Proposed SACM Architecture Ad-hoc SACM Arch team July 2014

Proposed SACM Architecture Draft-camwinget-sacm-architecture-00 posted in June 2014 Architecture defines the components or “actors” that communicate or interface with each other The interfaces define the means by which Posture Information (e.g. data model) is sent or received The means by which a provider or requestor can provide its metadata and address security access controls is defined through a “control plane”

Why a Control Plane? Control Plane is an abstraction layer to facilitate: – Secure communications between a requestor and a publisher of Posture Information – Registration of new data models and transport – Discovery of existing/supported data models transport

SACM Architecture - Conceptual Posture Assessment Information Requestor Broker/Proxy/Repository: authZ, directory, metadata/capability Posture Assessment Information Requestor Posture Assessment Information Provider An individual actor (such as a posture assessment validator) may act as both an information requestor and an information provider. Different types of information providers may offer different types / levels of information (e.g. metadata or data profile) Control Plane Data Plane

Posture Assessment Information Provider Posture Assessment Information Provider Posture Assessment Information Provider Posture Assessment Information Provider Conceptual architecture based on Use Cases Posture Collector Posture Validator Posture Assessment Information Provider Posture Assessment Information Provider Posture Aggregator Application Driven thru a single Information Model /Taxonomy Posture Assessment (Info) Requestor Admin Posture Assessment (Info) Requestor Sensor Posture Assessment (Info) Requestor Other

SACM Architecture - Example Sensor [P] Posture Aggregator [RP] IDS [P] Posture Collector [P] Posture Validator [RP] Analytics Engine [R] Other [R] Endpoint Assessment [P] AAA [RP] Dashboard [R] Physical Security [RP] Response [RP] Control Plane Broker Proxy Repository [P]=Posture Assessment Information Provider [R] = Posture Assessment Information Requestor Analysis [RP] Vulnerability Scanner [RP] SIM / SEM [RP] Other [P] CMDB [RP]

Next steps Comments provided by David Waltemire: – More text required to define “roles”: consumer/producer and entities that can behave as both – More text to fit in the different Posture functions (e.g. Collector, Validator) – More text to distinguish operations employed in the control plane vs. data plane More feedback please!

Q & A