From kathleen.moriarty@emc.com Mon Oct 3 06:36:11 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2ABDB21F8B3C for ; Mon, 3 Oct 2011 06:36:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.482 X-Spam-Level: X-Spam-Status: No, score=-6.482 tagged_above=-999 required=5 tests=[AWL=0.117, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wnGb6FIlcXzZ for ; Mon, 3 Oct 2011 06:36:10 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 338F321F8B38 for ; Mon, 3 Oct 2011 06:36:09 -0700 (PDT) Received: from hop04-l1d11-si03.isus.emc.com (HOP04-L1D11-SI03.isus.emc.com [10.254.111.23]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p93DdA7W005056 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 3 Oct 2011 09:39:10 -0400 Received: from mailhub.lss.emc.com (mailhub.lss.emc.com [10.254.221.251]) by hop04-l1d11-si03.isus.emc.com (RSA Interceptor) for ; Mon, 3 Oct 2011 09:38:58 -0400 Received: from mxhub15.corp.emc.com (mxhub15.corp.emc.com [128.221.56.104]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p93Dcw4k003847 for ; Mon, 3 Oct 2011 09:38:58 -0400 Received: from mx06a.corp.emc.com ([169.254.1.225]) by mxhub15.corp.emc.com ([128.221.56.104]) with mapi; Mon, 3 Oct 2011 09:38:58 -0400 From: To: , Date: Mon, 3 Oct 2011 09:38:55 -0400 Thread-Topic: Proposed MILE charter Thread-Index: Acx4c+pCc3LQ9j2SSDmCMSTngDjrSwJXQmwQ Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: Re: [mile] Proposed MILE charter X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Oct 2011 13:36:11 -0000 Hello, We had another draft submitted that could be used as initial input. I am a= dding to the list. It is a first draft, so there are a few things that nee= d to be tweaked (draft name). Thanks, Kathleen Managed Incident Lightweight Exchange (mile) -------------------------------------------- Proposed Working Group Charter Chairs: TBD Security Area Directors: Stephen Farrell > Sean Turner > Security Area Advisor: Sean Turner >> Mailing Lists: General Discussion: mile@ietf.org> To Subscribe: http://www.ietf.org/mailman/listinfo/mile Archive: http://www.ietf.org/mail-archive/web/mile Description: The Managed Incident Lightweight Exchange (MILE) working group will develop standards and extensions for the purpose of improving incident information sharing and handling capabilities based on the work developed in the IETF Extended INCident Handling (INCH) working group. The Incident Object Description Exchange Format (IODEF) in RFC5070 and Real-time Inter-network Defense (RID) in RFC6045 were developed in the INCH working group by international Computer Security Incident Response Teams (CSIRTs) and industry to meet the needs of a global community interested in sharing, handling, and exchanging incident information. The extensions and guidance created by the MILE working group assists with the daily operations of CSIRTs at an organization, service provider, law enforcement, and at the country level. The application of IODEF and RID to interdomain incident information cooperative exchange and sharing has recently expanded and the need for extensions has become more important. Efforts continue to deploy IODEF and RID, as well as to extend them to support specific use cases covering reporting and mitigation of current threats such as anti-phishing extensions. An incident could be a benign configuration issue, IT incident, an infraction to a service level agreement (SLA), a system compromise, socially engineered phishing attack, or a denial-of-service (DoS) attack, etc. When an incident is detected, the response may include simply filing a report, notification to the source of the incident, a request to a third party for resolution/mitigation, or a request to locate the source. IODEF defines a data representation that provides a standard format for sharing information commonly exchanged about computer security incidents. RID enables the secure exchange of incident related information in an IODEF format providing options for security, privacy, and policy setting. MILE leverages collaboration and sharing experiences with the work developed in the INCH working group which includes the data model detailed in the IODEF, existing extensions to the IODEF for Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure exchange of information. MILE will also leverage the experience gained in using IODEF and RID in operational contexts. Related work, drafted outside of INCH will also be reviewed and includes RFC5941, Sharing Transaction Fraud Data. The MILE working group provides coordination for these various extension efforts to improve the capabilities for exchanging incident information. MILE has several objectives with the first being a description a subset of IODEF focused on ease of deployment and applicability to current information security data sharing use cases. MILE also describes a generalization of RID for secure exchange of other security-relevant XML formats. MILE produces additional guidance needed for the successful exchange of incident information for new use cases according to policy, security, and privacy requirements. Finally, MILE produces a document template with guidance for defining IODEF extensions to be followed when producing extensions to IODEF as appropriate, for: * labeling incident reports with data protection, data retention, and other policies, regulations, and laws restricting the handling of those reports * referencing structured security information from within incident reports * reporting forensic data generated during an incident investigation (computer or accounting) The WG will produce the following: * An informational document on IODEF Guidance. * A Standards Track document specifying the Real-time Inter-network Defense (RID). * A Standards Track document specifying the transport for RID. * An informational template for extensions to IODEF. * A Standards Track document for IODEF Extensions in IANA XML Registry. * A Standards Track document for IODEF Extension to support structured cybersecurity information. * A Standards Track document for Labeling for data protection, retention, policies, and regulations. * A Standards Track document for GRC Report Exchange. * A Standards Track document for IODEF Extension to support forensics. The drafts under consideration as WG items include: * Real-time Inter-network Defense (RID) bis: draft-moriarty-mile-rfc6045-bis-01 * Transport of Real-time Inter-network Defense (RID) Messages bis: draft-trammell-mile-rfc6046-bis-00 * Template for extensions to IODEF: draft-trammell-mile-template-01.txt * IODEF Extensions in IANA XML Registry: draft-trammell-mile-iodef-xmlreg-00.txt * GRC Report Exchange (Generalized RID for XML reports/documents): draft-moriarty-mile-grc-exchange-00.txt * IODEF-extension to support structured cybersecurity information: draft-takahashi-mile-sci-00.txt * IODEF Extension, Labeling for data protection, retention, policies, an= d regulations draft-goodier-mile-data-markers-00.txt Milestones WGLC =3D Working Group Last Call 2011-11 - WGLC Real-time Inter-network Defense (RID) 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - WGLC Template for extensions to IODEF 2011-12 - WGLC IODEF Extensions in IANA XML Registry 2011-12 - WGLC IODEF Extension to support structured cybersecurity information 2012-02 - Submit Template for extensions to IODEF to IESG for consideration as Informational document 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for consideration as Standards Track document 2012-02 - Submit IODEF Extension to support structured cybersecurity information to IESG for consideration as Standards Track document 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, policies, and regulations 2012-03 - WGLC IODEF Guidance 2012-04 - Submit IODEF Extension Labeling for data protection, retention, policies, and regulations to IESG for consideration as Standards Track document 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as Informational document 2012-05 - WGLC GRC Report Exchange 2012-06 - Submit GRC Report Exchange to IESG for consideration as Standards Track document 2012-06 - WGLC Forensics extension 2012-07 - Submit IODEF Forensics extension to IESG for consideration as Standards Track document _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile From vesely@tana.it Tue Oct 4 04:36:38 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9649721F8CBC for ; Tue, 4 Oct 2011 04:36:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.628 X-Spam-Level: X-Spam-Status: No, score=-4.628 tagged_above=-999 required=5 tests=[AWL=0.091, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KFMElOaDXTke for ; Tue, 4 Oct 2011 04:36:38 -0700 (PDT) Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id C630A21F8CB0 for ; Tue, 4 Oct 2011 04:36:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1317728381; bh=N6w0s7cFdKcPQE1LAbTrS7+5+LLPVOFPcJbBgw/YE3A=; l=1408; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=IudV25FVjXTKxWiyzr+/rfhuFIMoalpwip+hNjiWOqtO6sgkLg4xCrFpY8/a8GhQ5 Si46nxgUXCdn7mLLxZQuBYBlyg5iST5L3j9HBOXJWALDunpG5dNkzKuMoNVGm6Cb9p WdjJJHH2uBS/dKoKOnK8UlOzjC9wAygJnOPaLGTE= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Tue, 04 Oct 2011 13:39:41 +0200 id 00000000005DC033.000000004E8AF07D.00001638 Message-ID: <4E8AF07C.5030805@tana.it> Date: Tue, 04 Oct 2011 13:39:40 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:7.0) Gecko/20110922 Thunderbird/7.0 MIME-Version: 1.0 To: Managed Incident Lightweight Exchange IODEF extensions and RID exchanges References: <20111004104836.23968.94302.idtracker@ietfa.amsl.com> In-Reply-To: <20111004104836.23968.94302.idtracker@ietfa.amsl.com> X-Forwarded-Message-Id: <20111004104836.23968.94302.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: [mile] draft-vesely-mile-mail-abuse X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Oct 2011 11:36:38 -0000 Hi all, I've been lurking here in order to comment on IODEF extensions on mail abuse, that used to be part of the list of proposed extensions. But no draft was submitted and the topic was dropped from recent proposed MILE charters. So I tried and draft an extension myself. I have no experience at all with IODEF, thus this draft is in need of a sharp review, if it's going to be any good. -------- Original Message -------- From: internet-drafts@ietf.org To: i-d-announce@ietf.org Subject: I-D Action: draft-vesely-mile-mail-abuse-00.txt Date: Tue, 04 Oct 2011 03:48:36 -0700 A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : IODEF Extension to Support Mail Abuse Reporting Author(s) : Alessandro Vesely Filename : draft-vesely-mile-mail-abuse-00.txt Pages : 12 Date : 2011-10-04 This document extends the Incident Object Description Exchange Format (IODEF) to allow mail-abuse reports to be shared as Incidents in the IODEF framework. Two URLs for this Internet-Draft are: http://www.ietf.org/internet-drafts/draft-vesely-mile-mail-abuse-00.txt http://http://tools.ietf.org/html/draft-vesely-mile-mail-abuse Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ This Internet-Draft can be retrieved at: ftp://ftp.ietf.org/internet-drafts/draft-vesely-mile-mail-abuse-00.txt From kathleen.moriarty@emc.com Fri Oct 7 09:01:59 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1401621F8AF5 for ; Fri, 7 Oct 2011 09:01:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.426 X-Spam-Level: X-Spam-Status: No, score=-6.426 tagged_above=-999 required=5 tests=[AWL=0.173, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sloP9z2tCSTM for ; Fri, 7 Oct 2011 09:01:58 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 7011421F8AD8 for ; Fri, 7 Oct 2011 09:01:58 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p97G59In009595 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 7 Oct 2011 12:05:09 -0400 Received: from mailhub.lss.emc.com (mailhub.lss.emc.com [10.254.222.226]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor) for ; Fri, 7 Oct 2011 12:05:05 -0400 Received: from mxhub10.corp.emc.com (mxhub10.corp.emc.com [10.254.92.105]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p97G54KS017956 for ; Fri, 7 Oct 2011 12:05:04 -0400 Received: from mx06a.corp.emc.com ([169.254.1.225]) by mxhub10.corp.emc.com ([10.254.92.105]) with mapi; Fri, 7 Oct 2011 12:05:04 -0400 From: To: Date: Fri, 7 Oct 2011 12:05:03 -0400 Thread-Topic: New Version Notification for draft-moriarty-mile-grc-exchange-01.txt Thread-Index: