From yuri@unix.ru Sat Jun 4 00:44:26 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 001E8E065A for ; Sat, 4 Jun 2011 00:44:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.977 X-Spam-Level: X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cf5WaZh9gsnh for ; Sat, 4 Jun 2011 00:44:25 -0700 (PDT) Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by ietfa.amsl.com (Postfix) with ESMTP id CD4E4E066A for ; Sat, 4 Jun 2011 00:44:24 -0700 (PDT) Received: by wwa36 with SMTP id 36so1580572wwa.13 for ; Sat, 04 Jun 2011 00:44:23 -0700 (PDT) Received: by 10.227.204.129 with SMTP id fm1mr2799441wbb.39.1307173463316; Sat, 04 Jun 2011 00:44:23 -0700 (PDT) MIME-Version: 1.0 Sender: yuri@unix.ru Received: by 10.227.205.65 with HTTP; Sat, 4 Jun 2011 00:44:03 -0700 (PDT) In-Reply-To: References: From: Yuri Ryazantsev Date: Sat, 4 Jun 2011 11:44:03 +0400 X-Google-Sender-Auth: uOlS7ZM2bDH_JYUcU11UuFh3hmA Message-ID: To: kathleen.moriarty@emc.com Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: yuri@cair.ru List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Jun 2011 07:46:50 -0000 Hello, Kathleen! I apologize for the delay in replying - been on vacation. I would like to add to the list of proposed extensions: "Misuse enumeration and classification. Extensions to the IODEF-document class for reporting misuse". Short description: "he Extensions to the IODEF-Document Class for Reporting Misuse Recommendation extends the Incident Object Description Exchange Format (IODEF) defined in RFC 5070 to support the reporting of misuse incidents. These extensions are flexible enough to support information gleaned from activities throughout the entire intrusion detection cycle where authorized users of the systems attempt to gain additional privileges for which they are not authorized, and authorized users who misuse the privileges given them." Thank you! Yuri. On Tue, May 31, 2011 at 19:17, wrote: > To follow up from the data sharing restrictions/markings discussion, a ne= w IODEF extension should be added to the list for the purpose of charter di= scussions and additional guidance for RID will be needed. > > Here is what we have right now for the list of extensions: > * =A0 =A0 =A0 Mail abuse (from MARF WG) - would like the name of a volunt= eer > * =A0 =A0 =A0 Forensic data (Youn-Hee Gil and Dowon Hong) > * =A0 =A0 =A0 Virtualized environments (NIST Cloud WG participants: Matt = Smith and Phil Cox) > * =A0 =A0 =A0 Malicious infrastructure - REN-ISAC? > * =A0 =A0 =A0 Actor profiles - REN-ISAC? > * =A0 =A0 =A0 Malicious code characteristics - REN-ISAC? > * =A0 =A0 =A0 Integrating SCAP Content (may be through one of the above) > * =A0 =A0 =A0 Financial transaction/fraud - review/change RFC5901 > * =A0 =A0 =A0 =A0 Data sharing restrictions/markings (we can change and e= volve the name) > > We do need more editors, so please volunteer if the areas are of interest= . =A0Having multiple editors on a document is welcome. > > Can anyone volunteer to assist with an extension template and guidance do= cument? > > > We have also had requests for guidance on other use cases, so we may need= to factor that in as well. =A0Yuri from the ITU-T has expressed interest i= n guidance for misuse. > > Thank you! > Kathleen > > -----Original Message----- > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of k= athleen.moriarty@emc.com > Sent: Thursday, May 19, 2011 4:46 PM > To: mile@ietf.org > Subject: [mile] MILE Kick-off message > > Hello! > > Thank you for joining the MILE mailing list! =A0We are looking forward to= increased collaboration and progress in this space. =A0The message below b= egins with a summary from the mailing list welcome message and then leads i= nto several topics for discussion to assist with charter and scope of work = development. =A0We look forward to your feedback! > > Welcome Message/Initial Goals: > > The MILE pre-working group will initially be focused on the development o= f a charter and scope of work effort for standards and extensions to meet t= he needs of a global community interested in sharing, exchanging, and handl= ing incidents. =A0Collaboration and sharing experiences with the data model= or use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC5= 901), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045,= RFC6046) standards will improve any solutions created to enable collaborat= ion for incident response and sharing. =A0This list is for charter and pre-= WG technical discussion about MILE, =A0which intends to describe a subset o= f IODEF aimed at exchanging easily readable incident information focused on= those things which people actually exchange. =A0 Extensions needed by the = IODEF and RID community to ensure current relevant use cases for the exchan= ge of incident information may also be discussed. > > Questions for the List: > > The above welcome statement calls out specifically the goal of the list: = "This list is for charter and pre-WG technical discussion about MILE, =A0wh= ich intends to describe a subset of IODEF aimed at exchanging easily readab= le incident information focused on those things which people actually excha= nge." > > * =A0 =A0 =A0 Are there opinions or thoughts on what is needed by the WG = to achieve this goal? > > We have had several volunteers come forward offering to initiate work on = extensions to IODEF. =A0Having a template with guidance on what is required= in an extension document would be a very useful start. =A0We are looking f= or volunteers to help create this template and guidance. > > * =A0 =A0 =A0 What are your thoughts on a template (maybe based off of RF= C5901) before we move into the creation/modification of any IODEF extension= s? > > Here is the list of proposed extensions with some volunteer editors liste= d (more are welcome). =A0Is this the right list of extensions? > > * =A0 =A0 =A0 Mail abuse (from MARF WG) > * =A0 =A0 =A0 Forensic data (Youn-Hee Gil and Dowon Hong) > * =A0 =A0 =A0 Virtualized environments (NIST Cloud WG participants: Matt = Smith and Phil Cox) > * =A0 =A0 =A0 Malicious infrastructure - REN-ISAC? > * =A0 =A0 =A0 Actor profiles - REN-ISAC? > * =A0 =A0 =A0 Malicious code characteristics - REN-ISAC? > * =A0 =A0 =A0 Integrating SCAP Content (may be through one of the above) > * =A0 =A0 =A0 Financial transaction/fraud - review/change RFC5901 > > > Best regards, > Kathleen, Brian, & Tom > > > > > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile > > --=20 Yuri Ryazantsev From kathleen.moriarty@emc.com Mon Jun 6 05:58:34 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5815511E8138 for ; Mon, 6 Jun 2011 05:58:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lbEnZGMKsYqw for ; Mon, 6 Jun 2011 05:58:33 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 4F80C11E8133 for ; Mon, 6 Jun 2011 05:58:30 -0700 (PDT) Received: from hop04-l1d11-si03.isus.emc.com (HOP04-L1D11-SI03.isus.emc.com [10.254.111.23]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56CwRhn025969 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 6 Jun 2011 08:58:27 -0400 Received: from mailhub.lss.emc.com (mailhub.lss.emc.com [10.254.221.253]) by hop04-l1d11-si03.isus.emc.com (RSA Interceptor); Mon, 6 Jun 2011 08:58:19 -0400 Received: from mxhub20.corp.emc.com (mxhub20.corp.emc.com [10.254.93.49]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56Cvf2Z031613; Mon, 6 Jun 2011 08:57:41 -0400 Received: from mx06a.corp.emc.com ([169.254.1.35]) by mxhub20.corp.emc.com ([10.254.93.49]) with mapi; Mon, 6 Jun 2011 08:57:41 -0400 From: To: Date: Mon, 6 Jun 2011 08:57:38 -0400 Thread-Topic: [mile] MILE Kick-off message Thread-Index: AcwkR9sMXlZ8h/FPRwqHPnxzerUqnQAAI2Hw Message-ID: References: <20110606123330.GO5482@MacGaus.cisco.com> In-Reply-To: <20110606123330.GO5482@MacGaus.cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2011 12:58:34 -0000 Thank you, Gaus! We can have multiple editors on drafts if others want to assist as an edito= r. This document will require a lot of collaboration to determine an agree= able approach. =20 We can look into holding a BoF at the July IETF. If we do that, it may be = good to get a review of a few different approaches to help solve this issue= before drafts are written. From the discussions to date, it seems it will= be a mix of a guidance for IODEF and RID as well as an extension to IODEF. Brian Trammell suggested also using Webex or some other method to enhance t= he remote experience as many of you have not attended an IETF yet and we wo= uld like to ensure you can participate if you can't attend. Typically, the= re are jabber sessions running as well to help remote participants. Best regards, Kathleen -----Original Message----- From: Damir Rajnovic [mailto:gaus@cisco.com]=20 Sent: Monday, June 06, 2011 8:34 AM To: Moriarty, Kathleen Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message Hi, I can take on Data sharing restrictions/markings Gaus On Tue, May 31, 2011 at 11:17:08AM -0400, kathleen.moriarty@emc.com wrote: > To follow up from the data sharing restrictions/markings discussion, a ne= w IODEF extension should be added to the list for the purpose of charter di= scussions and additional guidance for RID will be needed. =20 >=20 > Here is what we have right now for the list of extensions: > * Mail abuse (from MARF WG) - would like the name of a volunteer > * Forensic data (Youn-Hee Gil and Dowon Hong) > * Virtualized environments (NIST Cloud WG participants: Matt Smith = and Phil Cox) > * Malicious infrastructure - REN-ISAC? > * Actor profiles - REN-ISAC? > * Malicious code characteristics - REN-ISAC? > * Integrating SCAP Content (may be through one of the above) > * Financial transaction/fraud - review/change RFC5901 > * Data sharing restrictions/markings (we can change and evolve the name= ) >=20 > We do need more editors, so please volunteer if the areas are of interest= . Having multiple editors on a document is welcome. >=20 > Can anyone volunteer to assist with an extension template and guidance do= cument? >=20 >=20 > We have also had requests for guidance on other use cases, so we may need= to factor that in as well. Yuri from the ITU-T has expressed interest in = guidance for misuse. >=20 > Thank you! > Kathleen >=20 > -----Original Message----- > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of k= athleen.moriarty@emc.com > Sent: Thursday, May 19, 2011 4:46 PM > To: mile@ietf.org > Subject: [mile] MILE Kick-off message >=20 > Hello! >=20 > Thank you for joining the MILE mailing list! We are looking forward to i= ncreased collaboration and progress in this space. The message below begin= s with a summary from the mailing list welcome message and then leads into = several topics for discussion to assist with charter and scope of work deve= lopment. We look forward to your feedback! >=20 > Welcome Message/Initial Goals: >=20 > The MILE pre-working group will initially be focused on the development o= f a charter and scope of work effort for standards and extensions to meet t= he needs of a global community interested in sharing, exchanging, and handl= ing incidents. Collaboration and sharing experiences with the data model o= r use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC590= 1), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045, R= FC6046) standards will improve any solutions created to enable collaboratio= n for incident response and sharing. This list is for charter and pre-WG t= echnical discussion about MILE, which intends to describe a subset of IODE= F aimed at exchanging easily readable incident information focused on those= things which people actually exchange. Extensions needed by the IODEF an= d RID community to ensure current relevant use cases for the exchange of in= cident information may also be discussed. >=20 > Questions for the List: >=20 > The above welcome statement calls out specifically the goal of the list: = "This list is for charter and pre-WG technical discussion about MILE, whic= h intends to describe a subset of IODEF aimed at exchanging easily readable= incident information focused on those things which people actually exchang= e." >=20 > * Are there opinions or thoughts on what is needed by the WG to ach= ieve this goal? >=20 > We have had several volunteers come forward offering to initiate work on = extensions to IODEF. Having a template with guidance on what is required i= n an extension document would be a very useful start. We are looking for v= olunteers to help create this template and guidance. >=20 > * What are your thoughts on a template (maybe based off of RFC5901)= before we move into the creation/modification of any IODEF extensions? >=20 > Here is the list of proposed extensions with some volunteer editors liste= d (more are welcome). Is this the right list of extensions? >=20 > * Mail abuse (from MARF WG) > * Forensic data (Youn-Hee Gil and Dowon Hong) > * Virtualized environments (NIST Cloud WG participants: Matt Smith = and Phil Cox) > * Malicious infrastructure - REN-ISAC? > * Actor profiles - REN-ISAC? > * Malicious code characteristics - REN-ISAC? > * Integrating SCAP Content (may be through one of the above) > * Financial transaction/fraud - review/change RFC5901 >=20 >=20 > Best regards, > Kathleen, Brian, & Tom >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile >=20 > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Damir Rajnovic , PSIRT Incident Manager, Cisco Systems Telephone: +44 7715 546 033 200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D There are no insolvable problems.=20 The question is can you accept the solution?=20 http://www.ciscopress.com/bookstore/product.asp?isbn=3D1587052644 - - - - Cisco.com - http://www.cisco.com/global/UK This e-mail may contain confidential and privileged material for the sole=20 use of the intended recipient. Any review, use, distribution or disclosure = by=20 others is strictly prohibited. If you are not the intended recipient (or=20 authorized to receive for the recipient), please contact the sender by repl= y=20 e-mail and delete all copies of this message. Cisco Systems Limited (Company Number: 02558939), is registered in England= =20 and Wales with its registered office at 1 Callaghan Square, Cardiff,=20 South Glamorgan CF10 5BT For corporate legal information go to: http://www.cisco.com/web/about/doing_business/legal/cri/index.html From katherine.s.goodier@ugov.gov Mon Jun 6 06:04:53 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D17D11E8143 for ; Mon, 6 Jun 2011 06:04:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vjEKdTcF57za for ; Mon, 6 Jun 2011 06:04:52 -0700 (PDT) Received: from iron-e-outbound.osis.gov (fw1-b.osis.gov [206.112.75.239]) by ietfa.amsl.com (Postfix) with ESMTP id C62FE11E8133 for ; Mon, 6 Jun 2011 06:04:50 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.65,326,1304308800"; d="scan'208";a="83679847" Received: from netmgmt.ext.intelink.gov (HELO ww3.ugov.gov) ([172.16.11.235]) by iron-e-outbound.osis.gov with ESMTP; 06 Jun 2011 09:04:17 -0400 Date: Mon, 6 Jun 2011 13:04:48 +0000 (GMT+00:00) From: Katherine S Goodier To: kathleen moriarty Message-ID: <318945997.610098.1307365488872.JavaMail.root@linzimmb03o.imo.intelink.gov> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.2.188.66] X-Mailer: Zimbra 6.0.7_GA_2473.RHEL5_64 (ZimbraWebClient - IE7 (Win)/6.0.7_GA_2473.RHEL5_64) Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2011 13:04:53 -0000 I will assist Gaus. Dr. Katherine Goodier=20 Senior Computer Programmer/System Engineer=20 Stratis/L-3 Communications=20 Center of Excellence Lab, 5th floor=20 supporting Unified Cross Domain Management Office (UCDMO)=20 Army Research Lab, Bldg 601, Room 110=20 =C2=A0=20 lab - 301-575-3759=20 unclass - 240-373-1714=20 class - 763-2477=20 cell - 240-515-4791=20 ----- Original Message ----- From: "kathleen moriarty" To: gaus@cisco.com Cc: mile@ietf.org Sent: Monday, June 6, 2011 8:57:38 AM Subject: Re: [mile] MILE Kick-off message Thank you, Gaus! We can have multiple editors on drafts if others want to assist as an edito= r. This document will require a lot of collaboration to determine an agree= able approach. =20 We can look into holding a BoF at the July IETF. If we do that, it may be = good to get a review of a few different approaches to help solve this issue= before drafts are written. From the discussions to date, it seems it will= be a mix of a guidance for IODEF and RID as well as an extension to IODEF. Brian Trammell suggested also using Webex or some other method to enhance t= he remote experience as many of you have not attended an IETF yet and we wo= uld like to ensure you can participate if you can't attend. Typically, the= re are jabber sessions running as well to help remote participants. Best regards, Kathleen -----Original Message----- From: Damir Rajnovic [mailto:gaus@cisco.com]=20 Sent: Monday, June 06, 2011 8:34 AM To: Moriarty, Kathleen Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message Hi, I can take on Data sharing restrictions/markings Gaus On Tue, May 31, 2011 at 11:17:08AM -0400, kathleen.moriarty@emc.com wrote: > To follow up from the data sharing restrictions/markings discussion, a ne= w IODEF extension should be added to the list for the purpose of charter di= scussions and additional guidance for RID will be needed. =20 >=20 > Here is what we have right now for the list of extensions: > * Mail abuse (from MARF WG) - would like the name of a volunteer > * Forensic data (Youn-Hee Gil and Dowon Hong) > * Virtualized environments (NIST Cloud WG participants: Matt Smith = and Phil Cox) > * Malicious infrastructure - REN-ISAC? > * Actor profiles - REN-ISAC? > * Malicious code characteristics - REN-ISAC? > * Integrating SCAP Content (may be through one of the above) > * Financial transaction/fraud - review/change RFC5901 > *=09 Data sharing restrictions/markings (we can change and evolve the na= me) >=20 > We do need more editors, so please volunteer if the areas are of interest= . Having multiple editors on a document is welcome. >=20 > Can anyone volunteer to assist with an extension template and guidance do= cument? >=20 >=20 > We have also had requests for guidance on other use cases, so we may need= to factor that in as well. Yuri from the ITU-T has expressed interest in = guidance for misuse. >=20 > Thank you! > Kathleen >=20 > -----Original Message----- > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of k= athleen.moriarty@emc.com > Sent: Thursday, May 19, 2011 4:46 PM > To: mile@ietf.org > Subject: [mile] MILE Kick-off message >=20 > Hello! >=20 > Thank you for joining the MILE mailing list! We are looking forward to i= ncreased collaboration and progress in this space. The message below begin= s with a summary from the mailing list welcome message and then leads into = several topics for discussion to assist with charter and scope of work deve= lopment. We look forward to your feedback! >=20 > Welcome Message/Initial Goals: >=20 > The MILE pre-working group will initially be focused on the development o= f a charter and scope of work effort for standards and extensions to meet t= he needs of a global community interested in sharing, exchanging, and handl= ing incidents. Collaboration and sharing experiences with the data model o= r use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC590= 1), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045, R= FC6046) standards