RE: Things to do - Requirement Document. Security.

[Krishna Sankar <ksankar@cisco.com>]

Michael,

	Are you talking about security *only* or more ? I have a hard time
understanding which angle you are coming from. From your note, it looks like
you are talking about general voting system and not just security.

	Second, from what I see, your view is a technology view. This group has to
balance the technology view as well as the sociological view. A security
discussion *without* the environment it is going to support, would be a
security standards document not a *voting* security standards document. The
SAML (Security Assertions Markup Language) committee is the vehicle for that
kind of pure security activity.

	Third, we are not defining or redefining the voting systems, but adding
value by supporting the existing and new voting processes using XML and
related technologies. So in our domain model we have to *refer* to or
generically define the domain, the different voting systems, the interfaces
and the information they exchange.

	The processes we support would come from existing manual and automatic
systems, inside and outside US and even from folks who have new ideas. We do
need to capture and articulate the use cases we plan to support and develop
the specification to those use cases.

	We would, of course, refer to existing documents and then generalize them
in our domain model/use case documents. I am talking about the specification
not security alone. The security requirements themselves come from these
documents, the use cases and the domain model. There are no separate
security requirements independent of the domain.

	I do not know where you got the impression that we are re-defining the
voting systems. It is probable that I had created that impression in one of
my e-mails. Pl let me know where and if it is in my e-mail, I will clarify
it, No problems.

	I do like your idea of categorizing the different areas and if you want to
do that, may be that could clear up some of the confusion.

cheers