AcyFCnac3poTJa6rRq+u3xtw2tlK0wAAAhEQ Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: [mile] FW: New Version Notification for draft-moriarty-mile-grc-exchange-01.txt X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2011 16:01:59 -0000 QW4gdXBkYXRlZCB2ZXJzaW9uIG9mIEdSQy1FeGNoYW5nZSBoYXMgYmVlbiBwb3N0ZWQuICBUaGlz IHZlcnNpb24gYWRkcyB0aGUgcmVzdCBvZiB0aGUgcHJvcG9zZWQgc2NoZW1hLCBtYXRjaGluZyB0 aGUgbWV0aG9kIHVzZWQgYnkgdGhlIHNlY3VyaXR5IGF1dG9tYXRpb24gZXh0ZW5zaW9uIHRvIGlu Y2x1ZGUgb3RoZXIgc2NoZW1hcy4gIFdlJ2xsIGhhdmUgdG8gZmlndXJlIG91dCBpZiBzY2hlbWFz IHNob3VsZCBiZSBtYW5hZ2VkIHRoZSBzYW1lIHdheSBhcyB0aGF0IGV4dGVuc2lvbiBvciBpZiB0 aGlzIGNhbiBiZSBtb3JlIGZsZXhpYmxlLiAgDQoNClRoZSBhY3R1YWwgc2NoZW1hIGlzIG5vdCB5 ZXQgaW5jbHVkZWQsIG5vciBhcmUgZXhhbXBsZXMuDQoNClBsZWFzZSByZXZpZXcgdGhlIGRvY3Vt ZW50IGFuZCBwcm92aWRlIGNvbW1lbnRzLg0KDQpUaGFuayB5b3UhDQpLYXRobGVlbiAmIFNhaWQN Cg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IGludGVybmV0LWRyYWZ0c0BpZXRm Lm9yZyBbbWFpbHRvOmludGVybmV0LWRyYWZ0c0BpZXRmLm9yZ10gDQpTZW50OiBGcmlkYXksIE9j dG9iZXIgMDcsIDIwMTEgMTE6NTkgQU0NClRvOiBNb3JpYXJ0eSwgS2F0aGxlZW4NCkNjOiBUYWJl dCwgU2FpZDsgTW9yaWFydHksIEthdGhsZWVuDQpTdWJqZWN0OiBOZXcgVmVyc2lvbiBOb3RpZmlj YXRpb24gZm9yIGRyYWZ0LW1vcmlhcnR5LW1pbGUtZ3JjLWV4Y2hhbmdlLTAxLnR4dA0KDQpBIG5l dyB2ZXJzaW9uIG9mIEktRCwgZHJhZnQtbW9yaWFydHktbWlsZS1ncmMtZXhjaGFuZ2UtMDEudHh0 IGhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBzdWJtaXR0ZWQgYnkgS2F0aGxlZW4gTW9yaWFydHkgYW5k IHBvc3RlZCB0byB0aGUgSUVURiByZXBvc2l0b3J5Lg0KDQpGaWxlbmFtZToJIGRyYWZ0LW1vcmlh cnR5LW1pbGUtZ3JjLWV4Y2hhbmdlDQpSZXZpc2lvbjoJIDAxDQpUaXRsZToJCSBHUkMgUmVwb3J0 IEV4Y2hhbmdlDQpDcmVhdGlvbiBkYXRlOgkgMjAxMS0xMC0wNw0KV0cgSUQ6CQkgSW5kaXZpZHVh bCBTdWJtaXNzaW9uDQpOdW1iZXIgb2YgcGFnZXM6IDQ1DQoNCkFic3RyYWN0Og0KICAgR292ZXJu YW5jZSwgcmlzaywgYW5kIGNvbXBsaWFuY2UgKEdSQykgcHJvZ3JhbXMgcHJvdmlkZSBvdmVyc2ln aHQNCiAgIChnb3Zlcm5hbmNlKSBvZiByaXNrcyBhbmQgY29tcGxpYW5jZSBpbml0aWF0aXZlcyB3 aXRoaW4gYW4NCiAgIG9yZ2FuaXphdGlvbi4gIEdSQyByZXBvcnRzIGFyZSBpbmNyZWFzaW5nbHkg cHJvdmlkZWQgaW4gYW4gWE1MDQogICBmb3JtYXQuICBUaGlzIHNwZWNpZmljYXRpb24gZGVmaW5l cyBhIGNvbW1vbiBtZXRob2QgdG8gc2VjdXJlbHkNCiAgIHRyYW5zcG9ydCBHUkMgYW5kIG90aGVy IFhNTCByZXBvcnRzLiAgVGhlIGRlZmluZWQgbWVzc2FnaW5nDQogICBjYXBhYmlsaXR5IHByb3Zp ZGVzIHBvbGljeSBvcHRpb25zIGFuZCBtYXJraW5ncyBpbiBhbiBYTUwgc2NoZW1hLA0KICAgb3B0 aW9ucyBmb3IgY29uZmlkZW50aWFsaXR5IGF0IHRoZSBkb2N1bWVudC9yZXBvcnQgbGV2ZWwsIGFu ZA0KICAgc2VjdXJpdHkgZm9yIHRoZSBlbmQtdG8tZW5kIGNvbW11bmljYXRpb24uICBYTUwgcmVw b3J0cyBtYXkgYmUgc2hhcmVkDQogICBiZXR3ZWVuIHNlcnZpY2UgcHJvdmlkZXJzIGFuZCBjbGll bnRzLCBlbnRlcnByaXNlcywgb3Igd2l0aGluDQogICBlbnRlcnByaXNlcy4gIFJlcG9ydHMgbWF5 IGFsc28gYmUgZXhjaGFuZ2VkIGZvciBvZmZpY2lhbCBwdXJwb3Nlcw0KICAgc3VjaCBhcyBidXNp bmVzcyByZXBvcnQgZmlsaW5ncywgY29tcGxpYW5jZSByZXBvcnQgZmlsaW5ncywgYW5kIHRoZQ0K ICAgaGFuZGxpbmcgb2YgbGVnYWwgaW5jaWRlbnRzIChlV2FycmFudCwgZURpc2NvdmVyeSwgZXRj LikgIFRoaXMgd29yaw0KICAgaXMgYSBnZW5lcmFsaXplZCBmb3JtYXQgZGVyaXZlZCBmcm9tIHRo ZSBzZWN1cmUgZXhjaGFuZ2Ugb2YgaW5jaWRlbnQNCiAgIGluZm9ybWF0aW9uIGRlZmluZWQgYnkg UkZDNjA0NS1iaXMsIFJlYWwtdGltZSBJbnRlci1uZXR3b3JrIERlZmVuc2UNCiAgIChSSUQpLg0K DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgDQoNCg0KVGhlIElFVEYgU2VjcmV0YXJpYXQNCg0K From kathleen.moriarty@emc.com Fri Oct 7 09:57:30 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79E3A21F8BD3 for ; Fri, 7 Oct 2011 09:57:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.486 X-Spam-Level: X-Spam-Status: No, score=-6.486 tagged_above=-999 required=5 tests=[AWL=0.113, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DJAKVB-SYhnb for ; Fri, 7 Oct 2011 09:57:29 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 62A0621F8C07 for ; Fri, 7 Oct 2011 09:57:28 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p97H0fFU005744 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 7 Oct 2011 13:00:41 -0400 Received: from mailhub.lss.emc.com (mailhub.lss.emc.com [10.254.222.130]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor) for ; Fri, 7 Oct 2011 13:00:29 -0400 Received: from mxhub14.corp.emc.com (mxhub14.corp.emc.com [128.221.56.103]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p97H0SM7018237 for ; Fri, 7 Oct 2011 13:00:28 -0400 Received: from mx06a.corp.emc.com ([169.254.1.225]) by mxhub14.corp.emc.com ([128.221.56.103]) with mapi; Fri, 7 Oct 2011 13:00:28 -0400 From: To: Date: Fri, 7 Oct 2011 13:00:26 -0400 Thread-Topic: Finding documents Thread-Index: Acx4c+pCc3LQ9j2SSDmCMSTngDjrSwJXQmwQAM+9ahA= Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: [mile] Finding documents X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Oct 2011 16:57:30 -0000 Hello, For those new to the IETF, it may not seem straightforward yet to find docu= ments that are posted for review and comment. I am forwarding the charter = as it lists the name of each draft. I usually Google the name of a documen= t to find the most current version. The GRC-Exchange update is located at = the following link: https://datatracker.ietf.org/doc/draft-moriarty-mile-grc-exchange/ If you use the tracker tool, you will get the latest version of a document.= You can see it is just the file name without the version. If we move to = a working group, the working group page would include links to each of the = working documents. Here are the names of each of the documents that have b= een submitted. The drafts under consideration as WG items include: * Real-time Inter-network Defense (RID) bis: draft-moriarty-mile-rfc6045-bis-01.txt * Transport of Real-time Inter-network Defense (RID) Messages bis: draft-trammell-mile-rfc6046-bis-00.txt * Template for extensions to IODEF: draft-trammell-mile-template-01.txt * IODEF Extensions in IANA XML Registry: draft-trammell-mile-iodef-xmlreg-00.txt * GRC Report Exchange (Generalized RID for XML reports/documents): draft-moriarty-mile-grc-exchange-01.txt * IODEF-extension to support structured cybersecurity information: draft-takahashi-mile-sci-00.txt * IODEF Extension, Labeling for data protection, retention, policies, an= d regulations draft-goodier-mile-data-markers-00.txt Thanks, Kathleen -----Original Message----- From: Moriarty, Kathleen=20 Sent: Monday, October 03, 2011 9:39 AM To: Moriarty, Kathleen; mile@ietf.org Subject: RE: Proposed MILE charter Hello, We had another draft submitted that could be used as initial input. I am a= dding to the list. It is a first draft, so there are a few things that nee= d to be tweaked (draft name). Thanks, Kathleen Managed Incident Lightweight Exchange (mile) -------------------------------------------- Proposed Working Group Charter Chairs: TBD Security Area Directors: Stephen Farrell > Sean Turner > Security Area Advisor: Sean Turner >> Mailing Lists: General Discussion: mile@ietf.org> To Subscribe: http://www.ietf.org/mailman/listinfo/mile Archive: http://www.ietf.org/mail-archive/web/mile Description: The Managed Incident Lightweight Exchange (MILE) working group will develop standards and extensions for the purpose of improving incident information sharing and handling capabilities based on the work developed in the IETF Extended INCident Handling (INCH) working group. The Incident Object Description Exchange Format (IODEF) in RFC5070 and Real-time Inter-network Defense (RID) in RFC6045 were developed in the INCH working group by international Computer Security Incident Response Teams (CSIRTs) and industry to meet the needs of a global community interested in sharing, handling, and exchanging incident information. The extensions and guidance created by the MILE working group assists with the daily operations of CSIRTs at an organization, service provider, law enforcement, and at the country level. The application of IODEF and RID to interdomain incident information cooperative exchange and sharing has recently expanded and the need for extensions has become more important. Efforts continue to deploy IODEF and RID, as well as to extend them to support specific use cases covering reporting and mitigation of current threats such as anti-phishing extensions. An incident could be a benign configuration issue, IT incident, an infraction to a service level agreement (SLA), a system compromise, socially engineered phishing attack, or a denial-of-service (DoS) attack, etc. When an incident is detected, the response may include simply filing a report, notification to the source of the incident, a request to a third party for resolution/mitigation, or a request to locate the source. IODEF defines a data representation that provides a standard format for sharing information commonly exchanged about computer security incidents. RID enables the secure exchange of incident related information in an IODEF format providing options for security, privacy, and policy setting. MILE leverages collaboration and sharing experiences with the work developed in the INCH working group which includes the data model detailed in the IODEF, existing extensions to the IODEF for Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure exchange of information. MILE will also leverage the experience gained in using IODEF and RID in operational contexts. Related work, drafted outside of INCH will also be reviewed and includes RFC5941, Sharing Transaction Fraud Data. The MILE working group provides coordination for these various extension efforts to improve the capabilities for exchanging incident information. MILE has several objectives with the first being a description a subset of IODEF focused on ease of deployment and applicability to current information security data sharing use cases. MILE also describes a generalization of RID for secure exchange of other security-relevant XML formats. MILE produces additional guidance needed for the successful exchange of incident information for new use cases according to policy, security, and privacy requirements. Finally, MILE produces a document template with guidance for defining IODEF extensions to be followed when producing extensions to IODEF as appropriate, for: * labeling incident reports with data protection, data retention, and other policies, regulations, and laws restricting the handling of those reports * referencing structured security information from within incident reports * reporting forensic data generated during an incident investigation (computer or accounting) The WG will produce the following: * An informational document on IODEF Guidance. * A Standards Track document specifying the Real-time Inter-network Defense (RID). * A Standards Track document specifying the transport for RID. * An informational template for extensions to IODEF. * A Standards Track document for IODEF Extensions in IANA XML Registry. * A Standards Track document for IODEF Extension to support structured cybersecurity information. * A Standards Track document for Labeling for data protection, retention, policies, and regulations. * A Standards Track document for GRC Report Exchange. * A Standards Track document for IODEF Extension to support forensics. The drafts under consideration as WG items include: * Real-time Inter-network Defense (RID) bis: draft-moriarty-mile-rfc6045-bis-01.txt * Transport of Real-time Inter-network Defense (RID) Messages bis: draft-trammell-mile-rfc6046-bis-00.txt * Template for extensions to IODEF: draft-trammell-mile-template-01.txt * IODEF Extensions in IANA XML Registry: draft-trammell-mile-iodef-xmlreg-00.txt * GRC Report Exchange (Generalized RID for XML reports/documents): draft-moriarty-mile-grc-exchange-01.txt * IODEF-extension to support structured cybersecurity information: draft-takahashi-mile-sci-00.txt * IODEF Extension, Labeling for data protection, retention, policies, an= d regulations draft-goodier-mile-data-markers-00.txt Milestones WGLC =3D Working Group Last Call 2011-11 - WGLC Real-time Inter-network Defense (RID) 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - WGLC Template for extensions to IODEF 2011-12 - WGLC IODEF Extensions in IANA XML Registry 2011-12 - WGLC IODEF Extension to support structured cybersecurity information 2012-02 - Submit Template for extensions to IODEF to IESG for consideration as Informational document 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for consideration as Standards Track document 2012-02 - Submit IODEF Extension to support structured cybersecurity information to IESG for consideration as Standards Track document 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, policies, and regulations 2012-03 - WGLC IODEF Guidance 2012-04 - Submit IODEF