NEA Requirements Update -06 version summary

Posture Transport Considerations Issue –Ability of existing protocols used for network access to meet requirements for PT. Large data volumes Server initiated reassessment Resolution –Added text to Section of -06 version that acknowledges constraints of certain candidate PT protocols and suggests a couple of deployment considerations. Deployment perform limited assessment during network connections while using a constrained posture transport Limited network access granted to allow a full posture assessment to happen over TCP based transport.

Security Considerations Issues –Active man-in-the-middle attacks on NEA deployments. –Attacks on components that trigger posture assessment Resolution –Section already describes mechanisms for protecting NEA protocols against passive and active MITM attacks. –Protection against “lying” endpoints is out of scope of NEA protocols as described in the charter. –Protection of triggers for posture assessment are out of scope. Added text to Section 8 of -06 version to clarify and suggest implementations address this issue.

Other comments Need to expand NEA Reference Model to include entities that initiate posture assessment and consume posture results. –These entities are out of scope as per charter. Scalability concerns when a large number of endpoints require simultaneous assessment. –Assertion attributes address this at a protocol level. –Deployment policies are out-of-scope. Gen ART review –Addressed comments in -06 version.