will improve any solutions created to enable collaboratio= n for incident response and sharing. This list is for charter and pre-WG t= echnical discussion about MILE, which intends to describe a subset of IODE= F aimed at exchanging easily readable incident information focused on those= things which people actually exchange. Extensions needed by the IODEF an= d RID community to ensure current relevant use cases for the exchange of in= cident information may also be discussed. >=20 > Questions for the List: >=20 > The above welcome statement calls out specifically the goal of the list: = "This list is for charter and pre-WG technical discussion about MILE, whic= h intends to describe a subset of IODEF aimed at exchanging easily readable= incident information focused on those things which people actually exchang= e." >=20 > * Are there opinions or thoughts on what is needed by the WG to ach= ieve this goal? >=20 > We have had several volunteers come forward offering to initiate work on = extensions to IODEF. Having a template with guidance on what is required i= n an extension document would be a very useful start. We are looking for v= olunteers to help create this template and guidance. >=20 > * What are your thoughts on a template (maybe based off of RFC5901)= before we move into the creation/modification of any IODEF extensions? >=20 > Here is the list of proposed extensions with some volunteer editors liste= d (more are welcome). Is this the right list of extensions? >=20 > * Mail abuse (from MARF WG) > * Forensic data (Youn-Hee Gil and Dowon Hong) > * Virtualized environments (NIST Cloud WG participants: Matt Smith = and Phil Cox) > * Malicious infrastructure - REN-ISAC? > * Actor profiles - REN-ISAC? > * Malicious code characteristics - REN-ISAC? > * Integrating SCAP Content (may be through one of the above) > * Financial transaction/fraud - review/change RFC5901 >=20 >=20 > Best regards, > Kathleen, Brian, & Tom >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile >=20 > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Damir Rajnovic , PSIRT Incident Manager, Cisco Systems Telephone: +44 7715 546 033 200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D There are no insolvable problems.=20 The question is can you accept the solution?=20 http://www.ciscopress.com/bookstore/product.asp?isbn=3D1587052644 - - - - Cisco.com - http://www.cisco.com/global/UK This e-mail may contain confidential and privileged material for the sole= =20 use of the intended recipient. Any review, use, distribution or disclosure = by=20 others is strictly prohibited. If you are not the intended recipient (or=20 authorized to receive for the recipient), please contact the sender by repl= y=20 e-mail and delete all copies of this message. Cisco Systems Limited (Company Number: 02558939), is registered in England= =20 and Wales with its registered office at 1 Callaghan Square, Cardiff,=20 South Glamorgan CF10 5BT For corporate legal information go to: http://www.cisco.com/web/about/doing_business/legal/cri/index.html _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile From kathleen.moriarty@emc.com Mon Jun 6 06:13:54 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 400CC11E8133 for ; Mon, 6 Jun 2011 06:13:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K6EDQL+DODGB for ; Mon, 6 Jun 2011 06:13:53 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 640FB11E8132 for ; Mon, 6 Jun 2011 06:13:52 -0700 (PDT) Received: from hop04-l1d11-si04.isus.emc.com (HOP04-L1D11-SI04.isus.emc.com [10.254.111.24]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56DDlWN019989 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 6 Jun 2011 09:13:47 -0400 Received: from mailhub.lss.emc.com (mailhubhoprd01.lss.emc.com [10.254.221.251]) by hop04-l1d11-si04.isus.emc.com (RSA Interceptor); Mon, 6 Jun 2011 09:12:53 -0400 Received: from mxhub20.corp.emc.com (mxhub20.corp.emc.com [10.254.93.49]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56DB3OB027695; Mon, 6 Jun 2011 09:11:03 -0400 Received: from mx06a.corp.emc.com ([169.254.1.35]) by mxhub20.corp.emc.com ([10.254.93.49]) with mapi; Mon, 6 Jun 2011 09:11:02 -0400 From: To: Date: Mon, 6 Jun 2011 09:11:01 -0400 Thread-Topic: [mile] MILE Kick-off message Thread-Index: Acwii4N7Un+a+xTHTPa5j8a1inqYSwBtiHcA Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2011 13:13:54 -0000 Hello, Yuri! I hope you had a nice vacation. We are glad to have you participate and as= sist the effort with a document. Some of this one may be guidance on the b= ase specification and some may be extra values not represented in IODEF as = you state below. We have heard that guidance is needed to increase compati= bility in the exchange of reports, your assistance here is appreciated. Thank you, Kathleen -----Original Message----- From: yuri@unix.ru [mailto:yuri@unix.ru] On Behalf Of Yuri Ryazantsev Sent: Saturday, June 04, 2011 3:44 AM To: Moriarty, Kathleen Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message Hello, Kathleen! I apologize for the delay in replying - been on vacation. I would like to add to the list of proposed extensions: "Misuse enumeration and classification. Extensions to the IODEF-document class for reporting misuse". Short description: "he Extensions to the IODEF-Document Class for Reporting Misuse Recommendation extends the Incident Object Description Exchange Format (IODEF) defined in RFC 5070 to support the reporting of misuse incidents. These extensions are flexible enough to support information gleaned from activities throughout the entire intrusion detection cycle where authorized users of the systems attempt to gain additional privileges for which they are not authorized, and authorized users who misuse the privileges given them." Thank you! Yuri. On Tue, May 31, 2011 at 19:17, wrote: > To follow up from the data sharing restrictions/markings discussion, a ne= w IODEF extension should be added to the list for the purpose of charter di= scussions and additional guidance for RID will be needed. > > Here is what we have right now for the list of extensions: > * =A0 =A0 =A0 Mail abuse (from MARF WG) - would like the name of a volunt= eer > * =A0 =A0 =A0 Forensic data (Youn-Hee Gil and Dowon Hong) > * =A0 =A0 =A0 Virtualized environments (NIST Cloud WG participants: Matt = Smith and Phil Cox) > * =A0 =A0 =A0 Malicious infrastructure - REN-ISAC? > * =A0 =A0 =A0 Actor profiles - REN-ISAC? > * =A0 =A0 =A0 Malicious code characteristics - REN-ISAC? > * =A0 =A0 =A0 Integrating SCAP Content (may be through one of the above) > * =A0 =A0 =A0 Financial transaction/fraud - review/change RFC5901 > * =A0 =A0 =A0 =A0 Data sharing restrictions/markings (we can change and e= volve the name) > > We do need more editors, so please volunteer if the areas are of interest= . =A0Having multiple editors on a document is welcome. > > Can anyone volunteer to assist with an extension template and guidance do= cument? > > > We have also had requests for guidance on other use cases, so we may need= to factor that in as well. =A0Yuri from the ITU-T has expressed interest i= n guidance for misuse. > > Thank you! > Kathleen > > -----Original Message----- > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of k= athleen.moriarty@emc.com > Sent: Thursday, May 19, 2011 4:46 PM > To: mile@ietf.org > Subject: [mile] MILE Kick-off message > > Hello! > > Thank you for joining the MILE mailing list! =A0We are looking forward to= increased collaboration and progress in this space. =A0The message below b= egins with a summary from the mailing list welcome message and then leads i= nto several topics for discussion to assist with charter and scope of work = development. =A0We look forward to your feedback! > > Welcome Message/Initial Goals: > > The MILE pre-working group will initially be focused on the development o= f a charter and scope of work effort for standards and extensions to meet t= he needs of a global community interested in sharing, exchanging, and handl= ing incidents. =A0Collaboration and sharing experiences with the data model= or use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC5= 901), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045,= RFC6046) standards will improve any solutions created to enable collaborat= ion for incident response and sharing. =A0This list is for charter and pre-= WG technical discussion about MILE, =A0which intends to describe a subset o= f IODEF aimed at exchanging easily readable incident information focused on= those things which people actually exchange. =A0 Extensions needed by the = IODEF and RID community to ensure current relevant use cases for the exchan= ge of incident information may also be discussed. > > Questions for the List: > > The above welcome statement calls out specifically the goal of the list: = "This list is for charter and pre-WG technical discussion about MILE, =A0wh= ich intends to describe a subset of IODEF aimed at exchanging easily readab= le incident information focused on those things which people actually excha= nge." > > * =A0 =A0 =A0 Are there opinions or thoughts on what is needed by the WG = to achieve this goal? > > We have had several volunteers come forward offering to initiate work on = extensions to IODEF. =A0Having a template with guidance on what is required= in an extension document would be a very useful start. =A0We are looking f= or volunteers to help create this template and guidance. > > * =A0 =A0 =A0 What are your thoughts on a template (maybe based off of RF= C5901) before we move into the creation/modification of any IODEF extension= s? > > Here is the list of proposed extensions with some volunteer editors liste= d (more are welcome). =A0Is this the right list of extensions? > > * =A0 =A0 =A0 Mail abuse (from MARF WG) > * =A0 =A0 =A0 Forensic data (Youn-Hee Gil and Dowon Hong) > * =A0 =A0 =A0 Virtualized environments (NIST Cloud WG participants: Matt = Smith and Phil Cox) > * =A0 =A0 =A0 Malicious infrastructure - REN-ISAC? > * =A0 =A0 =A0 Actor profiles - REN-ISAC? > * =A0 =A0 =A0 Malicious code characteristics - REN-ISAC? > * =A0 =A0 =A0 Integrating SCAP Content (may be through one of the above) > * =A0 =A0 =A0 Financial transaction/fraud - review/change RFC5901 > > > Best regards, > Kathleen, Brian, & Tom > > > > > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile > > --=20 Yuri Ryazantsev From gaus@cisco.com Mon Jun 6 06:39:09 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF26F11E8140 for ; Mon, 6 Jun 2011 06:39:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JIIKNK-O6G7T for ; Mon, 6 Jun 2011 06:39:08 -0700 (PDT) Received: from av-tac-bru.cisco.com (weird-brew.cisco.com [144.254.15.118]) by ietfa.amsl.com (Postfix) with ESMTP id 83C2511E811E for ; Mon, 6 Jun 2011 06:39:08 -0700 (PDT) X-TACSUNS: Virus Scanned Received: from strange-brew.cisco.com (localhost.cisco.com [127.0.0.1]) by av-tac-bru.