[Recommendation] discovery scan type for Networks in OSCAL

[brian-ruf]

For "network" components there should be forth scan type: "discovery", which indicates the scan is intended to identify actual assets on the network.

This has always been an implied part of the "infrastructure" scan type; however, that scan type is more about drilling into the nodes for deeper analysis. Discovery is actually a related, yet separate activity.

For networks, only a discovery scan makes sense. Any nodes found on the network are then subject to the infrastructure scan, and other scans as appropriate.

Proposal

Expand the allowed-values for the "scan-type" prop (FedRAMP Extension) to allow "discovery" only for networks. This includes "network" component and any inventory-item either with the "asset-type" prop" set to "network" or the implemented-component` field linked to a network.

[aj-stein-gsa]

Hello again, @brian-ruf. 😄 👋 I agree that this work is actually an interesting proposal, definitely worth of consideration and possible work. We need to have a think on whether such a change is integral to an upcoming v3.0.0-milestone1 release. We will follow up in comments accordingly. I will move into the backlog, but not mark it as ready.

[brian-ruf]

It definitely requires coordination with the ConMon team and community feedback. For now it's fair to stick with 'infrastructure' as the scan type for networks with the understanding that only the discovery portion of an infrastructure scan is possible. This suggestion was simply in the spirit of "being more accurate with OSCAL".