint
assigns one or more SACM roles to the corresponding endpoint.  A
SACM component "resides on" an endpoint and an endpoint "contains"
a SACM component, correspondingly.
The function by which a SACM component (or subsets, such as SACM
roles or other functions) can be discovered.
A target endpoint is a SACM Role.  An endpoint that takes on the
target endpoint role either contains no SACM component or contains
an internal SACM component.  A target endpoint is an "endpoint
under assessment" (even if it is not actively under assessment at
all times).  If an endpoint takes on both the role of target
endpoint and _Not A Target Endpoint_ [TBD] it is not a Target
Endpoint.
A target endpoint is similar to a device that is a Target of
Evaluation (TOE) as defined in Common Criteria.
The function by which target endpoints can be discovered.
Added simple list of terms extracted from UC draft -05.  It is
expected that comments will be received on this list of terms as to
whether they should be kept in this document.  Those that are kept
will be appropriately defined or cited.
Removed Section 2.1.  Cleaned up some editing nits; broke terms into
2 sections (predefined and newly defined terms).  Added some of the
relevant terms per the proposed list discussed in the IETF 89
meeting.
Added simple list of terms extracted from UC draft -05.  It is
expected that comments will be received on this list of terms as
to whether they should be kept in this document.  Those that are
kept will be appropriately defined or cited.
Removed Section 2.1.  Cleaned up some editing nits; broke terms
into 2 sections (predefined and newly defined terms).  Added some
of the relevant terms per the proposed list discussed in the IETF
89 meeting.
Added placeholders for missing change log entries.
Added Contributors section.
Updated author list.
Changed title from "Terminology for Security Assessment" to
"Secure Automation and Continuous Monitoring (SACM) Terminology".
Changed abbrev from "SACM-Terms" to "SACM Terminology".
Added appendix The Attic to stash terms for future updates.
Added Authentication, Authorization, Data Confidentiality, Data
Integrity, Data Origin, Data Provenance, SACM Component, SACM
Component Discovery, Target Endpoint Discovery.
Major updates to Building Block, Function, SACM Role, Target
Endpoint.
Minor updates to Broker, Capability, Collection Task, Evaluation
Task, Posture.
Relabled Role to SACM Role, Endpoint Target to Target Endpoint,
Endpoint Discovery to Endpoint Identification.
Moved Asset Targeting, Client, Endpoint Identification to The
Attic.
Endpoint Attributes added as a TODO.