Extension Labeling for data protection, retention, policies, and regulations to IESG for consideration as Standards Track document 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as Informational document 2012-05 - WGLC GRC Report Exchange 2012-06 - Submit GRC Report Exchange to IESG for consideration as Standards Track document 2012-06 - WGLC Forensics extension 2012-07 - Submit IODEF Forensics extension to IESG for consideration as Standards Track document _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile From wwwrun@ietfa.amsl.com Tue Oct 11 09:26:08 2011 Return-Path: X-Original-To: mile@ietf.org Delivered-To: mile@ietfa.amsl.com Received: by ietfa.amsl.com (Postfix, from userid 30) id 90A4A21F8E1F; Tue, 11 Oct 2011 09:26:08 -0700 (PDT) From: IESG Secretary To: IETF Announcement list Content-Type: text/plain; charset="utf-8" Mime-Version: 1.0 Message-Id: <20111011162608.90A4A21F8E1F@ietfa.amsl.com> Date: Tue, 11 Oct 2011 09:26:08 -0700 (PDT) Cc: mile@ietf.org Subject: [mile] WG Review: Managed Incident Lightweight Exchange (mile) X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: iesg@ietf.org List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Oct 2011 16:26:08 -0000 A new IETF working group has been proposed in the Security Area. The IESG has not made any determination as yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by Tuesday, October 18, 2011. Managed Incident Lightweight Exchange (mile) -------------------------------------------- Status: Proposed Working Group Charter Last Updated: 2011-09-21 Chairs: TBD Security Area Directors: Stephen Farrell Sean Turner Security Area Advisor: Sean Turner Mailing Lists: General Discussion: mile@ietf.org To Subscribe: http://www.ietf.org/mailman/listinfo/mile Archive: http://www.ietf.org/mail-archive/web/mile Description: The Managed Incident Lightweight Exchange (MILE) working group will develop standards and extensions for the purpose of improving incident information sharing and handling capabilities based on the work developed in the IETF Extended INCident Handling (INCH) working group. The Incident Object Description Exchange Format (IODEF) in RFC5070 and Real-time Inter-network Defense (RID) in RFC6045 were developed in the INCH working group by international Computer Security Incident Response Teams (CSIRTs) and industry to meet the needs of a global community interested in sharing, handling, and exchanging incident information. The extensions and guidance created by the MILE working group assists with the daily operations of CSIRTs at an organization, service provider, law enforcement, and at the country level. The application of IODEF and RID to interdomain incident information cooperative exchange and sharing has recently expanded and the need for extensions has become more important. Efforts continue to deploy IODEF and RID, as well as to extend them to support specific use cases covering reporting and mitigation of current threats such as anti-phishing extensions. An incident could be a benign configuration issue, IT incident, an infraction to a service level agreement (SLA), a system compromise, socially engineered phishing attack, or a denial-of-service (DoS) attack, etc. When an incident is detected, the response may include simply filing a report, notification to the source of the incident, a request to a third party for resolution/mitigation, or a request to locate the source. IODEF defines a data representation that provides a standard format for sharing information commonly exchanged about computer security incidents. RID enables the secure exchange of incident related information in an IODEF format providing options for security, privacy, and policy setting. MILE leverages collaboration and sharing experiences with the work developed in the INCH working group which includes the data model detailed in the IODEF, existing extensions to the IODEF for Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure exchange of information. MILE will also leverage the experience gained in using IODEF and RID in operational contexts. Related work, drafted outside of INCH will also be reviewed and includes RFC5941, Sharing Transaction Fraud Data. The MILE working group provides coordination for these various extension efforts to improve the capabilities for exchanging incident information. MILE has several objectives with the first being a description a subset of IODEF focused on ease of deployment and applicability to current information security data sharing use cases. MILE also describes a generalization of RID for secure exchange of other security-relevant XML formats. MILE produces additional guidance needed for the successful exchange of incident information for new use cases according to policy, security, and privacy requirements. Finally, MILE produces a document template with guidance for defining IODEF extensions to be followed when producing extensions to IODEF as appropriate, for: * labeling incident reports with data protection, data retention, and other policies, regulations, and laws restricting the handling of those reports * referencing structured security information from within incident reports * reporting forensic data generated during an incident investigation (computer or accounting) The WG will produce the following: * An informational document on IODEF Guidance. * A Standards Track document specifying the Real-time Inter-network Defense (RID). * A Standards Track document specifying the transport for RID. * An informational template for extensions to IODEF. * A Standards Track document for IODEF Extensions in IANA XML Registry. * A Standards Track document for IODEF Extension to support structured cybersecurity information. * A Standards Track document for Labeling for data protection, retention, policies, and regulations. * A Standards Track document for GRC Report Exchange. * A Standards Track document for IODEF Extension to support forensics. The drafts under consideration as WG items include: * Real-time Inter-network Defense (RID) bis: draft-moriarty-mile-rfc6045-bis-01 * Transport of Real-time Inter-network Defense (RID) Messages bis: draft-trammell-mile-rfc6046-bis-00 * Template for extensions to IODEF: draft-trammell-mile-template-01.txt * IODEF Extensions in IANA XML Registry: draft-trammell-mile-iodef-xmlreg-00.txt * GRC Report Exchange (Generalized RID for XML reports/documents): draft-moriarty-mile-grc-exchange-00.txt * IODEF-extension to support structured cybersecurity information: draft-takahashi-mile-sci-00.txt Milestones WGLC = Working Group Last Call 2011-11 - WGLC Real-time Inter-network Defense (RID) 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - WGLC Template for extensions to IODEF 2011-12 - WGLC IODEF Extensions in IANA XML Registry 2011-12 - WGLC IODEF Extension to support structured cybersecurity information 2012-02 - Submit Template for extensions to IODEF to IESG for consideration as Informational document 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for consideration as Standards Track document 2012-02 - Submit IODEF Extension to support structured cybersecurity information to IESG for consideration as Standards Track document 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, policies, and regulations 2012-03 - WGLC IODEF Guidance 2012-04 - Submit IODEF Extension Labeling for data protection, retention, policies, and regulations to IESG for consideration as Standards Track document 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as Informational document 2012-05 - WGLC GRC Report Exchange 2012-06 - Submit GRC Report Exchange to IESG for consideration as Standards Track document 2012-06 - WGLC Forensics extension 2012-07 - Submit IODEF Forensics extension to IESG for consideration as Standards Track document From kathleen.moriarty@emc.com Wed Oct 19 08:30:45 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C056121F84E5 for ; Wed, 19 Oct 2011 08:30:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MmK645DatixT for ; Wed, 19 Oct 2011 08:30:45 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 22FF621F8880 for ; Wed, 19 Oct 2011 08:30:44 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9JFUIli020661 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 19 Oct 2011 11:30:18 -0400 Received: from mailhub.lss.emc.com ([10.254.222.129]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor) for ; Wed, 19 Oct 2011 11:30:05 -0400 Received: from mxhub33.corp.emc.com (mxhub33.corp.emc.com [10.254.93.81]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9JFU4X6028272 for ; Wed, 19 Oct 2011 11:30:05 -0400 Received: from mx06a.corp.emc.com ([169.254.1.225]) by mxhub33.corp.emc.com ([::1]) with mapi; Wed, 19 Oct 2011 11:30:04 -0400 From: To: Date: Wed, 19 Oct 2011 11:30:01 -0400 Thread-Topic: IETF 82, important dates Thread-Index: AcyOc/fLDijfFpD0S0aKwhs1C0Vf+w== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: [mile] IETF 82, important dates X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Oct 2011 15:30:45 -0000 Hello, Since many of you are new to the IETF, I thought it might be helpful to sen= d out a link to the important dates link that you may need to be aware of p= rior to the IETF82 in Taipei. The IETF meeting starts on Sunday, November = 13th with introductory sessions and a social. If you are attending for the= first time, it is a good idea to attend some of the sessions offered and o= f course the social to meet a few people. If you have a draft that will be= submitted (initial or an updated draft), see the important dates below. Main page for IETF82: http://www.ietf.org/meeting/82/index.html The link for remote participation is not active yet, but we will have optio= ns available to accommodate. Usually people who are remote type in questio= ns or comments via jabber and someone in the room keep up the jabber sessio= n and relays the comments to those in the room. I've been in rooms where t= here is audio (we did this at the last meeting where we held a 'side meetin= g' and used a conference bridge). If appropriate, we'll use a webex sessio= n. Agenda: The MILE meeting slot is on Wednesday, during the afternoon session from 15= :10-16:10 local time (Taipei) https://datatracker.ietf.org/meeting/82/agenda.html Important Dates: http://www.ietf.org/meeting/cutoff-dates-2011.html#IETF82 Here are some of the dates that may be relevant to those on the list: * 2011-10-24 (Monday): Internet Draft Cut-off for initial document (-00) s= ubmission by 17:00 PT (00:00 UTC), upload using IETF ID Submission Tool. * 2011-10-31 (Monday): Internet Draft final submission cut-off by 17:00 PT= (00:00 UTC), upload using IETF ID Submission Tool. * 2011-11-04 (Friday): Early Bird registration and payment cut-off at 17:0= 0 PT (00:00 UTC). * 2011-11-07 (Monday): Registration cancellation cut-off at 17:00 PT (00:0= 0 UTC). * 2011-11-11 (Friday): Final Pre-Registration and Pre-Payment cut-off at 1= 7:00 local meeting time. Let us know if you have any questions! Thank you, Kathleen From wwwrun@ietfa.amsl.com Tue Oct 25 09:45:55 2011 Return-Path: X-Original-To: mile@ietf.org Delivered-To: mile@ietfa.amsl.com Received: by ietfa.amsl.com (Postfix, from userid 30) id B51EC21F89BA; Tue, 25 Oct 2011 09:45:55 -0700 (PDT) From: IESG Secretary To: IETF Announcement list Content-Type: text/plain; charset="utf-8" Mime-Version: 1.0 Message-Id: <20111025164555.B51EC21F89BA@ietfa.amsl.com> Date: Tue, 25 Oct 2011 09:45:55 -0700 (PDT) Cc: mile@ietf.org Subject: [mile] WG Action: Managed Incident Lightweight Exchange (mile) X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Oct 2011 16:45:55 -0000 A new IETF working group has been formed in the Security Area. For additional information, please contact the Area Directors or the WG Chairs. Managed Incident Lightweight Exchange (mile) -------------------------------------------- Status: Proposed Working Group Charter Last Updated: 2011-09-21 Chairs: Kathleen Moriarty Brian Trammell Security Area Directors: Stephen Farrell Sean Turner Security Area Advisor: Sean Turner Mailing Lists: General Discussion: mile@ietf.org To Subscribe: http://www.ietf.org/mailman/listinfo/mile Archive: http://www.ietf.org/mail-archive/web/mile Description: The Managed Incident Lightweight Exchange (MILE) working group will develop standards and extensions for the purpose of improving incident information sharing and handling capabilities