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id p56DCcVk007088; Mon, 6 Jun 2011 15:12:38 +0200 (CEST) Received: from MacGaus.cisco.com (ams-drajnovi-8715.cisco.com [10.55.15.246]) by strange-brew.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id p56DCbxe010008; Mon, 6 Jun 2011 15:12:37 +0200 (CEST) Received: by MacGaus.cisco.com (Postfix, from userid 501) id 3DC3A39F922; Mon, 6 Jun 2011 14:12:36 +0100 (BST) Date: Mon, 6 Jun 2011 14:12:35 +0100 From: Damir Rajnovic To: kathleen.moriarty@emc.com Message-ID: <20110606131235.GE476@MacGaus.cisco.com> References: <20110606123330.GO5482@MacGaus.cisco.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i X-Operating-System: Whatever Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Gaus List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2011 13:39:09 -0000 Hi Kathleen, On Mon, Jun 06, 2011 at 08:57:38AM -0400, kathleen.moriarty@emc.com wrote: > We can have multiple editors on drafts if others want to assist as an editor. > This document will require a lot of collaboration to determine an agreeable approach. And I will need all the help I can get :) For the start I can not travel to IETF meetings at all and will depend very much on others to work with the people at the meeting. I can certainly arrange and lead virtual meetings. So, if anyone else is willing to jump in I would certainly welcome that :) Thanks, Gaus > > We can look into holding a BoF at the July IETF. If we do that, it may be good to get a review of a few different approaches to help solve this issue before drafts are written. From the discussions to date, it seems it will be a mix of a guidance for IODEF and RID as well as an extension to IODEF. > > Brian Trammell suggested also using Webex or some other method to enhance the remote experience as many of you have not attended an IETF yet and we would like to ensure you can participate if you can't attend. Typically, there are jabber sessions running as well to help remote participants. > > > Best regards, > Kathleen > > > -----Original Message----- > From: Damir Rajnovic [mailto:gaus@cisco.com] > Sent: Monday, June 06, 2011 8:34 AM > To: Moriarty, Kathleen > Cc: mile@ietf.org > Subject: Re: [mile] MILE Kick-off message > > Hi, > > I can take on Data sharing restrictions/markings > > Gaus > > > On Tue, May 31, 2011 at 11:17:08AM -0400, kathleen.moriarty@emc.com wrote: > > To follow up from the data sharing restrictions/markings discussion, a new IODEF extension should be added to the list for the purpose of charter discussions and additional guidance for RID will be needed. > > > > Here is what we have right now for the list of extensions: > > * Mail abuse (from MARF WG) - would like the name of a volunteer > > * Forensic data (Youn-Hee Gil and Dowon Hong) > > * Virtualized environments (NIST Cloud WG participants: Matt Smith and Phil Cox) > > * Malicious infrastructure - REN-ISAC? > > * Actor profiles - REN-ISAC? > > * Malicious code characteristics - REN-ISAC? > > * Integrating SCAP Content (may be through one of the above) > > * Financial transaction/fraud - review/change RFC5901 > > * Data sharing restrictions/markings (we can change and evolve the name) > > > > We do need more editors, so please volunteer if the areas are of interest. Having multiple editors on a document is welcome. > > > > Can anyone volunteer to assist with an extension template and guidance document? > > > > > > We have also had requests for guidance on other use cases, so we may need to factor that in as well. Yuri from the ITU-T has expressed interest in guidance for misuse. > > > > Thank you! > > Kathleen > > > > -----Original Message----- > > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of kathleen.moriarty@emc.com > > Sent: Thursday, May 19, 2011 4:46 PM > > To: mile@ietf.org > > Subject: [mile] MILE Kick-off message > > > > Hello! > > > > Thank you for joining the MILE mailing list! We are looking forward to increased collaboration and progress in this space. The message below begins with a summary from the mailing list welcome message and then leads into several topics for discussion to assist with charter and scope of work development. We look forward to your feedback! > > > > Welcome Message/Initial Goals: > > > > The MILE pre-working group will initially be focused on the development of a charter and scope of work effort for standards and extensions to meet the needs of a global community interested in sharing, exchanging, and handling incidents. Collaboration and sharing experiences with the data model or use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC5901), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045, RFC6046) standards will improve any solutions created to enable collaboration for incident response and sharing. This list is for charter and pre-WG technical discussion about MILE, which intends to describe a subset of IODEF aimed at exchanging easily readable incident information focused on those things which people actually exchange. Extensions needed by the IODEF and RID community to ensure current relevant use cases for the exchange of incident information may also be discussed. > > > > Questions for the List: > > > > The above welcome statement calls out specifically the goal of the list: "This list is for charter and pre-WG technical discussion about MILE, which intends to describe a subset of IODEF aimed at exchanging easily readable incident information focused on those things which people actually exchange." > > > > * Are there opinions or thoughts on what is needed by the WG to achieve this goal? > > > > We have had several volunteers come forward offering to initiate work on extensions to IODEF. Having a template with guidance on what is required in an extension document would be a very useful start. We are looking for volunteers to help create this template and guidance. > > > > * What are your thoughts on a template (maybe based off of RFC5901) before we move into the creation/modification of any IODEF extensions? > > > > Here is the list of proposed extensions with some volunteer editors listed (more are welcome). Is this the right list of extensions? > > > > * Mail abuse (from MARF WG) > > * Forensic data (Youn-Hee Gil and Dowon Hong) > > * Virtualized environments (NIST Cloud WG participants: Matt Smith and Phil Cox) > > * Malicious infrastructure - REN-ISAC? > > * Actor profiles - REN-ISAC? > > * Malicious code characteristics - REN-ISAC? > > * Integrating SCAP Content (may be through one of the above) > > * Financial transaction/fraud - review/change RFC5901 > > > > > > Best regards, > > Kathleen, Brian, & Tom > > > > > > > > > > > > _______________________________________________ > > mile mailing list > > mile@ietf.org > > https://www.ietf.org/mailman/listinfo/mile > > > > _______________________________________________ > > mile mailing list > > mile@ietf.org > > https://www.ietf.org/mailman/listinfo/mile ============== Damir Rajnovic , PSIRT Incident Manager, Cisco Systems Telephone: +44 7715 546 033 200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB ============== There are no insolvable problems. The question is can you accept the solution? http://www.ciscopress.com/bookstore/product.asp?isbn=1587052644 - - - - Cisco.com - http://www.cisco.com/global/UK This e-mail may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply e-mail and delete all copies of this message. Cisco Systems Limited (Company Number: 02558939), is registered in England and Wales with its registered office at 1 Callaghan Square, Cardiff, South Glamorgan CF10 5BT For corporate legal information go to: http://www.cisco.com/web/about/doing_business/legal/cri/index.html From gaus@cisco.com Mon Jun 6 06:39:10 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C10E611E811E for ; Mon, 6 Jun 2011 06:39:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TyM0lnwltZ2g for ; Mon, 6 Jun 2011 06:39:09 -0700 (PDT) Received: from av-tac-bru.cisco.com (weird-brew.cisco.com [144.254.15.118]) by ietfa.amsl.com (Postfix) with ESMTP id 606CE11E813C for ; Mon, 6 Jun 2011 06:39:09 -0700 (PDT) X-TACSUNS: Virus Scanned Received: from strange-brew.cisco.com (localhost.cisco.com [127.0.0.1]) by av-tac-bru.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id p56CXZmj002503; Mon, 6 Jun 2011 14:33:35 +0200 (CEST) Received: from MacGaus.cisco.com (ams-drajnovi-8715.cisco.com [10.55.15.246]) by strange-brew.