Kick off charter discussion and finalize

[adammontville]

Publish the v2 charter for discussion, and get discussion going on it, so that we can really do it.

[adammontville]

A draft charter was posted to the mailing list: https://mailarchive.ietf.org/arch/msg/sacm/O1GxmdrJrWRLA5xpEE0RP4PgWw0

Please opine on the charter specifically on mailing list - we'll leave this issue "in progress" until the charter is finalized. I encourage everyone to offer their support and/or constructive suggestions for the charter.

[adammontville]

We're closing this issue in the context of the hackathon - recharter will be submitted soon, seems like all comments are in.

[sacm]

Hello, I reviewed the charter and have a few comments that should be addressed before this goes to the IESG. It seems text limiting the scope to the enterprise was removed (or I don't see it). This is important as it limits the scope of privacy and security concerns, so it should somehow be added back in. Additionally, clearly stating that the reach of SACM is to a managed administrative domain where there is secured (authenticated and encrypted) access to gather information is also important. If YANG modules (for instance) already exist and the information can be gathered my the administrator, then that will reduce the privacy concerns that would be raised with work like this that lets you have visibility into devices and their profiles. Thank you, Kathleen

…

On Thu, Sep 14, 2017 at 11:52 AM, adammontville ***@***.***> wrote: A draft charter was posted to the mailing list: https://mailarchive.ietf.org/arch/msg/sacm/O1GxmdrJrWRLA5xpEE0RP4PgWw0 Please opine on the charter specifically on mailing list - we'll leave this issue "in progress" until the charter is finalized. I encourage everyone to offer their support and/or constructive suggestions for the charter. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#31 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AKbE0W2HDXc8gVUyg8zmxFA3uqNJaC6-ks5siUvPgaJpZM4PUrbB> . _______________________________________________ sacm mailing list ***@***.*** https://www.ietf.org/mailman/listinfo/sacm

-- Best regards, Kathleen

[adammontville]

Kathleen, thanks for your comments. Let's segment your comments into two: 1) we are talking about enterprises, not individuals or home networks, and 2) we are, consequently, talking about managed administrative domains.

I think both of these can be addressed in the first paragraph. Here's how it reads now:

Securing information and the systems that store, process, and transmit that information is a challenging task for organizations of all sizes, and many security practitioners spend much of their time on manual processes. Standardized protocols and models aiding collection and evaluation of endpoint attributes enables automation, thus freeing practitioners to focus on high priority tasks.

While I believe this paragraph implicitly scopes our effort to enterprise scenarios, which carries with it the implication of managed environments, we could gain some mileage by replacing "organizations" (and variants) with "enterprises" (and variants) as appropriate. We may also insert some additional text to move the implicit to the explicit. Perhaps something like the following (emphasis to show changes):

Securing information and the systems that store, process, and transmit that information is a challenging task for enterprises of all sizes, and many security practitioners spend much of their time on manual processes. Standardized protocols and models aiding collection and evaluation of endpoint attributes in such enterprise-managed environments enables automation, thus freeing practitioners to focus on high priority tasks.

These changes would seem to address the two concerns you raise right up front, which leaves the rest of the charter to focus more on what the group intends to work on.

Thoughts?

[adammontville]

Handling the remainder of this discussion, if any is still to be had, on the list and not in this GitHub issue.