based on the work developed in the IETF Extended INCident Handling (INCH) working group. The Incident Object Description Exchange Format (IODEF) in RFC5070 and Real-time Inter-network Defense (RID) in RFC6045 were developed in the INCH working group by international Computer Security Incident Response Teams (CSIRTs) and industry to meet the needs of a global community interested in sharing, handling, and exchanging incident information. The extensions and guidance created by the MILE working group assists with the daily operations of CSIRTs at an organization, service provider, law enforcement, and at the country level. The application of IODEF and RID to interdomain incident information cooperative exchange and sharing has recently expanded and the need for extensions has become more important. Efforts continue to deploy IODEF and RID, as well as to extend them to support specific use cases covering reporting and mitigation of current threats such as anti-phishing extensions. An incident could be a benign configuration issue, IT incident, an infraction to a service level agreement (SLA), a system compromise, socially engineered phishing attack, or a denial-of-service (DoS) attack, etc. When an incident is detected, the response may include simply filing a report, notification to the source of the incident, a request to a third party for resolution/mitigation, or a request to locate the source. IODEF defines a data representation that provides a standard format for sharing information commonly exchanged about computer security incidents. RID enables the secure exchange of incident related information in an IODEF format providing options for security, privacy, and policy setting. MILE leverages collaboration and sharing experiences with the work developed in the INCH working group which includes the data model detailed in the IODEF, existing extensions to the IODEF for Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure exchange of information. MILE will also leverage the experience gained in using IODEF and RID in operational contexts. Related work, drafted outside of INCH will also be reviewed and includes RFC5941, Sharing Transaction Fraud Data. The MILE working group provides coordination for these various extension efforts to improve the capabilities for exchanging incident information. MILE has several objectives with the first being a description a subset of IODEF focused on ease of deployment and applicability to current information security data sharing use cases. MILE also describes a generalization of RID for secure exchange of other security-relevant XML formats. MILE produces additional guidance needed for the successful exchange of incident information for new use cases according to policy, security, and privacy requirements. Finally, MILE produces a document template with guidance for defining IODEF extensions to be followed when producing extensions to IODEF as appropriate, for: * labeling incident reports with data protection, data retention, and other policies, regulations, and laws restricting the handling of those reports * referencing structured security information from within incident reports * reporting forensic data generated during an incident investigation (computer or accounting) The WG will produce the following: * An informational document on IODEF Guidance. * A Standards Track document specifying the Real-time Inter-network Defense (RID). * A Standards Track document specifying the transport for RID. * An informational template for extensions to IODEF. * A Standards Track document for IODEF Extensions in IANA XML Registry. * A Standards Track document for IODEF Extension to support structured cybersecurity information. * A Standards Track document for Labeling for data protection, retention, policies, and regulations. * A Standards Track document for GRC Report Exchange. * A Standards Track document for IODEF Extension to support forensics. The drafts under consideration as WG items include: * Real-time Inter-network Defense (RID) bis: draft-moriarty-mile-rfc6045-bis-01 * Transport of Real-time Inter-network Defense (RID) Messages bis: draft-trammell-mile-rfc6046-bis-00 * Template for extensions to IODEF: draft-trammell-mile-template-01.txt * IODEF Extensions in IANA XML Registry: draft-trammell-mile-iodef-xmlreg-00.txt * GRC Report Exchange (Generalized RID for XML reports/documents): draft-moriarty-mile-grc-exchange-00.txt * IODEF-extension to support structured cybersecurity information: draft-takahashi-mile-sci-00.txt Milestones WGLC = Working Group Last Call 2011-11 - WGLC Real-time Inter-network Defense (RID) 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - WGLC Template for extensions to IODEF 2011-12 - WGLC IODEF Extensions in IANA XML Registry 2011-12 - WGLC IODEF Extension to support structured cybersecurity information 2012-02 - Submit Template for extensions to IODEF to IESG for consideration as Informational document 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for consideration as Standards Track document 2012-02 - Submit IODEF Extension to support structured cybersecurity information to IESG for consideration as Standards Track document 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, policies, and regulations 2012-03 - WGLC IODEF Guidance 2012-04 - Submit IODEF Extension Labeling for data protection, retention, policies, and regulations to IESG for consideration as Standards Track document 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as Informational document 2012-05 - WGLC GRC Report Exchange 2012-06 - Submit GRC Report Exchange to IESG for consideration as Standards Track document 2012-06 - WGLC Forensics extension 2012-07 - Submit IODEF Forensics extension to IESG for consideration as Standards Track document From kathleen.moriarty@emc.com Tue Oct 25 14:28:45 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51EC611E8083 for ; Tue, 25 Oct 2011 14:28:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MWc8XTTHWZ1N for ; Tue, 25 Oct 2011 14:28:44 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 5674B11E807F for ; Tue, 25 Oct 2011 14:28:43 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9PLShpM005418 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 25 Oct 2011 17:28:43 -0400 Received: from mailhub.lss.emc.com (mailhubhoprd03.lss.emc.com [10.254.221.145]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor); Tue, 25 Oct 2011 17:28:39 -0400 Received: from mxhub13.corp.emc.com (mxhub13.corp.emc.com [128.221.56.102]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9PLSaK6012865; Tue, 25 Oct 2011 17:28:37 -0400 Received: from mx06a.corp.emc.com ([169.254.1.225]) by mxhub13.corp.emc.com ([128.221.56.102]) with mapi; Tue, 25 Oct 2011 17:28:36 -0400 From: To: , , Date: Tue, 25 Oct 2011 17:28:34 -0400 Thread-Topic: [mile] Fwd: I-D Action: draft-moriarty-mile-grc-exchange-00.txt Thread-Index: Acx4edAJkaqLq00TTneNuNxKVPP12gAATJNAAAC2L/AGt6OecA== Message-ID: References: <4E79E926.8060908@ieca.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Cc: mile@ietf.org Subject: Re: [mile] Fwd: I-D Action: draft-moriarty-mile-grc-exchange-00.txt X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Oct 2011 21:28:45 -0000 FYI - the 01 version of GRC-exchange has been posted to the IETF. This ver= sion is ready for review and comments to edit and improve the specification= . Please post comments to the MILE mailing list. As Dave suggested a gap = analysis would be helpful to see how this may apply to ASR / ARF / SCAP use= s. http://tools.ietf.org/html/draft-moriarty-mile-grc-exchange-01 Thank you, Kathleen -----Original Message----- From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of kat= hleen.moriarty@emc.com Sent: Wednesday, September 21, 2011 12:48 PM To: david.waltermire@nist.gov; ASSET-DEV@nist.gov Cc: mile@ietf.org Subject: Re: [mile] Fwd: I-D Action: draft-moriarty-mile-grc-exchange-00.tx= t You probably should wait for the next revision to go into any level of deta= il in a review. There are a couple of places where changes need to be made= still. The generalization of RID was requested by some people in the LI-X= ML and GRC-XML communities. The purpose was for a generic transport to exc= hange XML formatted reports using standard schemas. I'll post when we have an update ready. It should not take too long. Thank you, Kathleen =20 -----Original Message----- From: Waltermire, David A. [mailto:david.waltermire@nist.gov]=20 Sent: Wednesday, September 21, 2011 12:35 PM To: ASSET-DEV; Moriarty, Kathleen Subject: RE: [mile] Fwd: I-D Action: draft-moriarty-mile-grc-exchange-00.tx= t I haven't looked at this in detail yet, but this does look interesting. Thi= s spec combines aspects of ARF and what we have been notionally discussing = as tasking. We should probably do some gap analysis to better understand h= ow to move forward. Regards, Dave -----Original Message----- From: asset-dev@nist.gov [mailto:asset-dev@nist.gov] On Behalf Of Kent_Land= field@mcafee.com Sent: Wednesday, September 21, 2011 12:16 PM To: ASSET-DEV Subject: FW: [mile] Fwd: I-D Action: draft-moriarty-mile-grc-exchange-00.tx= t I received this today. Wonder how it plays with ASR / ARF / SCAP uses... Kent Landfield Director Content Strategy, Architecture and Standards McAfee, Inc. 5000 Headquarters Dr. Plano, Texas 75024 Direct: +1.972.963.7096 Mobile: +1.817.637.8026 Web: www.mcafee.com From: Sean Turner > Date: Wed, 21 Sep 2011 08:39:50 -0500 To: "mile@ietf.org" > Subject: [mile] Fwd: I-D Action: draft-moriarty-mile-grc-exchange-00.txt FYI... -------- Original Message -------- Subject: I-D Action: draft-moriarty-mile-grc-exchange-00.txt Date: Thu, 15 Sep 2011 06:22:54 -0700 From: internet-drafts@ietf.org Reply-To: internet-drafts@ietf.org To: i-d-announce@ietf.org A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : GRC Report Exchange Author(s) : Kathleen M. Moriarty Said Tabet Filename : draft-moriarty-mile-grc-exchange-00.txt Pages : 42 Date : 2011-09-15 Governance, risk, and compliance (GRC) programs provide oversight (governance) of risks and compliance initiatives within an organization. GRC reports are increasingly provided in an XML format. This specification defines a common method to securely transport GRC and other XML reports. The defined messaging capability provide policy options and markings in an XML schema, options for confidentiality at the document/report level, and security for the end-to-end communication. XML reports may be shared between service providers and clients, enterprises, or within enterprises. Reports may also be exchanged for official purposes such as business report filings, compliance report filings, and the handling of legal incidents (eWarrant, eDiscovery, etc.) This work is a generalized format derived from the secure exchange of incident information defined by RFC6045-bis, Real-time Inter-network Defense (RID). A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-moriarty-mile-grc-exchange-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ This Internet-Draft can be retrieved at: ftp://ftp.ietf.org/internet-drafts/draft-moriarty-mile-grc-exchange-00.txt _______________________________________________ I-D-Announce mailing list I-D-Announce@ietf.org https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile From kathleen.moriarty@emc.com Tue Oct 25 15:26:08 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C16E41F0C40 for ; Tue, 25 Oct 2011 15:26:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.399 X-Spam-Level: X-Spam-Status: No, score=-6.399 tagged_above=-999 required=5 tests=[AWL=0.200, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jLOLdAXaxFQ6 for ; Tue, 25 Oct 2011 15:26:06 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 6475021F86B3 for ; Tue, 25 Oct 2011 15:26:05 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9PMQ5av026998 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 25 Oct 2011 18:26:05 -0400 Received: from mailhub.lss.emc.com (mailhub.lss.emc.com [10.254.221.251]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor) for ; Tue, 25 Oct 2011 18:25:59 -0400 Received: from mxhub34.corp.emc.com (mxhub34.corp.emc.com [10.254.93.82]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9PMPvVe017891 for ; Tue, 25 Oct 2011 18:25:58 -0400 Received: from mx06a.corp.emc.com ([169.254.1.225]) by mxhub34.corp.emc.com ([::1]) with mapi; Tue, 25 Oct 2011 