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id p56CXY97029060; Mon, 6 Jun 2011 14:33:34 +0200 (CEST) Received: by MacGaus.cisco.com (Postfix, from userid 501) id 0530639F826; Mon, 6 Jun 2011 13:33:30 +0100 (BST) Date: Mon, 6 Jun 2011 13:33:30 +0100 From: Damir Rajnovic To: kathleen.moriarty@emc.com Message-ID: <20110606123330.GO5482@MacGaus.cisco.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i X-Operating-System: Whatever Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Gaus List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2011 13:39:10 -0000 Hi, I can take on Data sharing restrictions/markings Gaus On Tue, May 31, 2011 at 11:17:08AM -0400, kathleen.moriarty@emc.com wrote: > To follow up from the data sharing restrictions/markings discussion, a new IODEF extension should be added to the list for the purpose of charter discussions and additional guidance for RID will be needed. > > Here is what we have right now for the list of extensions: > * Mail abuse (from MARF WG) - would like the name of a volunteer > * Forensic data (Youn-Hee Gil and Dowon Hong) > * Virtualized environments (NIST Cloud WG participants: Matt Smith and Phil Cox) > * Malicious infrastructure - REN-ISAC? > * Actor profiles - REN-ISAC? > * Malicious code characteristics - REN-ISAC? > * Integrating SCAP Content (may be through one of the above) > * Financial transaction/fraud - review/change RFC5901 > * Data sharing restrictions/markings (we can change and evolve the name) > > We do need more editors, so please volunteer if the areas are of interest. Having multiple editors on a document is welcome. > > Can anyone volunteer to assist with an extension template and guidance document? > > > We have also had requests for guidance on other use cases, so we may need to factor that in as well. Yuri from the ITU-T has expressed interest in guidance for misuse. > > Thank you! > Kathleen > > -----Original Message----- > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of kathleen.moriarty@emc.com > Sent: Thursday, May 19, 2011 4:46 PM > To: mile@ietf.org > Subject: [mile] MILE Kick-off message > > Hello! > > Thank you for joining the MILE mailing list! We are looking forward to increased collaboration and progress in this space. The message below begins with a summary from the mailing list welcome message and then leads into several topics for discussion to assist with charter and scope of work development. We look forward to your feedback! > > Welcome Message/Initial Goals: > > The MILE pre-working group will initially be focused on the development of a charter and scope of work effort for standards and extensions to meet the needs of a global community interested in sharing, exchanging, and handling incidents. Collaboration and sharing experiences with the data model or use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC5901), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045, RFC6046) standards will improve any solutions created to enable collaboration for incident response and sharing. This list is for charter and pre-WG technical discussion about MILE, which intends to describe a subset of IODEF aimed at exchanging easily readable incident information focused on those things which people actually exchange. Extensions needed by the IODEF and RID community to ensure current relevant use cases for the exchange of incident information may also be discussed. > > Questions for the List: > > The above welcome statement calls out specifically the goal of the list: "This list is for charter and pre-WG technical discussion about MILE, which intends to describe a subset of IODEF aimed at exchanging easily readable incident information focused on those things which people actually exchange." > > * Are there opinions or thoughts on what is needed by the WG to achieve this goal? > > We have had several volunteers come forward offering to initiate work on extensions to IODEF. Having a template with guidance on what is required in an extension document would be a very useful start. We are looking for volunteers to help create this template and guidance. > > * What are your thoughts on a template (maybe based off of RFC5901) before we move into the creation/modification of any IODEF extensions? > > Here is the list of proposed extensions with some volunteer editors listed (more are welcome). Is this the right list of extensions? > > * Mail abuse (from MARF WG) > * Forensic data (Youn-Hee Gil and Dowon Hong) > * Virtualized environments (NIST Cloud WG participants: Matt Smith and Phil Cox) > * Malicious infrastructure - REN-ISAC? > * Actor profiles - REN-ISAC? > * Malicious code characteristics - REN-ISAC? > * Integrating SCAP Content (may be through one of the above) > * Financial transaction/fraud - review/change RFC5901 > > > Best regards, > Kathleen, Brian, & Tom > > > > > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile ============== Damir Rajnovic , PSIRT Incident Manager, Cisco Systems Telephone: +44 7715 546 033 200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB ============== There are no insolvable problems. The question is can you accept the solution? http://www.ciscopress.com/bookstore/product.asp?isbn=1587052644 - - - - Cisco.com - http://www.cisco.com/global/UK This e-mail may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply e-mail and delete all copies of this message. Cisco Systems Limited (Company Number: 02558939), is registered in England and Wales with its registered office at 1 Callaghan Square, Cardiff, South Glamorgan CF10 5BT For corporate legal information go to: http://www.cisco.com/web/about/doing_business/legal/cri/index.html From kathleen.moriarty@emc.com Mon Jun 6 07:03:07 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 381CD11E814C for ; Mon, 6 Jun 2011 07:03:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rcqiexCwSpGp for ; Mon, 6 Jun 2011 07:03:06 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 3327C11E80F7 for ; Mon, 6 Jun 2011 07:03:05 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56E33Re029368 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 6 Jun 2011 10:03:03 -0400 Received: from mailhub.lss.emc.com (mailhubhoprd04.lss.emc.com [10.254.222.226]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor); Mon, 6 Jun 2011 10:02:53 -0400 Received: from mxhub18.corp.emc.com (mxhub18.corp.emc.com [10.254.93.47]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56E1KY2022213; Mon, 6 Jun 2011 10:01:36 -0400 Received: from mx06a.corp.emc.com ([169.254.1.35]) by mxhub18.corp.emc.com ([10.254.93.47]) with mapi; Mon, 6 Jun 2011 10:00:02 -0400 From: To: Date: Mon, 6 Jun 2011 10:00:01 -0400 Thread-Topic: [mile] MILE Kick-off message Thread-Index: AcwkTYcH6QKtq05pT260AgarQCJ/FAABAyaA Message-ID: References: <20110606123330.GO5482@MacGaus.cisco.com> <20110606131235.GE476@MacGaus.cisco.com> In-Reply-To: <20110606131235.GE476@MacGaus.cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: Re: [mile] MILE Kick-off message X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2011 14:03:07 -0000 Thank you! Do we have any volunteers to work on/be an editor for a template/extension = guideline document? This would list out all of the sections that should be= included in an extension document and provide guidance as to the content e= xpected in each of the sections. It would be nice to produce consistent ex= tensions that will make it easier for editors of extensions as well as deve= lopers using the extension documents. We will need this one sooner rather than later and the existing extensions = can be used as a reference (RFC5901). Best regards, Kathleen -----Original Message----- From: Damir Rajnovic [mailto:gaus@cisco.com]=20 Sent: Monday, June 06, 2011 9:13 AM To: Moriarty, Kathleen Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message Hi Kathleen, On Mon, Jun 06, 2011 at 08:57:38AM -0400, kathleen.moriarty@emc.com wrote: > We can have multiple editors on drafts if others want to assist as an edi= tor. =20 > This document will require a lot of collaboration to determine an agreeab= le approach. =20 And I will need all the help I can get :) For the start I can not travel t= o IETF meetings at all and will depend very much on others to work with the = people=20 at the meeting. I can certainly arrange and lead virtual meetings. So, if anyone else is willing to jump in I would certainly welcome that :) Thanks, Gaus >=20 > We can look into holding a BoF at the July IETF. If we do that, it may b= e good to get a review of a few different approaches to help solve this iss= ue before drafts are written. From the discussions to date, it seems it wi= ll be a mix of a guidance for IODEF and RID as well as an extension to IODE= F. >=20 > Brian Trammell suggested also using Webex or some other method to enhance= the remote experience as many of you have not attended an IETF yet and we = would like to ensure you can participate if you can't attend. Typically, t= here are jabber sessions running as well to help remote participants. >=20 >=20 > Best regards, > Kathleen >=20 >=20 > -----Original Message----- > From: Damir Rajnovic [mailto:gaus@cisco.com]=20 > Sent: Monday, June 06, 2011 8:34 AM > To: Moriarty, Kathleen > Cc: mile@ietf.org > Subject: Re: [mile] MILE Kick-off message >=20 > Hi, >=20 > I can take on Data sharing restrictions/markings >=20 > Gaus >=20 >=20 > On Tue, May 31, 2011 at 11:17:08AM -0400, kathleen.moriarty@emc.com wrote= : > > To follow up from the data sharing restrictions/markings discussion, a = new IODEF extension should be added to the list for the purpose of charter = discussions and additional guidance for RID will be needed. =20 > >=20 > > Here is what we