Minutes 14 April 2016 TC Meeting

Time: 4:30 PM EDT (-0400 GMT)
Tel: 1-712-775-7031
Access Code: 620-103-760

Minutes for 14 April 2016 TC Meeting

I. Roll Call & Minutes

   Voting Members
   Mohammad Jafari
   Steven Legg
   Rich Levinson
   Hal Lockhart (Co-chair)
   Bill Parducci (Co-chair)
   Martin Smith

 Voting Members: 6 of 9 (67%) (used for quorum calculation)

   Bill Fisher         NCCoE (NIST)
   Sudhi Umarji        NCCoE (NIST)

Approve Minutes 31 March 2016
 https://lists.oasis-open.org/archives/xacml/201603/msg00006.html
   Hal:
    Approved unanimously, no objections heard

II. Administrivia
 NCCOE Presentation Follow-up
  Fisher: 
   I have read through the comments and believe that Martin's point re: the
   business value is quite pertinent. The technical people I have spoken with
   are finding it a challenge to present ROI, so Use Cases that show value
   would be quite useful.
  Hal:
   Yes, this has been an ongoing challenge.
  Martin:
   When I worked for the government such analyses we common. Cost benefit 
   analysis was particularly difficult because attributing costs to 
   maintenance of ACLs, etc. The savings are, I believe, real but represent a 
   challenge to define and require significant estimation.
  Hal:
   What is being compared to is an obvious key point. Framing this in the 
   larger sense can make the more compelling case on the benefit side.
  Martin:
   This can be extended to incorporate things are simply not being done today.
  Hal:
   This can be looked at probabilistic side by looking at a variety of likely 
   scenarios (hacks, reorgs, mergers, etc.)
  Fisher:
   The administrative aspects of audits, management, etc. can also be 
   effective on the cost side. ON the auditing side, the key questions center 
   around on finding: (a) what does a user have access to?; (b) Who has 
   access to X?
  Hal:
   I think many of these questions are not feasible because of things like 
   federation, timing (state) issues. In other words, there are situations 
   where "reversing" a query is not possible.
  Martin:
   I think the questions: (a) what has this person done?; (b) how was he able 
   to see it?; (c) who else may have accessed this?
  Hal:
   All of these are possible today.
  Martin:
   I think that ABAC tends to be an IT project, rather than a Security/Risk 
   project. I think that this is a major roadblock to validation for adoption.
  Rich:
   I don't think technical explanations will get us traction in the market. 
   I think Bill's approach of a plain explanation of benefits in business 
   terms is likely to be more fruitful. I think the work NCCOE is doing is on
   target, especially regarding the deployment processes that are established
   that enable people to apply the technology in a very cost-effective way to
   see if it will work in their environment. 
  Fisher:
    One of the things we have been thinking about in our "1800 series" documents 
    that introduce mechanism that help make decision like, "Is ABAC right for me?" 
    This is where we are trying to develop details to help answer these questions.
  Fisher:
    There is a perception that ABAC has a high barrier (business) to entry because 
    it requires a relatively custom solution. I have been pushing the concept of 
    Oasis coming up with a "standard model" for ABAC that reduce the risk of 
    deployment and lengthy evaluation.
  Hal:
   The reality is that new standards require adoption. The nature of the problem 
   makes this an integration project.
  Fisher:
   This implies that the vendor has tested compatibility. The question remains
   how do you choose a vendor?
  Hal:
   The problem is complex. It has a lot of variables.

  Hal reviewed the topics in the email thread on the list with general
  discussion…

  Sudhi:
   I have heard XACML as being “policy" based while OAuth is "consent" based.
  Hal:
   Consent is just one way of granting access, but it is consistent with policy 
   based access.
  Rich:
   In the OAuth demo there are about 5 places where a policy comes into play in
   the flow. ( https://lists.oasis-open.org/archives/xacml/201604/msg00007.html)

Fisher:
   I will go through the notes and determine what will work as an update to the current document work and then what will require a separate effort.

Hal:
There is general agreement that a follow-up discussion in a month or two would be a good idea.

meeting adjourned.