18:25:57 -0400 From: To: Date: Tue, 25 Oct 2011 18:25:55 -0400 Thread-Topic: MILE WG draft adoption for RFC6045-bis Thread-Index: AcyTNeQy1EYhFA+ORpak2LvXdvj3awALb9RQ Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: [mile] MILE WG draft adoption for RFC6045-bis X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Oct 2011 22:26:08 -0000 SGVsbG8sDQoNClRoYW5rIHlvdSBhbGwgZm9yIHlvdXIgaGFyZCB3b3JrIGluIGhlbHBpbmcgdG8g bW92ZSB1cyB0byBhIFdHIHN0YXR1cyEgIFRoZSBuZXh0IHN0ZXAgaXMgdG8gYXNrIGZvciBhZG9w dGlvbiBvZiBkcmFmdHMuICANCg0KVGhlIGZpcnN0IGRvY3VtZW50IGluIHdoaWNoIEkgd291bGQg bGlrZSB0byByZXF1ZXN0IHdvcmtpbmcgZ3JvdXAgYWRvcHRpb24gaXMgUkZDNjA0NS1iaXMgd2l0 aCBteSBoYXQgb24gYXMgZWRpdG9yIG9mIHRoZSBkb2N1bWVudC4gIFBsZWFzZSByZXNwb25kIHRv IHRoZSBtYWlsaW5nIGxpc3Qgd2l0aGluIGEgd2VlayAoTm92IDJuZCkgc3RhdGluZyBpZiB5b3Ug c3VwcG9ydCBSRkM2MDQ1LWJpcyBhZG9wdGlvbiBieSB0aGUgd29ya2luZyBncm91cC4gIEFsc28s IHBsZWFzZSBpbmNsdWRlIGlmIHlvdSBhcmUgd2lsbGluZyB0byByZXZpZXcgdGhlIGRyYWZ0IGlu IHlvdXIgcmVzcG9uc2Ugb24gYWRvcHRpb24uIA0KDQpodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9kcmFmdC1tb3JpYXJ0eS1taWxlLXJmYzYwNDUtYmlzLTAxDQoNCkEgY29uc2Vuc3VzIGNhbGwg d2lsbCBmb2xsb3cgZnJvbSBCcmlhbiBUcmFtbWVsbCBhcyBXb3JraW5nIEdyb3VwIGNoYWlyLg0K DQpUaGFuayB5b3UhDQpLYXRobGVlbg0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJv bTogSUVTRyBTZWNyZXRhcnkgW21haWx0bzppZXNnLXNlY3JldGFyeUBpZXRmLm9yZ10gDQpTZW50 OiBUdWVzZGF5LCBPY3RvYmVyIDI1LCAyMDExIDEyOjQ2IFBNDQpUbzogSUVURiBBbm5vdW5jZW1l bnQgbGlzdA0KQ2M6IE1vcmlhcnR5LCBLYXRobGVlbjsgdHJhbW1lbGxAdGlrLmVlLmV0aHouY2g7 IG1pbGVAaWV0Zi5vcmcNClN1YmplY3Q6IFdHIEFjdGlvbjogTWFuYWdlZCBJbmNpZGVudCBMaWdo dHdlaWdodCBFeGNoYW5nZSAobWlsZSkgDQoNCkEgbmV3IElFVEYgd29ya2luZyBncm91cCBoYXMg YmVlbiBmb3JtZWQgaW4gdGhlIFNlY3VyaXR5IEFyZWEuICBGb3IgDQphZGRpdGlvbmFsIGluZm9y bWF0aW9uLCBwbGVhc2UgY29udGFjdCB0aGUgQXJlYSBEaXJlY3RvcnMgb3IgdGhlIFdHIA0KQ2hh aXJzLg0KDQpNYW5hZ2VkIEluY2lkZW50IExpZ2h0d2VpZ2h0IEV4Y2hhbmdlIChtaWxlKQ0KLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NClN0YXR1czogUHJvcG9z ZWQgV29ya2luZyBHcm91cCBDaGFydGVyDQpMYXN0IFVwZGF0ZWQ6IDIwMTEtMDktMjENCg0KQ2hh aXJzOg0KICAgICBLYXRobGVlbiBNb3JpYXJ0eSA8S2F0aGxlZW4uTW9yaWFydHlAZW1jLmNvbT4N CiAgICAgQnJpYW4gVHJhbW1lbGwgPHRyYW1tZWxsQHRpay5lZS5ldGh6LmNoPg0KDQpTZWN1cml0 eSBBcmVhIERpcmVjdG9yczoNCiAgICAgU3RlcGhlbiBGYXJyZWxsIDxzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllPg0KICAgICBTZWFuIFR1cm5lciA8dHVybmVyc0BpZWNhLmNvbT4NCg0KU2VjdXJp dHkgQXJlYSBBZHZpc29yOg0KICAgICBTZWFuIFR1cm5lciA8dHVybmVyc0BpZWNhLmNvbT4NCg0K TWFpbGluZyBMaXN0czoNCiAgICAgR2VuZXJhbCBEaXNjdXNzaW9uOiBtaWxlQGlldGYub3JnDQog ICAgIFRvIFN1YnNjcmliZTogICAgICAgaHR0cDovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL21pbGUNCiAgICAgQXJjaGl2ZTogICAgICAgICAgICBodHRwOi8vd3d3LmlldGYub3JnL21h aWwtYXJjaGl2ZS93ZWIvbWlsZQ0KDQpEZXNjcmlwdGlvbjoNCg0KVGhlIE1hbmFnZWQgSW5jaWRl bnQgTGlnaHR3ZWlnaHQgRXhjaGFuZ2UgKE1JTEUpIHdvcmtpbmcgZ3JvdXAgd2lsbA0KZGV2ZWxv cCBzdGFuZGFyZHMgYW5kIGV4dGVuc2lvbnMgZm9yIHRoZSBwdXJwb3NlIG9mIGltcHJvdmluZyBp bmNpZGVudA0KaW5mb3JtYXRpb24gc2hhcmluZyBhbmQgaGFuZGxpbmcgY2FwYWJpbGl0aWVzIGJh c2VkIG9uIHRoZSB3b3JrDQpkZXZlbG9wZWQgaW4gdGhlIElFVEYgRXh0ZW5kZWQgSU5DaWRlbnQg SGFuZGxpbmcgKElOQ0gpIHdvcmtpbmcgZ3JvdXAuDQpUaGUgSW5jaWRlbnQgT2JqZWN0IERlc2Ny aXB0aW9uIEV4Y2hhbmdlIEZvcm1hdCAoSU9ERUYpIGluIFJGQzUwNzAgYW5kDQpSZWFsLXRpbWUg SW50ZXItbmV0d29yayBEZWZlbnNlIChSSUQpIGluIFJGQzYwNDUgd2VyZSBkZXZlbG9wZWQgaW4g dGhlDQpJTkNIIHdvcmtpbmcgZ3JvdXAgYnkgaW50ZXJuYXRpb25hbCBDb21wdXRlciBTZWN1cml0 eSBJbmNpZGVudCBSZXNwb25zZQ0KVGVhbXMgKENTSVJUcykgYW5kIGluZHVzdHJ5IHRvIG1lZXQg dGhlIG5lZWRzIG9mIGEgZ2xvYmFsIGNvbW11bml0eQ0KaW50ZXJlc3RlZCBpbiBzaGFyaW5nLCBo YW5kbGluZywgYW5kIGV4Y2hhbmdpbmcgaW5jaWRlbnQgaW5mb3JtYXRpb24uDQpUaGUgZXh0ZW5z aW9ucyBhbmQgZ3VpZGFuY2UgY3JlYXRlZCBieSB0aGUgTUlMRSB3b3JraW5nIGdyb3VwIGFzc2lz dHMNCndpdGggdGhlIGRhaWx5IG9wZXJhdGlvbnMgb2YgQ1NJUlRzIGF0IGFuIG9yZ2FuaXphdGlv biwgc2VydmljZQ0KcHJvdmlkZXIsIGxhdyBlbmZvcmNlbWVudCwgYW5kIGF0IHRoZSBjb3VudHJ5 IGxldmVsLiAgVGhlIGFwcGxpY2F0aW9uIG9mDQpJT0RFRiBhbmQgUklEIHRvIGludGVyZG9tYWlu IGluY2lkZW50IGluZm9ybWF0aW9uIGNvb3BlcmF0aXZlIGV4Y2hhbmdlDQphbmQgc2hhcmluZyBo YXMgcmVjZW50bHkgZXhwYW5kZWQgYW5kIHRoZSBuZWVkIGZvciBleHRlbnNpb25zIGhhcyBiZWNv bWUNCm1vcmUgaW1wb3J0YW50LiBFZmZvcnRzIGNvbnRpbnVlIHRvIGRlcGxveSBJT0RFRiBhbmQg UklELCBhcyB3ZWxsIGFzIHRvDQpleHRlbmQgdGhlbSB0byBzdXBwb3J0IHNwZWNpZmljIHVzZSBj YXNlcyBjb3ZlcmluZyByZXBvcnRpbmcgYW5kDQptaXRpZ2F0aW9uIG9mIGN1cnJlbnQgdGhyZWF0 cyBzdWNoIGFzIGFudGktcGhpc2hpbmcgZXh0ZW5zaW9ucy4NCg0KQW4gaW5jaWRlbnQgY291bGQg YmUgYSBiZW5pZ24gY29uZmlndXJhdGlvbiBpc3N1ZSwgSVQgaW5jaWRlbnQsIGFuDQppbmZyYWN0 aW9uIHRvIGEgc2VydmljZSBsZXZlbCBhZ3JlZW1lbnQgKFNMQSksIGEgc3lzdGVtIGNvbXByb21p c2UsDQpzb2NpYWxseSBlbmdpbmVlcmVkIHBoaXNoaW5nIGF0dGFjaywgb3IgYSBkZW5pYWwtb2Yt c2VydmljZSAoRG9TKQ0KYXR0YWNrLCBldGMuICBXaGVuIGFuIGluY2lkZW50IGlzIGRldGVjdGVk LCB0aGUgcmVzcG9uc2UgbWF5IGluY2x1ZGUNCnNpbXBseSBmaWxpbmcgYSByZXBvcnQsIG5vdGlm aWNhdGlvbiB0byB0aGUgc291cmNlIG9mIHRoZSBpbmNpZGVudCwgYQ0KcmVxdWVzdCB0byBhIHRo aXJkIHBhcnR5IGZvciByZXNvbHV0aW9uL21pdGlnYXRpb24sIG9yIGEgcmVxdWVzdCB0bw0KbG9j YXRlIHRoZSBzb3VyY2UuICBJT0RFRiBkZWZpbmVzIGEgZGF0YSByZXByZXNlbnRhdGlvbiB0aGF0 IHByb3ZpZGVzIGENCnN0YW5kYXJkIGZvcm1hdCBmb3Igc2hhcmluZyBpbmZvcm1hdGlvbiBjb21t b25seSBleGNoYW5nZWQgYWJvdXQNCmNvbXB1dGVyIHNlY3VyaXR5IGluY2lkZW50cy4gIFJJRCBl bmFibGVzIHRoZSBzZWN1cmUgZXhjaGFuZ2Ugb2YNCmluY2lkZW50IHJlbGF0ZWQgaW5mb3JtYXRp b24gaW4gYW4gSU9ERUYgZm9ybWF0IHByb3ZpZGluZyBvcHRpb25zIGZvcg0Kc2VjdXJpdHksIHBy aXZhY3ksIGFuZCBwb2xpY3kgc2V0dGluZy4NCg0KTUlMRSBsZXZlcmFnZXMgY29sbGFib3JhdGlv biBhbmQgc2hhcmluZyBleHBlcmllbmNlcyB3aXRoIHRoZSB3b3JrDQpkZXZlbG9wZWQgaW4gdGhl IElOQ0ggd29ya2luZyBncm91cCB3aGljaCBpbmNsdWRlcyB0aGUgZGF0YSBtb2RlbA0KZGV0YWls ZWQgaW4gdGhlIElPREVGLCBleGlzdGluZyBleHRlbnNpb25zIHRvIHRoZSBJT0RFRiBmb3INCkFu dGktcGhpc2hpbmcgKFJGQzU5MDEpLCBhbmQgUklEIChSRkM2MDQ1LCBSRkM2MDQ2KSBmb3IgdGhl IHNlY3VyZQ0KZXhjaGFuZ2Ugb2YgaW5mb3JtYXRpb24uICBNSUxFIHdpbGwgYWxzbyBsZXZlcmFn ZSB0aGUgZXhwZXJpZW5jZSBnYWluZWQNCmluIHVzaW5nIElPREVGIGFuZCBSSUQgaW4gb3BlcmF0 aW9uYWwgY29udGV4dHMuIFJlbGF0ZWQgd29yaywgZHJhZnRlZA0Kb3V0c2lkZSBvZiBJTkNIIHdp bGwgYWxzbyBiZSByZXZpZXdlZCBhbmQgaW5jbHVkZXMgUkZDNTk0MSwgU2hhcmluZw0KVHJhbnNh Y3Rpb24gRnJhdWQgRGF0YS4NCg0KVGhlIE1JTEUgd29ya2luZyBncm91cCBwcm92aWRlcyBjb29y ZGluYXRpb24gZm9yIHRoZXNlIHZhcmlvdXMgZXh0ZW5zaW9uDQplZmZvcnRzIHRvIGltcHJvdmUg dGhlIGNhcGFiaWxpdGllcyBmb3IgZXhjaGFuZ2luZyBpbmNpZGVudCBpbmZvcm1hdGlvbi4NCiAg TUlMRSBoYXMgc2V2ZXJhbCBvYmplY3RpdmVzIHdpdGggdGhlIGZpcnN0IGJlaW5nIGEgZGVzY3Jp cHRpb24gYQ0Kc3Vic2V0IG9mIElPREVGIGZvY3VzZWQgb24gZWFzZSBvZiBkZXBsb3ltZW50IGFu ZCBhcHBsaWNhYmlsaXR5IHRvDQpjdXJyZW50IGluZm9ybWF0aW9uIHNlY3VyaXR5IGRhdGEgc2hh cmluZyB1c2UgY2FzZXMuICBNSUxFIGFsc28NCmRlc2NyaWJlcyBhIGdlbmVyYWxpemF0aW9uIG9m IFJJRCBmb3Igc2VjdXJlIGV4Y2hhbmdlIG9mIG90aGVyDQpzZWN1cml0eS1yZWxldmFudCBYTUwg Zm9ybWF0cy4gIE1JTEUgcHJvZHVjZXMgYWRkaXRpb25hbCBndWlkYW5jZSBuZWVkZWQNCmZvciB0 aGUgc3VjY2Vzc2Z1bCBleGNoYW5nZSBvZiBpbmNpZGVudCBpbmZvcm1hdGlvbiBmb3IgbmV3IHVz ZSBjYXNlcw0KYWNjb3JkaW5nIHRvIHBvbGljeSwgc2VjdXJpdHksIGFuZCBwcml2YWN5IHJlcXVp cmVtZW50cy4gIEZpbmFsbHksIE1JTEUNCnByb2R1Y2VzIGEgZG9jdW1lbnQgdGVtcGxhdGUgd2l0 aCBndWlkYW5jZSBmb3IgZGVmaW5pbmcgSU9ERUYgZXh0ZW5zaW9ucw0KdG8gYmUgZm9sbG93ZWQg d2hlbiBwcm9kdWNpbmcgZXh0ZW5zaW9ucyB0byBJT0RFRiBhcyBhcHByb3ByaWF0ZSwgZm9yOg0K DQogICogbGFiZWxpbmcgaW5jaWRlbnQgcmVwb3J0cyB3aXRoIGRhdGEgcHJvdGVjdGlvbiwgZGF0 YSByZXRlbnRpb24sIGFuZA0KICAgIG90aGVyIHBvbGljaWVzLCByZWd1bGF0aW9ucywgYW5kDQog ICAgbGF3cyByZXN0cmljdGluZyB0aGUgaGFuZGxpbmcgb2YgdGhvc2UgcmVwb3J0cw0KICAqIHJl ZmVyZW5jaW5nIHN0cnVjdHVyZWQgc2VjdXJpdHkgaW5mb3JtYXRpb24gZnJvbSB3aXRoaW4gaW5j aWRlbnQNCiAgICByZXBvcnRzDQogICogcmVwb3J0aW5nIGZvcmVuc2ljIGRhdGEgZ2VuZXJhdGVk IGR1cmluZyBhbiBpbmNpZGVudCBpbnZlc3RpZ2F0aW9uDQogICAgKGNvbXB1dGVyIG9yIGFjY291 bnRpbmcpDQoNClRoZSBXRyB3aWxsIHByb2R1Y2UgdGhlIGZvbGxvd2luZzoNCg0KICAqIEFuIGlu Zm9ybWF0aW9uYWwgZG9jdW1lbnQgb24gSU9ERUYgR3VpZGFuY2UuDQogICogQSBTdGFuZGFyZHMg VHJhY2sgZG9jdW1lbnQgc3BlY2lmeWluZyB0aGUgUmVhbC10aW1lIEludGVyLW5ldHdvcmsNCiAg ICBEZWZlbnNlIChSSUQpLg0KICAqIEEgU3RhbmRhcmRzIFRyYWNrIGRvY3VtZW50IHNwZWNpZnlp bmcgdGhlIHRyYW5zcG9ydCBmb3IgUklELg0KICAqIEFuIGluZm9ybWF0aW9uYWwgdGVtcGxhdGUg Zm9yIGV4dGVuc2lvbnMgdG8gSU9ERUYuDQogICogQSBTdGFuZGFyZHMgVHJhY2sgZG9jdW1lbnQg Zm9yIElPREVGIEV4dGVuc2lvbnMgaW4gSUFOQSBYTUwgUmVnaXN0cnkuDQogICogQSBTdGFuZGFy ZHMgVHJhY2sgZG9jdW1lbnQgZm9yIElPREVGIEV4dGVuc2lvbiB0byBzdXBwb3J0DQogICAgc3Ry dWN0dXJlZCBjeWJlcnNlY3VyaXR5IGluZm9ybWF0aW9uLg0KICAqIEEgU3RhbmRhcmRzIFRyYWNr IGRvY3VtZW50IGZvciBMYWJlbGluZyBmb3IgZGF0YSBwcm90ZWN0aW9uLA0KICAgIHJldGVudGlv biwgcG9saWNpZXMsIGFuZCByZWd1bGF0aW9ucy4NCiAgKiBBIFN0YW5kYXJkcyBUcmFjayBkb2N1 bWVudCBmb3IgR1JDIFJlcG9ydCBFeGNoYW5nZS4NCiAgKiBBIFN0YW5kYXJkcyBUcmFjayBkb2N1 bWVudCBmb3IgSU9ERUYgRXh0ZW5zaW9uIHRvIHN1cHBvcnQgZm9yZW5zaWNzLg0KDQpUaGUgZHJh ZnRzIHVuZGVyIGNvbnNpZGVyYXRpb24gYXMgV0cgaXRlbXMgaW5jbHVkZToNCiAgICogUmVhbC10 aW1lIEludGVyLW5ldHdvcmsgRGVmZW5zZSAoUklEKSBiaXM6DQogICAgICBkcmFmdC1tb3JpYXJ0 eS1taWxlLXJmYzYwNDUtYmlzLTAxDQogICAqIFRyYW5zcG9ydCBvZiBSZWFsLXRpbWUgSW50ZXIt bmV0d29yayBEZWZlbnNlIChSSUQpIE1lc3NhZ2VzIGJpczoNCiAgICAgIGRyYWZ0LXRyYW1tZWxs LW1pbGUtcmZjNjA0Ni1iaXMtMDANCiAgICogVGVtcGxhdGUgZm9yIGV4dGVuc2lvbnMgdG8gSU9E RUY6DQogICAgICBkcmFmdC10cmFtbWVsbC1taWxlLXRlbXBsYXRlLTAxLnR4dA0KICAgKiBJT0RF RiBFeHRlbnNpb25zIGluIElBTkEgWE1MIFJlZ2lzdHJ5Og0KICAgICAgZHJhZnQtdHJhbW1lbGwt bWlsZS1pb2RlZi14bWxyZWctMDAudHh0DQogICAqIEdSQyBSZXBvcnQgRXhjaGFuZ2UgKEdlbmVy YWxpemVkIFJJRCBmb3IgWE1MIHJlcG9ydHMvZG9jdW1lbnRzKToNCiAgICAgIGRyYWZ0LW1vcmlh cnR5LW1pbGUtZ3JjLWV4Y2hhbmdlLTAwLnR4dA0KICAgKiBJT0RFRi1leHRlbnNpb24gdG8gc3Vw cG9ydCBzdHJ1Y3R1cmVkIGN5YmVyc2VjdXJpdHkgaW5mb3JtYXRpb246DQogICAgICBkcmFmdC10 YWthaGFzaGktbWlsZS1zY2ktMDAudHh0DQoNCk1pbGVzdG9uZXMNCg0KV0dMQyA9IFdvcmtpbmcg R3JvdXAgTGFzdCBDYWxsDQoNCjIwMTEtMTEgLSBXR0xDIFJlYWwtdGltZSBJbnRlci1uZXR3b3Jr IERlZmVuc2UgKFJJRCkNCjIwMTEtMTEgLSBXR0xDIFRyYW5zcG9ydCBmb3IgUmVhbC10aW1lIElu dGVyLW5ldHdvcmsgRGVmZW5zZSAoUklEKQ0KMjAxMS0xMiAtIFN1Ym1pdCBSZWFsLXRpbWUgSW50 ZXItbmV0d29yayBEZWZlbnNlIChSSUQpIHRvIElFU0cgZm9yDQogICAgICAgICAgIGNvbnNpZGVy YXRpb24gYXMgU3RhbmRhcmRzIFRyYWNrIGRvY3VtZW50DQoyMDExLTEyIC0gU3VibWl0IFRyYW5z cG9ydCBSZWFsLXRpbWUgSW50ZXItbmV0d29yayBEZWZlbnNlIChSSUQpIHRvDQogICAgICAgICAg IElFU0cgZm9yIGNvbnNpZGVyYXRpb24gYXMgU3RhbmRhcmRzIFRyYWNrIGRvY3VtZW50DQoyMDEx LTEyIC0gV0dMQyBUZW1wbGF0ZSBmb3IgZXh0ZW5zaW9ucyB0byBJT0RFRg0KMjAxMS0xMiAtIFdH TEMgSU9ERUYgRXh0ZW5zaW9ucyBpbiBJQU5BIFhNTCBSZWdpc3RyeQ0KMjAxMS0xMiAtIFdHTEMg SU9ERUYgRXh0ZW5zaW9uIHRvIHN1cHBvcnQgc3RydWN0dXJlZCBjeWJlcnNlY3VyaXR5DQogICAg ICAgICAgIGluZm9ybWF0aW9uDQoyMDEyLTAyIC0gU3VibWl0IFRlbXBsYXRlIGZvciBleHRlbnNp b25zIHRvIElPREVGIHRvIElFU0cgZm9yDQogICAgICAgICAgIGNvbnNpZGVyYXRpb24gYXMgSW5m b3JtYXRpb25hbCBkb2N1bWVudA0KMjAxMi0wMiAtIFN1Ym1pdCBJT0RFRiBFeHRlbnNpb25zIGlu IElBTkEgWE1MIFJlZ2lzdHJ5IHRvIElFU0cgZm9yDQogICAgICAgICAgIGNvbnNpZGVyYXRpb24g YXMgU3RhbmRhcmRzIFRyYWNrIGRvY3VtZW50DQoyMDEyLTAyIC0gU3VibWl0IElPREVGIEV4dGVu c2lvbiB0byBzdXBwb3J0IHN0cnVjdHVyZWQgY3liZXJzZWN1cml0eQ0KICAgICAgICAgICBpbmZv cm1hdGlvbiB0byBJRVNHIGZvciBjb25zaWRlcmF0aW9uIGFzIFN0YW5kYXJkcyBUcmFjaw0KICAg ICAgICAgICBkb2N1bWVudA0KMjAxMi0wMyAtIFdHTEMgSU9ERUYgRXh0ZW5zaW9uIExhYmVsaW5n IGZvciBkYXRhIHByb3RlY3Rpb24sIHJldGVudGlvbiwNCiAgICAgICAgICAgcG9saWNpZXMsIGFu ZCByZWd1bGF0aW9ucw0KMjAxMi0wMyAtIFdHTEMgSU9ERUYgR3VpZGFuY2UNCjIwMTItMDQgLSBT dWJtaXQgSU9ERUYgRXh0ZW5zaW9uIExhYmVsaW5nIGZvciBkYXRhIHByb3RlY3Rpb24sDQogICAg ICAgICAgIHJldGVudGlvbiwgcG9saWNpZXMsIGFuZCByZWd1bGF0aW9ucyB0byBJRVNHIGZvcg0K ICAgICAgICAgICBjb25zaWRlcmF0aW9uIGFzIFN0YW5kYXJkcyBUcmFjayBkb2N1bWVudA0KMjAx Mi0wNCAtIFN1Ym1pdCBXR0xDIElPREVGIEd1aWRhbmNlIHRvIElFU0cgZm9yIGNvbnNpZGVyYXRp b24gYXMNCiAgICAgICAgICAgSW5mb3JtYXRpb25hbCBkb2N1bWVudA0KMjAxMi0wNSAtIFdHTEMg R1JDIFJlcG9ydCBFeGNoYW5nZQ0KMjAxMi0wNiAtIFN1Ym1pdCBHUkMgUmVwb3J0IEV4Y2hhbmdl IHRvIElFU0cgZm9yIGNvbnNpZGVyYXRpb24gYXMNCiAgICAgICAgICAgU3RhbmRhcmRzIFRyYWNr IGRvY3VtZW50DQoyMDEyLTA2IC0gV0dMQyBGb3JlbnNpY3MgZXh0ZW5zaW9uDQoyMDEyLTA3IC0g U3VibWl0IElPREVGIEZvcmVuc2ljcyBleHRlbnNpb24gdG8gSUVTRyBmb3IgY29uc2lkZXJhdGlv biBhcw0KICAgICAgICAgICBTdGFuZGFyZHMgVHJhY2sgZG9jdW1lbnQNCg0KDQo= From trammell@tik.ee.ethz.ch Wed Oct 26 00:23:32 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A73AD21F84D2 for ; Wed, 26 Oct 2011 00:23:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I-bTSzYTLu+o for ; Wed, 26 Oct 2011 00:23:32 -0700 (PDT) Received: from smtp.ee.ethz.ch (smtp.ee.ethz.ch [129.132.2.219]) by ietfa.amsl.com (Postfix) with ESMTP id 0600421F84CC for ; Wed, 26 Oct 2011 00:23:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by smtp.ee.ethz.ch (Postfix) with ESMTP id B9012D930B for ; Wed, 26 Oct 2011 09:23:19 +0200 (MEST) X-Virus-Scanned: by amavisd-new on smtp.ee.ethz.ch Received: from smtp.ee.ethz.ch ([127.0.0.1]) by localhost (.ee.ethz.ch [127.0.0.1]) (amavisd-new, port 10024) with LMTP id UwvqLf6GK3dp for ; Wed, 26 Oct 2011 09:23:19 +0200 (MEST) Received: from [10.0.1.2] (cust-integra-121-161.antanet.ch [80.75.121.161]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: briant) by smtp.ee.ethz.ch (Postfix) with ESMTPSA id 4DA62D9304 for ; Wed, 26 Oct 2011 09:23:19 +0200 (MEST) From: Brian Trammell Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Wed, 26 Oct 2011 09:23:18 +0200 Message-Id: To: mile@ietf.org Mime-Version: 1.0 (Apple Message framework v1084) X-Mailer: Apple Mail (2.1084) Subject: [mile] Documents for consideration as MILE WG items X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Oct 2011 07:23:32 -0000 Greetings, all, and welcome to the MILE working group! As a contributor, I'd like to put forward three documents for = consideration as working group items under the initial charter; these = are all relatively lightweight, and I believe should be easy to come to = agreement on. 1. For * An informational template for extensions to IODEF: "Guidelines for Extensions to IODEF for Managed Incident Lightweight = Exchange" http://tools.ietf.org/html/draft-trammell-mile-template=20 This is an informational document primarily intended to speed the work = of the MILE WG itself. It contains an Internet-Draft template for IODEF = extensions. 