have right now for the list of extensions: > > * Mail abuse (from MARF WG) - would like the name of a volunteer > > * Forensic data (Youn-Hee Gil and Dowon Hong) > > * Virtualized environments (NIST Cloud WG participants: Matt Smit= h and Phil Cox) > > * Malicious infrastructure - REN-ISAC? > > * Actor profiles - REN-ISAC? > > * Malicious code characteristics - REN-ISAC? > > * Integrating SCAP Content (may be through one of the above) > > * Financial transaction/fraud - review/change RFC5901 > > * Data sharing restrictions/markings (we can change and evolve the na= me) > >=20 > > We do need more editors, so please volunteer if the areas are of intere= st. Having multiple editors on a document is welcome. > >=20 > > Can anyone volunteer to assist with an extension template and guidance = document? > >=20 > >=20 > > We have also had requests for guidance on other use cases, so we may ne= ed to factor that in as well. Yuri from the ITU-T has expressed interest i= n guidance for misuse. > >=20 > > Thank you! > > Kathleen > >=20 > > -----Original Message----- > > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of= kathleen.moriarty@emc.com > > Sent: Thursday, May 19, 2011 4:46 PM > > To: mile@ietf.org > > Subject: [mile] MILE Kick-off message > >=20 > > Hello! > >=20 > > Thank you for joining the MILE mailing list! We are looking forward to= increased collaboration and progress in this space. The message below beg= ins with a summary from the mailing list welcome message and then leads int= o several topics for discussion to assist with charter and scope of work de= velopment. We look forward to your feedback! > >=20 > > Welcome Message/Initial Goals: > >=20 > > The MILE pre-working group will initially be focused on the development= of a charter and scope of work effort for standards and extensions to meet= the needs of a global community interested in sharing, exchanging, and han= dling incidents. Collaboration and sharing experiences with the data model= or use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC5= 901), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045,= RFC6046) standards will improve any solutions created to enable collaborat= ion for incident response and sharing. This list is for charter and pre-WG= technical discussion about MILE, which intends to describe a subset of IO= DEF aimed at exchanging easily readable incident information focused on tho= se things which people actually exchange. Extensions needed by the IODEF = and RID community to ensure current relevant use cases for the exchange of = incident information may also be discussed. > >=20 > > Questions for the List: > >=20 > > The above welcome statement calls out specifically the goal of the list= : "This list is for charter and pre-WG technical discussion about MILE, wh= ich intends to describe a subset of IODEF aimed at exchanging easily readab= le incident information focused on those things which people actually excha= nge." > >=20 > > * Are there opinions or thoughts on what is needed by the WG to a= chieve this goal? > >=20 > > We have had several volunteers come forward offering to initiate work o= n extensions to IODEF. Having a template with guidance on what is required= in an extension document would be a very useful start. We are looking for= volunteers to help create this template and guidance. > >=20 > > * What are your thoughts on a template (maybe based off of RFC590= 1) before we move into the creation/modification of any IODEF extensions? > >=20 > > Here is the list of proposed extensions with some volunteer editors lis= ted (more are welcome). Is this the right list of extensions? > >=20 > > * Mail abuse (from MARF WG) > > * Forensic data (Youn-Hee Gil and Dowon Hong) > > * Virtualized environments (NIST Cloud WG participants: Matt Smit= h and Phil Cox) > > * Malicious infrastructure - REN-ISAC? > > * Actor profiles - REN-ISAC? > > * Malicious code characteristics - REN-ISAC? > > * Integrating SCAP Content (may be through one of the above) > > * Financial transaction/fraud - review/change RFC5901 > >=20 > >=20 > > Best regards, > > Kathleen, Brian, & Tom > >=20 > >=20 > >=20 > >=20 > >=20 > > _______________________________________________ > > mile mailing list > > mile@ietf.org > > https://www.ietf.org/mailman/listinfo/mile > >=20 > > _______________________________________________ > > mile mailing list > > mile@ietf.org > > https://www.ietf.org/mailman/listinfo/mile =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Damir Rajnovic , PSIRT Incident Manager, Cisco Systems Telephone: +44 7715 546 033 200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D There are no insolvable problems.=20 The question is can you accept the solution?=20 http://www.ciscopress.com/bookstore/product.asp?isbn=3D1587052644 - - - - Cisco.com - http://www.cisco.com/global/UK This e-mail may contain confidential and privileged material for the sole=20 use of the intended recipient. Any review, use, distribution or disclosure = by=20 others is strictly prohibited. If you are not the intended recipient (or=20 authorized to receive for the recipient), please contact the sender by repl= y=20 e-mail and delete all copies of this message. Cisco Systems Limited (Company Number: 02558939), is registered in England= =20 and Wales with its registered office at 1 Callaghan Square, Cardiff,=20 South Glamorgan CF10 5BT For corporate legal information go to: http://www.cisco.com/web/about/doing_business/legal/cri/index.html From kathleen.moriarty@emc.com Mon Jun 6 08:33:36 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 184B221F8478 for ; Mon, 6 Jun 2011 08:33:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id teLkhW2P5g4g for ; Mon, 6 Jun 2011 08:33:35 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id E767721F8442 for ; Mon, 6 Jun 2011 08:33:34 -0700 (PDT) Received: from hop04-l1d11-si04.isus.emc.com (HOP04-L1D11-SI04.isus.emc.com [10.254.111.24]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56FXVIY021476 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 6 Jun 2011 11:33:32 -0400 Received: from mailhub.lss.emc.com (mailhub.lss.emc.com [10.254.222.226]) by hop04-l1d11-si04.isus.emc.com (RSA Interceptor); Mon, 6 Jun 2011 11:33:21 -0400 Received: from mxhub10.corp.emc.com (mxhub10.corp.emc.com [10.254.92.105]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56FSV02026839; Mon, 6 Jun 2011 11:31:57 -0400 Received: from mx06a.corp.emc.com ([169.254.1.35]) by mxhub10.corp.emc.com ([10.254.92.105]) with mapi; Mon, 6 Jun 2011 11:31:01 -0400 From: To: Date: Mon, 6 Jun 2011 11:31:00 -0400 Thread-Topic: [mile] MILE Kick-off message Thread-Index: AcwkTL0bWwGMAv4+TK63mMYOkYBplwAEcRHA Message-ID: References: <318945997.610098.1307365488872.JavaMail.root@linzimmb03o.imo.intelink.gov> In-Reply-To: <318945997.610098.1307365488872.JavaMail.root@linzimmb03o.imo.intelink.gov> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-EMM-MHVC: 1 Cc: mile@ietf.org Subject: Re: [mile] MILE Kick-off message X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2011 15:33:36 -0000 VGhhbmsgeW91LCBLYXRoZXJpbmUhDQoNCi1LYXRobGVlbg0KDQotLS0tLU9yaWdpbmFsIE1lc3Nh Z2UtLS0tLQ0KRnJvbTogS2F0aGVyaW5lIFMgR29vZGllciBbbWFpbHRvOmthdGhlcmluZS5zLmdv b2RpZXJAdWdvdi5nb3ZdIA0KU2VudDogTW9uZGF5LCBKdW5lIDA2LCAyMDExIDk6MDUgQU0NClRv OiBNb3JpYXJ0eSwgS2F0aGxlZW4NCkNjOiBtaWxlQGlldGYub3JnOyBnYXVzQGNpc2NvLmNvbQ0K U3ViamVjdDogUmU6IFttaWxlXSBNSUxFIEtpY2stb2ZmIG1lc3NhZ2UNCg0KSSB3aWxsIGFzc2lz dCBHYXVzLg0KDQoNCg0KDQpEci4gS2F0aGVyaW5lIEdvb2RpZXIgDQoNClNlbmlvciBDb21wdXRl ciBQcm9ncmFtbWVyL1N5c3RlbSBFbmdpbmVlciANClN0cmF0aXMvTC0zIENvbW11bmljYXRpb25z IA0KQ2VudGVyIG9mIEV4Y2VsbGVuY2UgTGFiLCA1dGggZmxvb3IgDQpzdXBwb3J0aW5nIFVuaWZp ZWQgQ3Jvc3MgRG9tYWluIE1hbmFnZW1lbnQgT2ZmaWNlIChVQ0RNTykgDQpBcm15IFJlc2VhcmNo IExhYiwgQmxkZyA2MDEsIFJvb20gMTEwIA0KwqAgDQpsYWIgLSAzMDEtNTc1LTM3NTkgDQp1bmNs YXNzIC0gMjQwLTM3My0xNzE0IA0KY2xhc3MgLSA3NjMtMjQ3NyANCmNlbGwgLSAyNDAtNTE1LTQ3 OTEgDQoNCg0KLS0tLS0gT3JpZ2luYWwgTWVzc2FnZSAtLS0tLQ0KRnJvbTogImthdGhsZWVuIG1v cmlhcnR5IiA8a2F0aGxlZW4ubW9yaWFydHlAZW1jLmNvbT4NClRvOiBnYXVzQGNpc2NvLmNvbQ0K Q2M6IG1pbGVAaWV0Zi5vcmcNClNlbnQ6IE1vbmRheSwgSnVuZSA2LCAyMDExIDg6NTc6MzggQU0N ClN1YmplY3Q6IFJlOiBbbWlsZV0gTUlMRSBLaWNrLW9mZiBtZXNzYWdlDQoNClRoYW5rIHlvdSwg R2F1cyENCg0KV2UgY2FuIGhhdmUgbXVsdGlwbGUgZWRpdG9ycyBvbiBkcmFmdHMgaWYgb3RoZXJz IHdhbnQgdG8gYXNzaXN0IGFzIGFuIGVkaXRvci4gIFRoaXMgZG9jdW1lbnQgd2lsbCByZXF1aXJl IGEgbG90IG9mIGNvbGxhYm9yYXRpb24gdG8gZGV0ZXJtaW5lIGFuIGFncmVlYWJsZSBhcHByb2Fj aC4gIA0KDQpXZSBjYW4gbG9vayBpbnRvIGhvbGRpbmcgYSBCb0YgYXQgdGhlIEp1bHkgSUVURi4g IElmIHdlIGRvIHRoYXQsIGl0IG1heSBiZSBnb29kIHRvIGdldCBhIHJldmlldyBvZiBhIGZldyBk aWZmZXJlbnQgYXBwcm9hY2hlcyB0byBoZWxwIHNvbHZlIHRoaXMgaXNzdWUgYmVmb3JlIGRyYWZ0 cyBhcmUgd3JpdHRlbi4gIEZyb20gdGhlIGRpc2N1c3Npb25zIHRvIGRhdGUsIGl0IHNlZW1zIGl0 IHdpbGwgYmUgYSBtaXggb2YgYSBndWlkYW5jZSBmb3IgSU9ERUYgYW5kIFJJRCBhcyB3ZWxsIGFz IGFuIGV4dGVuc2lvbiB0byBJT0RFRi4NCg0KQnJpYW4gVHJhbW1lbGwgc3VnZ2VzdGVkIGFsc28g dXNpbmcgV2ViZXggb3Igc29tZSBvdGhlciBtZXRob2QgdG8gZW5oYW5jZSB0aGUgcmVtb3RlIGV4 cGVyaWVuY2UgYXMgbWFueSBvZiB5b3UgaGF2ZSBub3QgYXR0ZW5kZWQgYW4gSUVURiB5ZXQgYW5k IHdlIHdvdWxkIGxpa2UgdG8gZW5zdXJlIHlvdSBjYW4gcGFydGljaXBhdGUgaWYgeW91IGNhbid0 IGF0dGVuZC4gIFR5cGljYWxseSwgdGhlcmUgYXJlIGphYmJlciBzZXNzaW9ucyBydW5uaW5nIGFz IHdlbGwgdG8gaGVscCByZW1vdGUgcGFydGljaXBhbnRzLg0KDQoNCkJlc3QgcmVnYXJkcywNCkth dGhsZWVuDQoNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IERhbWlyIFJham5v dmljIFttYWlsdG86Z2F1c0BjaXNjby5jb21dIA0KU2VudDogTW9uZGF5LCBKdW5lIDA2LCAyMDEx IDg6MzQgQU0NClRvOiBNb3JpYXJ0eSwgS2F0aGxlZW4NCkNjOiBtaWxlQGlldGYub3JnDQpTdWJq ZWN0OiBSZTogW21pbGVdIE1JTEUgS2ljay1vZmYgbWVzc2FnZQ0KDQpIaSwNCg0KSSBjYW4gdGFr ZSBvbiBEYXRhIHNoYXJpbmcgcmVzdHJpY3Rpb25zL21hcmtpbmdzDQoNCkdhdXMNCg0KDQpPbiBU dWUsIE1heSAzMSwgMjAxMSBhdCAxMToxNzowOEFNIC0wNDAwLCBrYXRobGVlbi5tb3JpYXJ0eUBl bWMuY29tIHdyb3RlOg0KPiBUbyBmb2xsb3cgdXAgZnJvbSB0aGUgZGF0YSBzaGFyaW5nIHJlc3Ry aWN0aW9ucy9tYXJraW5ncyBkaXNjdXNzaW9uLCBhIG5ldyBJT0RFRiBleHRlbnNpb24gc2hvdWxk IGJlIGFkZGVkIHRvIHRoZSBsaXN0IGZvciB0aGUgcHVycG9zZSBvZiBjaGFydGVyIGRpc2N1c3Np b25zIGFuZCBhZGRpdGlvbmFsIGd1aWRhbmNlIGZvciBSSUQgd2lsbCBiZSBuZWVkZWQuICANCj4g DQo+IEhlcmUgaXMgd2hhdCB3ZSBoYXZlIHJpZ2h0IG5vdyBmb3IgdGhlIGxpc3Qgb2YgZXh0ZW5z aW9uczoNCj4gKiAgICAgICBNYWlsIGFidXNlIChmcm9tIE1BUkYgV0cpIC0gd291bGQgbGlrZSB0 aGUgbmFtZSBvZiBhIHZvbHVudGVlcg0KPiAqICAgICAgIEZvcmVuc2ljIGRhdGEgKFlvdW4tSGVl IEdpbCBhbmQgRG93b24gSG9uZykNCj4gKiAgICAgICBWaXJ0dWFsaXplZCBlbnZpcm9ubWVudHMg KE5JU1QgQ2xvdWQgV0cgcGFydGljaXBhbnRzOiBNYXR0IFNtaXRoIGFuZCBQaGlsIENveCkNCj4g KiAgICAgICBNYWxpY2lvdXMgaW5mcmFzdHJ1Y3R1cmUgLSBSRU4tSVNBQz8NCj4gKiAgICAgICBB Y3RvciBwcm9maWxlcyAtIFJFTi1JU0FDPw0KPiAqICAgICAgIE1hbGljaW91cyBjb2RlIGNoYXJh Y3RlcmlzdGljcyAtIFJFTi1JU0FDPw0KPiAqICAgICAgIEludGVncmF0aW5nIFNDQVAgQ29udGVu dCAobWF5IGJlIHRocm91Z2ggb25lIG9mIHRoZSBhYm92ZSkNCj4gKiAgICAgICBGaW5hbmNpYWwg dHJhbnNhY3Rpb24vZnJhdWQgLSByZXZpZXcvY2hhbmdlIFJGQzU5MDENCj4gKgkgIERhdGEgc2hh cmluZyByZXN0cmljdGlvbnMvbWFya2luZ3MgKHdlIGNhbiBjaGFuZ2UgYW5kIGV2b2x2ZSB0aGUg bmFtZSkNCj4gDQo+IFdlIGRvIG5lZWQgbW9yZSBlZGl0b3JzLCBzbyBwbGVhc2Ugdm9sdW50ZWVy IGlmIHRoZSBhcmVhcyBhcmUgb2YgaW50ZXJlc3QuICBIYXZpbmcgbXVsdGlwbGUgZWRpdG9ycyBv biBhIGRvY3VtZW50IGlzIHdlbGNvbWUuDQo+IA0KPiBDYW4gYW55b25lIHZvbHVudGVlciB0byBh c3Npc3Qgd2l0aCBhbiBleHRlbnNpb24gdGVtcGxhdGUgYW5kIGd1aWRhbmNlIGRvY3VtZW50Pw0K PiANCj4gDQo+IFdlIGhhdmUgYWxzbyBoYWQgcmVxdWVzdHMgZm9yIGd1aWRhbmNlIG9uIG90aGVy IHVzZSBjYXNlcywgc28gd2UgbWF5IG5lZWQgdG8gZmFjdG9yIHRoYXQgaW4gYXMgd2VsbC4gIFl1 cmkgZnJvbSB0aGUgSVRVLVQgaGFzIGV4cHJlc3NlZCBpbnRlcmVzdCBpbiBndWlkYW5jZSBmb3Ig bWlzdXNlLg0KPiANCj4gVGhhbmsgeW91IQ0KPiBLYXRobGVlbg0KPiANCj4gLS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogbWlsZS1ib3VuY2VzQGlldGYub3JnIFttYWlsdG86bWls ZS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2Yga2F0aGxlZW4ubW9yaWFydHlAZW1jLmNv bQ0KPiBTZW50OiBUaHVyc2RheSwgTWF5IDE5LCAyMDExIDQ6NDYgUE0NCj4gVG86IG1pbGVAaWV0 Zi5vcmcNCj4gU3ViamVjdDogW21pbGVdIE1JTEUgS2ljay1vZmYgbWVzc2FnZQ0KPiANCj4gSGVs bG8hDQo+IA0KPiBUaGFuayB5b3UgZm9yIGpvaW5pbmcgdGhlIE1JTEUgbWFpbGluZyBsaXN0ISAg V2UgYXJlIGxvb2tpbmcgZm9yd2FyZCB0byBpbmNyZWFzZWQgY29sbGFib3JhdGlvbiBhbmQgcHJv Z3Jlc3MgaW4gdGhpcyBzcGFjZS4gIFRoZSBtZXNzYWdlIGJlbG93IGJlZ2lucyB3aXRoIGEgc3Vt bWFyeSBmcm9tIHRoZSBtYWlsaW5nIGxpc3Qgd2VsY29tZSBtZXNzYWdlIGFuZCB0aGVuIGxlYWRz IGludG8gc2V2ZXJhbCB0b3BpY3MgZm9yIGRpc2N1c3Npb24gdG8gYXNzaXN0IHdpdGggY2hhcnRl ciBhbmQgc2NvcGUgb2Ygd29yayBkZXZlbG9wbWVudC4gIFdlIGxvb2sgZm9yd2FyZCB0byB5b3Vy IGZlZWRiYWNrIQ0KPiANCj4gV2VsY29tZSBNZXNzYWdlL0luaXRpYWwgR29hbHM6DQo+IA0KPiBU aGUgTUlMRSBwcmUtd29ya2luZyBncm91cCB3aWxsIGluaXRpYWxseSBiZSBmb2N1c2VkIG9uIHRo ZSBkZXZlbG9wbWVudCBvZiBhIGNoYXJ0ZXIgYW5kIHNjb3BlIG9mIHdvcmsgZWZmb3J0IGZvciBz dGFuZGFyZHMgYW5kIGV4dGVuc2lvbnMgdG8gbWVldCB0aGUgbmVlZHMgb2YgYSBnbG9iYWwgY29t bXVuaXR5IGludGVyZXN0ZWQgaW4gc2hhcmluZywgZXhjaGFuZ2luZywgYW5kIGhhbmRsaW5nIGlu Y2lkZW50cy4gIENvbGxhYm9yYXRpb24gYW5kIHNoYXJpbmcgZXhwZXJpZW5jZXMgd2l0aCB0aGUg ZGF0YSBtb2RlbCBvciB1c2Ugb2YgdGhlIElPREVGIChSRkM1MDcwKSwgZXhpc3RpbmcgZXh0ZW5z aW9ucyBmb3IgQW50aS1waGlzaGluZyAoUkZDNTkwMSksIGV4aXN0aW5nIGV4dGVuc2lvbiBmb3Ig VHJhbnNhY3Rpb24gRnJhdWQgKFJGQzU5NDEpLCBhbmQgUklEIChSRkM2MDQ1LCBSRkM2MDQ2KSBz dGFuZGFyZHMgd2lsbCBpbXByb3ZlIGFueSBzb2x1dGlvbnMgY3JlYXRlZCB0byBlbmFibGUgY29s bGFib3JhdGlvbiBmb3IgaW5jaWRlbnQgcmVzcG9uc2UgYW5kIHNoYXJpbmcuICBUaGlzIGxpc3Qg aXMgZm9yIGNoYXJ0ZXIgYW5kIHByZS1XRyB0ZWNobmljYWwgZGlzY3Vzc2lvbiBhYm91dCBNSUxF LCAgd2hpY2ggaW50ZW5kcyB0byBkZXNjcmliZSBhIHN1YnNldCBvZiBJT0RFRiBhaW1lZCBhdCBl eGNoYW5naW5nIGVhc2lseSByZWFkYWJsZSBpbmNpZGVudCBpbmZvcm1hdGlvbiBmb2N1c2VkIG9u IHRob3NlIHRoaW5ncyB3aGljaCBwZW9wbGUgYWN0dWFsbHkgZXhjaGFuZ2UuICAgRXh0ZW5zaW9u cyBuZWVkZWQgYnkgdGhlIElPREVGIGFuZCBSSUQgY29tbXVuaXR5IHRvIGVuc3VyZSBjdXJyZW50 IHJlbGV2YW50IHVzZSBjYXNlcyBmb3IgdGhlIGV4Y2hhbmdlIG9mIGluY2lkZW50IGluZm9ybWF0 aW9uIG1heSBhbHNvIGJlIGRpc2N1c3NlZC4NCj4gDQo+IFF1ZXN0aW9ucyBmb3IgdGhlIExpc3Q6 DQo+IA0KPiBUaGUgYWJvdmUgd2VsY29tZSBzdGF0ZW1lbnQgY2FsbHMgb3V0IHNwZWNpZmljYWxs eSB0aGUgZ29hbCBvZiB0aGUgbGlzdDogIlRoaXMgbGlzdCBpcyBmb3IgY2hhcnRlciBhbmQgcHJl LVdHIHRlY2huaWNhbCBkaXNjdXNzaW9uIGFib3V0IE1JTEUsICB3aGljaCBpbnRlbmRzIHRvIGRl c2NyaWJlIGEgc3Vic2V0IG9mIElPREVGIGFpbWVkIGF0IGV4Y2hhbmdpbmcgZWFzaWx5IHJlYWRh YmxlIGluY2lkZW50IGluZm9ybWF0aW9uIGZvY3VzZWQgb24gdGhvc2UgdGhpbmdzIHdoaWNoIHBl b3BsZSBhY3R1YWxseSBleGNoYW5nZS4iDQo+IA0KPiAqICAgICAgIEFyZSB0aGVyZSBvcGluaW9u cyBvciB0aG91Z2h0cyBvbiB3aGF0IGlzIG5lZWRlZCBieSB0aGUgV0cgdG8gYWNoaWV2ZSB0aGlz IGdvYWw/DQo+IA0KPiBXZSBoYXZlIGhhZCBzZXZlcmFsIHZvbHVudGVlcnMgY29tZSBmb3J3YXJk IG9mZmVyaW5nIHRvIGluaXRpYXRlIHdvcmsgb24gZXh0ZW5zaW9ucyB0byBJT0RFRi4gIEhhdmlu ZyBhIHRlbXBsYXRlIHdpdGggZ3VpZGFuY2Ugb24gd2hhdCBpcyByZXF1aXJlZCBpbiBhbiBleHRl bnNpb24gZG9jdW1lbnQgd291bGQgYmUgYSB2ZXJ5IHVzZWZ1bCBzdGFydC4gIFdlIGFyZSBsb29r aW5nIGZvciB2b2x1bnRlZXJzIHRvIGhlbHAgY3JlYXRlIHRoaXMgdGVtcGxhdGUgYW5kIGd1aWRh bmNlLg0KPiANCj4gKiAgICAgICBXaGF0IGFyZSB5b3VyIHRob3VnaHRzIG9uIGEgdGVtcGxhdGUg KG1heWJlIGJhc2VkIG9mZiBvZiBSRkM1OTAxKSBiZWZvcmUgd2UgbW92ZSBpbnRvIHRoZSBjcmVh dGlvbi9tb2RpZmljYXRpb24gb2YgYW55IElPREVGIGV4dGVuc2lvbnM/DQo+IA0KPiBIZXJlIGlz IHRoZSBsaXN0IG9mIHByb3Bvc2VkIGV4dGVuc2lvbnMgd2l0aCBzb21lIHZvbHVudGVlciBlZGl0 b3JzIGxpc3RlZCAobW9yZSBhcmUgd2VsY29tZSkuICBJcyB0aGlzIHRoZSByaWdodCBsaXN0IG9m IGV4dGVuc2lvbnM/DQo+IA0KPiAqICAgICAgIE1haWwgYWJ1c2UgKGZyb20gTUFSRiBXRykNCj4g KiAgICAgICBGb3JlbnNpYyBkYXRhIChZb3VuLUhlZSBHaWwgYW5kIERvd29uIEhvbmcpDQo+ICog ICAgICAgVmlydHVhbGl6ZWQgZW52aXJvbm1lbnRzIChOSVNUIENsb3VkIFdHIHBhcnRpY2lwYW50 czogTWF0dCBTbWl0aCBhbmQgUGhpbCBDb3gpDQo+ICogICAgICAgTWFsaWNpb3VzIGluZnJhc3Ry dWN0dXJlIC0gUkVOLUlTQUM/DQo+ICogICAgICAgQWN0b3IgcHJvZmlsZXMgLSBSRU4tSVNBQz8N Cj4gKiAgICAgICBNYWxpY2lvdXMgY29kZSBjaGFyYWN0ZXJpc3RpY3MgLSBSRU4tSVNBQz8NCj4g KiAgICAgICBJbnRlZ3JhdGluZyBTQ0FQIENvbnRlbnQgKG1heSBiZSB0aHJvdWdoIG9uZSBvZiB0 aGUgYWJvdmUpDQo+ICogICAgICAgRmluYW5jaWFsIHRyYW5zYWN0aW9uL2ZyYXVkIC0gcmV2aWV3 L2NoYW5nZSBSRkM1OTAxDQo+IA0KPiANCj4gQmVzdCByZWdhcmRzLA0KPiBLYXRobGVlbiwgQnJp YW4sICYgVG9tDQo+IA0KPiANCj4gDQo+IA0KPiANCj4gX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCj4gbWlsZSBtYWlsaW5nIGxpc3QNCj4gbWlsZUBpZXRm Lm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL21pbGUNCj4gDQo+ IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+IG1pbGUg bWFpbGluZyBsaXN0DQo+IG1pbGVAaWV0Zi5vcmcNCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9taWxlDQoNCj09PT09PT09PT09PT09DQpEYW1pciBSYWpub3ZpYyA8cHNp cnRAY2lzY28uY29tPiwgUFNJUlQgSW5jaWRlbnQgTWFuYWdlciwgQ2lzY28gU3lzdGVtcw0KPGh0 dHA6Ly93d3cuY2lzY28uY29tL2dvL3BzaXJ0PiAgICAgIFRlbGVwaG9uZTogKzQ0IDc3MTUgNTQ2 IDAzMw0KMjAwIExvbmd3YXRlciBBdmVudWUsIEdyZWVuIFBhcmssIFJlYWRpbmcsIEJlcmtzaGly ZSBSRzIgNkdCLCBHQg0KPT09PT09PT09PT09PT0NClRoZXJlIGFyZSBubyBpbnNvbHZhYmxlIHBy b2JsZW1zLiANClRoZSBxdWVzdGlvbiBpcyBjYW4geW91IGFjY2VwdCB0aGUgc29sdXRpb24/IA0K DQpodHRwOi8vd3d3LmNpc2NvcHJlc3MuY29tL2Jvb2tzdG9yZS9wcm9kdWN0LmFzcD9pc2JuPTE1 ODcwNTI2NDQNCg0KLSAtIC0gLQ0KQ2lzY28uY29tIC0gaHR0cDovL3d3dy5jaXNjby5jb20vZ2xv YmFsL1VLDQoNClRoaXMgZS1tYWlsIG1heSBjb250YWluIGNvbmZpZGVudGlhbCBhbmQgcHJpdmls ZWdlZCBtYXRlcmlhbCBmb3IgdGhlIHNvbGUgDQp1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVu dC4gQW55IHJldmlldywgdXNlLCBkaXN0cmlidXRpb24gb3IgZGlzY2xvc3VyZSBieSANCm90aGVy cyBpcyBzdHJpY3RseSBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVj aXBpZW50IChvciANCmF1dGhvcml6ZWQgdG8gcmVjZWl2ZSBmb3IgdGhlIHJlY2lwaWVudCksIHBs ZWFzZSBjb250YWN0IHRoZSBzZW5kZXIgYnkgcmVwbHkgDQplLW1haWwgYW5kIGRlbGV0ZSBhbGwg Y29waWVzIG9mIHRoaXMgbWVzc2FnZS4NCg0KQ2lzY28gU3lzdGVtcyBMaW1pdGVkIChDb21wYW55 IE51bWJlcjogMDI1NTg5MzkpLCBpcyByZWdpc3RlcmVkIGluIEVuZ2xhbmQgDQphbmQgV2FsZXMg d2l0aCBpdHMgcmVnaXN0ZXJlZCBvZmZpY2UgYXQgMSBDYWxsYWdoYW4gU3F1YXJlLCBDYXJkaWZm LCANClNvdXRoIEdsYW1vcmdhbiBDRjEwIDVCVA0KDQpGb3IgY29ycG9yYXRlIGxlZ2FsIGluZm9y bWF0aW9uIGdvIHRvOg0KaHR0cDovL3d3dy5jaXNjby5jb20vd2ViL2Fib3V0L2RvaW5nX2J1c2lu ZXNzL2xlZ2FsL2NyaS9pbmRleC5odG1sDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQptaWxlIG1haWxpbmcgbGlzdA0KbWlsZUBpZXRmLm9yZw0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9taWxlDQoNCg== From kathleen.moriarty@emc.com Mon Jun 6 08:48:55 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B13A611E8160 for ; Mon, 6 Jun 2011 08:48:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jJA67yW5paxM for ; Mon, 6 Jun 2011 08:48:54 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id BE7F411E8159 for ; Mon, 6 Jun 2011 08:48:54 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56FmrnI004678 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 6 Jun 2011 11:48:53 -0400 Received: from mailhub.lss.emc.com (mailhubhoprd03.lss.emc.com [10.254.221.145]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor); Mon, 6 Jun 2011 11:48:37 -0400 Received: from mxhub01.corp.emc.com (mxhub01.corp.emc.com [10.254.141.103]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p56Fh8Bc027221; Mon, 6 Jun 2011 11:43:09 -0400 Received: from mx06a.corp.emc.com ([169.254.1.35]) by mxhub01.corp.emc.com ([10.254.141.103]) with mapi; Mon, 6 Jun 2011 11:43:08 -0400 From: To: , Date: Mon, 6 Jun 2011 11:43:07 -0400 Thread-Topic: [mile] contemplating data sharing restrictions/markings Thread-Index: Acwf/noJS1dY3ggQToSWrNcQbHIekQEYPcrQ Message-ID: References: <973940887.538232.1306261709807.JavaMail.root@linzimmb03o.imo.intelink.gov><6F6CDFD9-9EBB-474A-ABE9-25A18EFE0E69@cloudsecurityalliance.org><4DE011F0.2080708@yaanatech.com><79E6A88F-40FC-4F32-8D73-069A0DC1DEBF@tik.ee.ethz.ch><4DE4F409.6030200@yaanatech.com> <5EA5E378841F7043B9815EE1E6FAAB8F0E9DA0@hive.bronze.us-cert.gov> <4DE59A31.6030307@ren-isac.net> In-Reply-To: <4DE59A31.6030307@ren-isac.