2. For * A Standards Track document for IODEF Extensions in IANA XML = Registry: "Expert Review for IODEF Extensions in IANA XML Registry" http://tools.ietf.org/html/draft-trammell-mile-iodef-xmlreg This is a housekeeping and process document, which specifies a change to = IODEF-related XML schema registrations in order to ensure an expert = review of those schemas. It's really short; indeed, I'll quote the = important part of the document here: Changes to the XML Schema registry for schema names beginning with "urn:ietf:params:xml:schema:iodef" are subject to an additional IODEF Expert Review [RFC5226]. The IODEF expert(s) for these reviews will be designated by the IETF Security Area Directors. 3. For * A Standards Track document specifying the transport for RID: "Transport of Real-time Inter-network Defense (RID) Messages" http://tools.ietf.org/html/draft-trammell-mile-rfc6046-bis This document is a straight update of RFC6046, making minor editorial = changes and updating its status to Standards Track; there are no = substantive technical changes from the HTTP-based protocol specified in = RFC6046. As a contributor, I'd appreciate comments to the list on these documents = by 2 November, stating whether you support the documents for adoption as = WG items, and whether you would be willing to review them. (Okay, if = you've read this message this far, you've essentially already reviewed = mile-iodef-xmlreg, but the other two could use a critical eye.) After 2 November, Kathleen will hold a consensus call on these = documents. Many thanks, and best regards, Brian= From david.black@emc.com Wed Oct 26 07:03:52 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6C6E21F8B33 for ; Wed, 26 Oct 2011 07:03:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.915 X-Spam-Level: X-Spam-Status: No, score=-105.915 tagged_above=-999 required=5 tests=[AWL=0.684, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RxmY6ShMOas4 for ; Wed, 26 Oct 2011 07:03:51 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id 42CFA21F899D for ; Wed, 26 Oct 2011 07:03:51 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9QE3nq7023786 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 26 Oct 2011 10:03:50 -0400 Received: from mailhub.lss.emc.com (mailhub.lss.emc.com [10.254.221.253]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor) for ; Wed, 26 Oct 2011 10:03:35 -0400 Received: from mxhub15.corp.emc.com (mxhub15.corp.emc.com [128.221.56.104]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9QE3Y6I020251 for ; Wed, 26 Oct 2011 10:03:34 -0400 Received: from mx14a.corp.emc.com ([169.254.1.78]) by mxhub15.corp.emc.com ([128.221.56.104]) with mapi; Wed, 26 Oct 2011 10:03:33 -0400 From: To: , Date: Wed, 26 Oct 2011 10:03:31 -0400 Thread-Topic: MILE WG draft adoption for RFC6045-bis Thread-Index: AcyTNeQy1EYhFA+ORpak2LvXdvj3awALb9RQACD0+NA= Message-ID: <7C4DFCE962635144B8FAE8CA11D0BF1E058D0EF98C@MX14A.corp.emc.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Oct 2011 14:03:52 -0000 Congratulations on the formation of the WG! The RFC6045-bis draft should be adopted by the mile WG; the draft contains = some important improvements over RFC 6045. I've already reviewed the draft, and would be willing to take another look = ... as my time availability permits ;-). Thanks, --David ---------------------------------------------------- David L. Black, Distinguished Engineer EMC Corporation, 176 South St., Hopkinton, MA=A0 01748 +1 (508) 293-7953=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 FAX: +1 (508) 293-778= 6 david.black@emc.com=A0=A0=A0=A0=A0=A0=A0 Mobile: +1 (978) 394-7754 ---------------------------------------------------- > -----Original Message----- > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of k= athleen.moriarty@emc.com > Sent: Tuesday, October 25, 2011 6:26 PM > To: mile@ietf.org > Subject: [mile] MILE WG draft adoption for RFC6045-bis >=20 > Hello, >=20 > Thank you all for your hard work in helping to move us to a WG status! T= he next step is to ask for > adoption of drafts. >=20 > The first document in which I would like to request working group adoptio= n is RFC6045-bis with my hat > on as editor of the document. Please respond to the mailing list within = a week (Nov 2nd) stating if > you support RFC6045-bis adoption by the working group. Also, please incl= ude if you are willing to > review the draft in your response on adoption. >=20 > http://tools.ietf.org/html/draft-moriarty-mile-rfc6045-bis-01 >=20 > A consensus call will follow from Brian Trammell as Working Group chair. >=20 > Thank you! > Kathleen >=20 > -----Original Message----- > From: IESG Secretary [mailto:iesg-secretary@ietf.org] > Sent: Tuesday, October 25, 2011 12:46 PM > To: IETF Announcement list > Cc: Moriarty, Kathleen; trammell@tik.ee.ethz.ch; mile@ietf.org > Subject: WG Action: Managed Incident Lightweight Exchange (mile) >=20 > A new IETF working group has been formed in the Security Area. For > additional information, please contact the Area Directors or the WG > Chairs. >=20 > Managed Incident Lightweight Exchange (mile) > -------------------------------------------- > Status: Proposed Working Group Charter > Last Updated: 2011-09-21 >=20 > Chairs: > Kathleen Moriarty > Brian Trammell >=20 > Security Area Directors: > Stephen Farrell > Sean Turner >=20 > Security Area Advisor: > Sean Turner >=20 > Mailing Lists: > General Discussion: mile@ietf.org > To Subscribe: http://www.ietf.org/mailman/listinfo/mile > Archive: http://www.ietf.org/mail-archive/web/mile >=20 > Description: >=20 > The Managed Incident Lightweight Exchange (MILE) working group will > develop standards and extensions for the purpose of improving incident > information sharing and handling capabilities based on the work > developed in the IETF Extended INCident Handling (INCH) working group. > The Incident Object Description Exchange Format (IODEF) in RFC5070 and > Real-time Inter-network Defense (RID) in RFC6045 were developed in the > INCH working group by international Computer Security Incident Response > Teams (CSIRTs) and industry to meet the needs of a global community > interested in sharing, handling, and exchanging incident information. > The extensions and guidance created by the MILE working group assists > with the daily operations of CSIRTs at an organization, service > provider, law enforcement, and at the country level. The application of > IODEF and RID to interdomain incident information cooperative exchange > and sharing has recently expanded and the need for extensions has become > more important. Efforts continue to deploy IODEF and RID, as well as to > extend them to support specific use cases covering reporting and > mitigation of current threats such as anti-phishing extensions. >=20 > An incident could be a benign configuration issue, IT incident, an > infraction to a service level agreement (SLA), a system compromise, > socially engineered phishing attack, or a denial-of-service (DoS) > attack, etc. When an incident is detected, the response may include > simply filing a report, notification to the source of the incident, a > request to a third party for resolution/mitigation, or a request to > locate the source. IODEF defines a data representation that provides a > standard format for sharing information commonly exchanged about > computer security incidents. RID enables the secure exchange of > incident related information in an IODEF format providing options for > security, privacy, and policy setting. >=20 > MILE leverages collaboration and sharing experiences with the work > developed in the INCH working group which includes the data model > detailed in the IODEF, existing extensions to the IODEF for > Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure > exchange of information. MILE will also leverage the experience gained > in using IODEF and RID in operational contexts. Related work, drafted > outside of INCH will also be reviewed and includes RFC5941, Sharing > Transaction Fraud Data. >=20 > The MILE working group provides coordination for these various extension > efforts to improve the capabilities for exchanging incident information. > MILE has several objectives with the first being a description a > subset of IODEF focused on ease of deployment and applicability to > current information security data sharing use cases. MILE also > describes a generalization of RID for secure exchange of other > security-relevant XML formats. MILE produces additional guidance needed > for the successful exchange of incident information for new use cases > according to policy, security, and privacy requirements. Finally, MILE > produces a document template with guidance for defining IODEF extensions > to be followed when producing extensions to IODEF as appropriate, for: >=20 > * labeling incident reports with data protection, data retention, and > other policies, regulations, and > laws restricting the handling of those reports > * referencing structured security information from within incident > reports > * reporting forensic data generated during an incident investigation > (computer or accounting) >=20 > The WG will produce the following: >=20 > * An informational document on IODEF Guidance. > * A Standards Track document specifying the Real-time Inter-network > Defense (RID). > * A Standards Track document specifying the transport for RID. > * An informational template for extensions to IODEF. > * A Standards Track document for IODEF Extensions in IANA XML Registry. > * A Standards Track document for IODEF Extension to support > structured cybersecurity information. > * A Standards Track document for Labeling for data protection, > retention, policies, and regulations. > * A Standards Track document for GRC Report Exchange. > * A Standards Track document for IODEF Extension to support forensics. >=20 > The drafts under consideration as WG items include: > * Real-time Inter-network Defense (RID) bis: > draft-moriarty-mile-rfc6045-bis-01 > * Transport of Real-time Inter-network Defense (RID) Messages bis: > draft-trammell-mile-rfc6046-bis-00 > * Template for extensions to IODEF: > draft-trammell-mile-template-01.txt > * IODEF Extensions in IANA XML Registry: > draft-trammell-mile-iodef-xmlreg-00.txt > * GRC Report Exchange (Generalized RID for XML reports/documents): > draft-moriarty-mile-grc-exchange-00.txt > * IODEF-extension to support structured cybersecurity information: > draft-takahashi-mile-sci-00.txt >=20 > Milestones >=20 > WGLC =3D Working Group Last Call >=20 > 2011-11 - WGLC Real-time Inter-network Defense (RID) > 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) > 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for > consideration as Standards Track document > 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to > IESG for consideration as Standards Track document > 2011-12 - WGLC Template for extensions to IODEF > 2011-12 - WGLC IODEF Extensions in IANA XML Registry > 2011-12 - WGLC IODEF Extension to support structured cybersecurity > information > 2012-02 - Submit Template for extensions to IODEF to IESG for > consideration as Informational document > 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for > consideration as Standards Track document > 2012-02 - Submit IODEF Extension to support structured cybersecurity > information to IESG for consideration as Standards Track > document > 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, > policies, and regulations > 2012-03 - WGLC IODEF Guidance > 2012-04 - Submit IODEF Extension Labeling for data protection, > retention, policies, and regulations to IESG for > consideration as Standards Track document > 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as > Informational document > 2012-05 - WGLC GRC Report Exchange > 2012-06 - Submit GRC Report Exchange to IESG for consideration as > Standards Track document > 2012-06 - WGLC Forensics extension > 2012-07 - Submit IODEF Forensics extension to IESG for consideration as > Standards Track document >=20 >=20 > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile From turners@ieca.com Wed Oct 26 09:23:41 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C5F221F85AA for ; Wed, 26 Oct 2011 09:23:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.265 X-Spam-Level: X-Spam-Status: No, score=-102.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jPRc1CJGU9pM for ; Wed, 26 Oct 2011 09:23:40 -0700 (PDT) Received: from gateway15.websitewelcome.com (gateway15.websitewelcome.com [69.93.154.23]) by ietfa.amsl.com (Postfix) with SMTP id D376721F85DB for ; Wed, 26 Oct 2011 09:23:39 -0700 (PDT) Received: (qmail 21153 invoked from network); 26 Oct 2011 16:24:02 -0000 Received: from gator1743.hostgator.com (184.173.253.227) by gateway15.websitewelcome.com with SMTP; 26 Oct 2011 16:24:02 -0000 Received: from [96.241.1.80] (port=44346 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1RJ6GN-0005Pu-Fr; Wed, 26 Oct 2011 11:23:36 -0500 Message-ID: <4EA83407.6070504@ieca.com> Date: Wed, 26 Oct 2011 12:23:35 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1 MIME-Version: 1.0 To: kathleen.moriarty@emc.com References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [96.241.1.80]:44346 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 6 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: mile@ietf.org Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Oct 2011 16:23:41 -0000 Kathleen, As a starting point for defining a proactive inter-network communication method to facilitate sharing incident handling data while integrating existing detection, tracing, source identification, and mitigation mechanisms for a complete incident handling solution - I think it's a great starting point. Some comments based on a very quick skim: The draft indicates that it updates RFC 6045. Is there any reason that it shouldn't obsolete RFC 6045 and move RFC 6045 to Historic? Do you expect that implementations of RFC 6045 will be around? Do you want to strongly encourage them to do this updated version? I know this might seem awfully procedural, but having a well thought out answer might save some time later in the process. If this is a new and updated version, are new version #s needed in the protocol? I read that the summary of revisions, but I think it's worth asking anyway. Shouldn't the reference to RFC6046 be replaced with draft-trammell-mile-rfc6046-bis? ID nits complains about the following: s4: r/[XMLnames/[XMLNames] - note the N in names I love me some RFC 5275, but it's not used in the draft. spt On 10/25/11 6:25 PM, kathleen.moriarty@emc.com wrote: > Hello, > > Thank you all for your hard work in helping to move us to a WG status! The next step is to ask for adoption of drafts. > > The first document in which I would like to request working group adoption is RFC6045-bis with my hat on as editor of the document. Please respond to the mailing list within a week (Nov 2nd) stating if you support RFC6045-bis adoption by the working group. Also, please include if you are willing to review the draft in your response on adoption. > > http://tools.ietf.org/html/draft-moriarty-mile-rfc6045-bis-01 > > A consensus call will follow from Brian Trammell as Working Group chair. > > Thank you! > Kathleen > > -----Original Message----- > From: IESG Secretary [mailto:iesg-secretary@ietf.org] > Sent: Tuesday, October 25, 2011 12:46 PM > To: IETF Announcement list > Cc: Moriarty, Kathleen; trammell@tik.ee.ethz.ch; mile@ietf.org > Subject: WG Action: Managed Incident Lightweight Exchange (mile) > > A new IETF working group has been formed in the Security Area. For > additional information, please contact the Area Directors or the WG > Chairs. > > Managed Incident Lightweight Exchange (mile) > -------------------------------------------- > Status: Proposed Working Group Charter > Last Updated: 2011-09-21 > > Chairs: > Kathleen Moriarty > Brian Trammell > > Security Area Directors: > Stephen Farrell > Sean Turner > > Security Area Advisor: > Sean Turner > > Mailing Lists: > General Discussion: mile@ietf.org > To Subscribe: http://www.ietf.org/mailman/listinfo/mile > Archive: http://www.ietf.org/mail-archive/web/mile > > Description: > > The Managed Incident Lightweight Exchange (MILE) working group will > develop standards and extensions for the purpose of improving incident > information sharing and handling capabilities based on the work > developed in the IETF Extended INCident Handling (INCH) working group. > The Incident Object Description Exchange Format (IODEF) in RFC5070 and > Real-time Inter-network Defense (RID) in RFC6045 were developed in the > INCH working group by international Computer Security Incident Response > Teams (CSIRTs) and industry to meet the needs of a global community > interested in sharing, handling, and exchanging incident information. > The extensions and guidance created by the MILE working group assists > with the daily operations of CSIRTs at an organization, service > provider, law enforcement, and at the country level. The application of > IODEF and RID to interdomain incident information cooperative exchange > and sharing has recently expanded and the need for extensions has become > more important. Efforts continue to deploy IODEF and RID, as well as to > extend them to support specific use cases covering reporting and > mitigation of current threats such as anti-phishing extensions. > > An incident could be a benign configuration issue, IT incident, an > infraction to a service level agreement (SLA), a system compromise, > socially engineered phishing attack, or a denial-of-service (DoS) > attack, etc. When an incident is detected, the response may include > simply filing a report, notification to the source of the incident, a > request to a third party for resolution/mitigation, or a request to > locate the source. IODEF defines a data representation that provides a > standard format for sharing information commonly exchanged about > computer security incidents. RID enables the secure exchange of > incident related information in an IODEF format providing options for > security, privacy, and policy setting. > > MILE leverages collaboration and sharing experiences with the work > developed in the INCH working group which includes the data model > detailed in the IODEF, existing extensions to the IODEF for > Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure > exchange of information. MILE will also leverage the experience gained > in using IODEF and RID in operational contexts. Related work, drafted > outside of INCH will also be reviewed and includes RFC5941, Sharing > Transaction Fraud Data. > > The MILE working group provides coordination for these various extension > efforts to improve the capabilities for exchanging incident information. > MILE has several objectives with the first being a description a > subset of IODEF focused on ease of deployment and applicability to > current information security data sharing use cases. MILE also > describes a generalization of RID for secure exchange of other > security-relevant XML formats. MILE produces additional guidance needed > for the successful exchange of incident information for new use cases > according to policy, security, and privacy requirements. Finally, MILE > produces a document template with guidance for defining IODEF extensions > to be followed when producing extensions to IODEF as appropriate, for: > > * labeling incident reports with data protection, data retention, and > other policies, regulations, and > laws restricting the handling of those reports > * referencing structured security information from within incident > reports > * reporting forensic data generated during an incident investigation > (computer or accounting) > > The WG will produce the following: > > * An informational document on IODEF Guidance. > * A Standards Track document specifying the Real-time Inter-network > Defense (RID). > * A Standards Track document specifying the transport for RID. > * An informational template for extensions to IODEF. > * A Standards Track document for IODEF Extensions in IANA XML Registry. > * A Standards Track document for IODEF Extension to support > structured cybersecurity information. > * A Standards Track document for Labeling for data protection, > retention, policies, and regulations. > * A Standards Track document for GRC Report Exchange. > * A Standards Track document for IODEF Extension to support forensics. > > The drafts under consideration as WG items include: > * Real-time Inter-network Defense (RID) bis: > draft-moriarty-mile-rfc6045-bis-01 > * Transport of Real-time Inter-network Defense (RID) Messages bis: > draft-trammell-mile-rfc6046-bis-00 > * Template for extensions to IODEF: > draft-trammell-mile-template-01.txt > * IODEF Extensions in IANA XML Registry: > draft-trammell-mile-iodef-xmlreg-00.txt > * GRC Report Exchange (Generalized RID for XML reports/documents): > draft-moriarty-mile-grc-exchange-00.txt > * IODEF-extension to support structured cybersecurity information: > draft-takahashi-mile-sci-00.txt > > Milestones > > WGLC = Working Group Last Call > > 2011-11 - WGLC Real-time Inter-network Defense (RID) > 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) > 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for > consideration as Standards Track document > 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to > IESG for consideration as Standards Track document > 2011-12 - WGLC Template for extensions to IODEF > 2011-12 - WGLC IODEF Extensions in IANA XML Registry > 2011-12 - WGLC IODEF Extension to support structured cybersecurity > information > 2012-02 - Submit Template for extensions to IODEF to IESG for > consideration as Informational document > 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for > consideration as Standards Track document > 2012-02 - Submit IODEF Extension to support structured cybersecurity > information to IESG for consideration as Standards Track > document > 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, > policies, and regulations > 2012-03 - WGLC IODEF Guidance > 2012-04 - Submit IODEF Extension Labeling for data protection, > retention, policies, and regulations to IESG for > consideration as Standards Track document > 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as > Informational document > 2012-05 - WGLC GRC Report Exchange > 2012-06 - Submit GRC Report Exchange to IESG for consideration as > Standards Track document > 2012-06 - WGLC Forensics extension > 2012-07 - Submit IODEF Forensics extension to IESG for consideration as > Standards Track document > > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile > From kathleen.moriarty@emc.com Wed Oct 26 10:06:54 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3E3B21F8509 for ; Wed, 26 Oct 2011 10:06:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.166 X-Spam-Level: X-Spam-Status: No, score=-6.166 tagged_above=-999 required=5 tests=[AWL=-0.167, BAYES_00=-2.599, J_CHICKENPOX_22=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 30nY26OrX5vf for ; Wed, 26 Oct 2011 10:06:53 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id D469021F84CF for ; Wed, 26 Oct 2011 10:06:52 -0700 (PDT) Received: from hop04-l1d11-si02.isus.emc.com (HOP04-L1D11-SI02.isus.emc.com [10.254.111.55]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9QH6bmm023475 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 26 Oct 2011 13:06:44 -0400 Received: from mailhub.lss.emc.com (mailhubhoprd03.lss.emc.com [10.254.221.145]) by hop04-l1d11-si02.isus.emc.com (RSA Interceptor); Wed, 26 Oct 2011 13:06:28 -0400 Received: from mxhub18.corp.emc.com (mxhub18.corp.emc.com [10.254.93.47]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9QH6EWP022573; Wed, 26 Oct 2011 13:06:27 -0400 Received: from mx06a.corp.emc.com ([169.254.1.225]) by mxhub18.corp.emc.com ([10.254.93.47]) with mapi; Wed, 26 Oct 2011 13:06:23 -0400 From: To: Date: Wed, 26 Oct 2011 13:06:20 -0400 Thread-Topic: [mile] MILE WG draft adoption for RFC6045-bis Thread-Index: AcyT+7yec2Zz+QWpS1WW/MKKU1z49AABVG0w Message-ID: References: <4EA83407.6070504@ieca.com> In-Reply-To: <4EA83407.6070504@ieca.