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: Re: [mile] contemplating data sharing restrictions/markings X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jun 2011 15:48:55 -0000 Thank you, Gabe. It may help those on the list to get more information on = this approach to help determine what is already covered, where guidance is = needed, and what additions will be required. The current RFC documents use= the restriction markers in examples and provide techniques to deal with pr= ivacy, security and policy. If there are gaps or if guidance is needed, it= would be very helpful to sort through all of that. Are there differences = in Pat Cain's approach that should be elaborated upon? Thank you, Kathleen=20 -----Original Message----- From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of Gab= riel Iovino Sent: Tuesday, May 31, 2011 9:47 PM To: mile@ietf.org Subject: Re: [mile] contemplating data sharing restrictions/markings -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 5/31/2011 6:03 PM, Thomas.Millar@us-cert.gov wrote: > I would really be interested to see if Pat's attribute-based approach is > achievable=20 +1 What Pat described is very similar to what we have discussed trying to implement within the REN-ISAC community so we can better share information outside of the REN-ISAC membership. I would like to highlight two potentially different sets of data we may be trying to share: 1. Identified miscreant infrastruture (e.g. C&C's, Phishing URLs, Malware download infrastructure, etc) 2. PII data (e.g. CC #s, SS #s, username/password, etc) The REN-ISAC community shares miscreant infrastructure for the purpose of operational protection and response without much concern with breaking information disclosure laws and regulation as I am not aware of anything that says you cannot share an identified malicious C&C. (note: I am not well versed in EU laws) On the other hand, we do not share PII data on a regular basis as there are laws and regulations that need to be taken into consideration AND I am not sure how much operational protection value this data has. (of course one would like to tell the account owner/holder they have had a breach but I view this differently than sharing miscreant infrastructure) There may be value in trying to come up with some agreed upon nomenclature to share PII data but I would hate to see us fail on this endeavor due to the complexities of PII when in reality a lot of us want and need to share miscreant infrastructure data sets. > it isn't about broad strokes as much as it is ensuring > your constituency/partners all agree on whatever certificate or token > scheme you employ as "proofs" that a user fits the mold you identify as > privileged or trusted. +1 Gabe - -- Gabriel Iovino Principal Security Engineer, REN-ISAC http://www.ren-isac.net 24x7 Watch Desk +1(317)278-6630 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk3lmjEACgkQwqygxIz+pTsmNQCeOnVRj3z+kB7GdQVFuTnbtA9W MG8AoKp+hCGFgvh0aDDNX0PedmFP+NFm =3DjmaW -----END PGP SIGNATURE----- _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile From kathleen.moriarty@emc.com Wed Jun 29 15:19:05 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AADA211E80C4 for ; Wed, 29 Jun 2011 15:19:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3QAS0UwlQdUz for ; Wed, 29 Jun 2011 15:19:04 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 7E14911E80A6 for ; Wed, 29 Jun 2011 15:19:04 -0700 (PDT) Received: from hop04-l1d11-si03.isus.emc.com (HOP04-L1D11-SI03.isus.emc.com [10.254.111.23]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p5TMJ16h009187 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 29 Jun 2011 18:19:01 -0400 Received: from mailhub.lss.emc.com (mailhubhoprd03.lss.emc.com [10.254.221.145]) by hop04-l1d11-si03.isus.emc.com (RSA Interceptor) for ; Wed, 29 Jun 2011 18:18:50 -0400 Received: from mxhub30.corp.emc.com (mxhub30.corp.emc.com [128.221.47.159]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p5TMHOi2002544 for ; Wed, 29 Jun 2011 18:17:24 -0400 Received: from mx06a.corp.emc.com ([169.254.1.199]) by mxhub30.corp.emc.com ([128.221.47.159]) with mapi; Wed, 29 Jun 2011 18:17:24 -0400 From: To: Date: Wed, 29 Jun 2011 18:17:22 -0400 Thread-Topic: MILE 'side meeting' Monday night July 25th Thread-Index: Acw2qlGEERoB3FLoSlqzLXntISs/Bw== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: [mile] MILE 'side meeting' Monday night July 25th X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jun 2011 22:19:05 -0000 Hello, This email is to announce that we will be holding a side meeting for a pre-= working group to review the proposed charter and some of the work to be com= pleted in the proposed group. The side meeting will take place Monday, Jul= y 25th following the Technical Plenary, at 19:30. Please let Brian and I k= now if you would like to present on any of the drafts in progress. In addi= tion to reviewing the charter, Brian will provide a review of the template = and guidance for IODEF extensions to help jumpstart drafts for the next mee= ting. Dr. Katherine Goodier will also present the approach(es) that she an= d Gaus have been working on for the data restriction/marking extension. Thank you, Kathleen & Brian Managed Incident Lightweight Exchange (mile) -------------------------------------------- Proposed Working Group Charter Chairs: Kathleen Moriarty > Brian Trammell > Security Area Directors: Stephen Farrell > Sean Turner > Security Area Advisor: Sean Turner > Mailing Lists: General Discussion: mile@ietf.org To Subscribe: http://www.ietf.org/mailman/listinfo/mile Archive: http://www.ietf.org/mail-archive/web/mile Description of Working Group: The Managed Incident Lightweight Exchange (MILE) pre-working group will dev= elop standards and extensions for the purpose of improving incident informa= tion sharing and handling capabilities based on the work developed in the I= ETF Extended INCident Handling (INCH) working group. The Incident Object D= escription Exchange Format (IODEF) in RFC5070 and Real-time Inter-network D= efense (RID) in RFC6045 were developed in the INCH working group by interna= tional Computer Security Incident Response Teams (CSIRTs) and industry to m= eet the needs of a global community interested in sharing, handling, and ex= changing incident information. The extensions and guidance created by the = MILE working group assists with the daily operations of CSIRTs at an organi= zation, service provider, law enforcement, and at the country level. The a= pplication of IODEF and RID to interdomain incident information cooperative= exchange and sharing has recently expanded and the need for extensions has= become more important. Efforts continue to deploy IODEF and RID, as well a= s to extend them to support specific use cases covering reporting and mitig= ation of current threats such as anti-phishing extensions. An incident could be a benign configuration issue, IT incident, an infracti= on to a service level agreement (SLA), a system compromise, socially engine= ered phishing attack, or a denial-of-service (DoS) attack, etc.. When an i= ncident is detected, the response may include simply filing a report, notif= ication to the source of the incident, a request to a third party for resol= ution/mitigation, or a request to locate the source. IODEF defines a data = representation that provides a standard format for sharing information comm= only exchanged about computer security incidents. RID enables the secure e= xchange of incident related information in an IODEF format providing option= s for security, privacy, and policy setting. MILE leverages collaboration and sharing experiences with the work develope= d in the INCH working group which includes the data model detailed in the I= ODEF, existing extensions to the IODEF for Anti-phishing (RFC5901), and RID= (RFC6045, RFC6046) for the secure exchange of information. MILE will also= leverage the experience gained in using IODEF and RID in operational conte= xts. Related work, drafted outside of INCH will also be reviewed and includ= es RFC5941, Sharing Transaction Fraud Data. The MILE working group provides coordination for these various extension ef= forts to improve the capabilities for exchanging incident information. MIL= E has several objectives with the first being a description a subset of IOD= EF focused on ease of deployment and applicability to current information s= ecurity data sharing use cases. MILE also describes a generalization of RI= D for secure exchange of other security-relevant XML formats. MILE produce= s additional guidance needed for the successful exchange of incident inform= ation for new use cases according to policy, security, and privacy requirem= ents. Finally, MILE produces a document template with guidance for definin= g IODEF extensions to be followed when producing extensions to IODEF as app= ropriate, for: * labeling incident reports with data protection, data retention, and oth= er policies, regulations, and laws restricting the handling of those reports * reporting on mail service abuse incidents * reporting forensic data generated during incident investigation * reporting indicators of compromise in incident reports * reporting on financial fraud incidents * reporting incidents involving virtualized environments * referencing SCAP enumerations from within incident reports * profiling and reporting on characteristics of malware suspected or conf= irmed to be involved in an incident * profiling and reporting on characteristics of actors (persons or groups= ) suspected or confirmed to be involved in an incident * reporting on misuse incidents Kathleen M. Moriarty, CISSP | GRC Strategy | Office of the CTO | 617-851-58= 07 | Kathleen.Moriarty@emc.com | EMC Corporation