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Cc: mile@ietf.org Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Oct 2011 17:06:54 -0000 Hi Se4an, Thank you. Yes, this should result in RFC6045 becoming obsolete as the imp= rovements should be made. I will update the schema version, thanks for the= catch. I had that in the back of my mind, so the reminder is helpful! I was thinking about how group keys might be used in some use cases, so the= reference to 5275 was part of my thought process as I was trying to figure= out the right references (did not accomplish this). If you have suggestio= ns, it may be something that should get considered. Thanks, Kathleen -----Original Message----- From: Sean Turner [mailto:turners@ieca.com]=20 Sent: Wednesday, October 26, 2011 12:24 PM To: Moriarty, Kathleen Cc: mile@ietf.org Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis Kathleen, As a starting point for defining a proactive inter-network communication=20 method to facilitate sharing incident handling data while integrating=20 existing detection, tracing, source identification, and mitigation=20 mechanisms for a complete incident handling solution - I think it's a=20 great starting point. Some comments based on a very quick skim: The draft indicates that it updates RFC 6045. Is there any reason that=20 it shouldn't obsolete RFC 6045 and move RFC 6045 to Historic? Do you=20 expect that implementations of RFC 6045 will be around? Do you want to=20 strongly encourage them to do this updated version? I know this might=20 seem awfully procedural, but having a well thought out answer might save=20 some time later in the process. If this is a new and updated version, are new version #s needed in the=20 protocol? I read that the summary of revisions, but I think it's worth=20 asking anyway. Shouldn't the reference to RFC6046 be replaced with=20 draft-trammell-mile-rfc6046-bis? ID nits complains about the following: s4: r/[XMLnames/[XMLNames] - note the N in names I love me some RFC 5275, but it's not used in the draft. spt On 10/25/11 6:25 PM, kathleen.moriarty@emc.com wrote: > Hello, > > Thank you all for your hard work in helping to move us to a WG status! T= he next step is to ask for adoption of drafts. > > The first document in which I would like to request working group adoptio= n is RFC6045-bis with my hat on as editor of the document. Please respond = to the mailing list within a week (Nov 2nd) stating if you support RFC6045-= bis adoption by the working group. Also, please include if you are willing= to review the draft in your response on adoption. > > http://tools.ietf.org/html/draft-moriarty-mile-rfc6045-bis-01 > > A consensus call will follow from Brian Trammell as Working Group chair. > > Thank you! > Kathleen > > -----Original Message----- > From: IESG Secretary [mailto:iesg-secretary@ietf.org] > Sent: Tuesday, October 25, 2011 12:46 PM > To: IETF Announcement list > Cc: Moriarty, Kathleen; trammell@tik.ee.ethz.ch; mile@ietf.org > Subject: WG Action: Managed Incident Lightweight Exchange (mile) > > A new IETF working group has been formed in the Security Area. For > additional information, please contact the Area Directors or the WG > Chairs. > > Managed Incident Lightweight Exchange (mile) > -------------------------------------------- > Status: Proposed Working Group Charter > Last Updated: 2011-09-21 > > Chairs: > Kathleen Moriarty > Brian Trammell > > Security Area Directors: > Stephen Farrell > Sean Turner > > Security Area Advisor: > Sean Turner > > Mailing Lists: > General Discussion: mile@ietf.org > To Subscribe: http://www.ietf.org/mailman/listinfo/mile > Archive: http://www.ietf.org/mail-archive/web/mile > > Description: > > The Managed Incident Lightweight Exchange (MILE) working group will > develop standards and extensions for the purpose of improving incident > information sharing and handling capabilities based on the work > developed in the IETF Extended INCident Handling (INCH) working group. > The Incident Object Description Exchange Format (IODEF) in RFC5070 and > Real-time Inter-network Defense (RID) in RFC6045 were developed in the > INCH working group by international Computer Security Incident Response > Teams (CSIRTs) and industry to meet the needs of a global community > interested in sharing, handling, and exchanging incident information. > The extensions and guidance created by the MILE working group assists > with the daily operations of CSIRTs at an organization, service > provider, law enforcement, and at the country level. The application of > IODEF and RID to interdomain incident information cooperative exchange > and sharing has recently expanded and the need for extensions has become > more important. Efforts continue to deploy IODEF and RID, as well as to > extend them to support specific use cases covering reporting and > mitigation of current threats such as anti-phishing extensions. > > An incident could be a benign configuration issue, IT incident, an > infraction to a service level agreement (SLA), a system compromise, > socially engineered phishing attack, or a denial-of-service (DoS) > attack, etc. When an incident is detected, the response may include > simply filing a report, notification to the source of the incident, a > request to a third party for resolution/mitigation, or a request to > locate the source. IODEF defines a data representation that provides a > standard format for sharing information commonly exchanged about > computer security incidents. RID enables the secure exchange of > incident related information in an IODEF format providing options for > security, privacy, and policy setting. > > MILE leverages collaboration and sharing experiences with the work > developed in the INCH working group which includes the data model > detailed in the IODEF, existing extensions to the IODEF for > Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure > exchange of information. MILE will also leverage the experience gained > in using IODEF and RID in operational contexts. Related work, drafted > outside of INCH will also be reviewed and includes RFC5941, Sharing > Transaction Fraud Data. > > The MILE working group provides coordination for these various extension > efforts to improve the capabilities for exchanging incident information. > MILE has several objectives with the first being a description a > subset of IODEF focused on ease of deployment and applicability to > current information security data sharing use cases. MILE also > describes a generalization of RID for secure exchange of other > security-relevant XML formats. MILE produces additional guidance needed > for the successful exchange of incident information for new use cases > according to policy, security, and privacy requirements. Finally, MILE > produces a document template with guidance for defining IODEF extensions > to be followed when producing extensions to IODEF as appropriate, for: > > * labeling incident reports with data protection, data retention, and > other policies, regulations, and > laws restricting the handling of those reports > * referencing structured security information from within incident > reports > * reporting forensic data generated during an incident investigation > (computer or accounting) > > The WG will produce the following: > > * An informational document on IODEF Guidance. > * A Standards Track document specifying the Real-time Inter-network > Defense (RID). > * A Standards Track document specifying the transport for RID. > * An informational template for extensions to IODEF. > * A Standards Track document for IODEF Extensions in IANA XML Registry= . > * A Standards Track document for IODEF Extension to support > structured cybersecurity information. > * A Standards Track document for Labeling for data protection, > retention, policies, and regulations. > * A Standards Track document for GRC Report Exchange. > * A Standards Track document for IODEF Extension to support forensics. > > The drafts under consideration as WG items include: > * Real-time Inter-network Defense (RID) bis: > draft-moriarty-mile-rfc6045-bis-01 > * Transport of Real-time Inter-network Defense (RID) Messages bis: > draft-trammell-mile-rfc6046-bis-00 > * Template for extensions to IODEF: > draft-trammell-mile-template-01.txt > * IODEF Extensions in IANA XML Registry: > draft-trammell-mile-iodef-xmlreg-00.txt > * GRC Report Exchange (Generalized RID for XML reports/documents): > draft-moriarty-mile-grc-exchange-00.txt > * IODEF-extension to support structured cybersecurity information: > draft-takahashi-mile-sci-00.txt > > Milestones > > WGLC =3D Working Group Last Call > > 2011-11 - WGLC Real-time Inter-network Defense (RID) > 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) > 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for > consideration as Standards Track document > 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to > IESG for consideration as Standards Track document > 2011-12 - WGLC Template for extensions to IODEF > 2011-12 - WGLC IODEF Extensions in IANA XML Registry > 2011-12 - WGLC IODEF Extension to support structured cybersecurity > information > 2012-02 - Submit Template for extensions to IODEF to IESG for > consideration as Informational document > 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for > consideration as Standards Track document > 2012-02 - Submit IODEF Extension to support structured cybersecurity > information to IESG for consideration as Standards Track > document > 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, > policies, and regulations > 2012-03 - WGLC IODEF Guidance > 2012-04 - Submit IODEF Extension Labeling for data protection, > retention, policies, and regulations to IESG for > consideration as Standards Track document > 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as > Informational document > 2012-05 - WGLC GRC Report Exchange > 2012-06 - Submit GRC Report Exchange to IESG for consideration as > Standards Track document > 2012-06 - WGLC Forensics extension > 2012-07 - Submit IODEF Forensics extension to IESG for consideration as > Standards Track document > > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile > From takeshi_takahashi@nict.go.jp Thu Oct 27 23:24:07 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 420901F0C55 for ; Thu, 27 Oct 2011 23:24:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.355 X-Spam-Level: X-Spam-Status: No, score=-1.355 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_JP=1.244] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aWQJ9QhHl1GX for ; Thu, 27 Oct 2011 23:24:06 -0700 (PDT) Received: from ns1.nict.go.jp (ns1.nict.go.jp [IPv6:2001:df0:232:300::1]) by ietfa.amsl.com (Postfix) with ESMTP id EAB011F0C42 for ; Thu, 27 Oct 2011 23:24:05 -0700 (PDT) Received: from gw1.nict.go.jp (gw1 [133.243.18.250]) by ns1.nict.go.jp with ESMTP id p9S6O282001003; Fri, 28 Oct 2011 15:24:02 +0900 (JST) Received: from gw1.nict.go.jp (localhost [127.0.0.1]) by gw1.nict.go.jp with ESMTP id p9S6O1C0006539; Fri, 28 Oct 2011 15:24:02 +0900 (JST) Received: from mail2.nict.go.jp (mail.nict.go.jp [133.243.18.3]) by gw1.nict.go.jp with ESMTP id p9S6O1wL006536; Fri, 28 Oct 2011 15:24:01 +0900 (JST) Received: from mail2.nict.go.jp (localhost [127.0.0.1]) by mail2.nict.go.jp (NICT Mail) with ESMTP id 148422C3E1; Fri, 28 Oct 2011 15:24:01 +0900 (JST) Received: from TakeVAIO (unknown [133.243.119.172]) by mail2.nict.go.jp (NICT Mail) with ESMTP id EFA792C3B8; Fri, 28 Oct 2011 15:24:00 +0900 (JST) From: "Takeshi Takahashi" To: , References: <7C4DFCE962635144B8FAE8CA11D0BF1E058D0EF98C@MX14A.corp.emc.com> In-Reply-To: <7C4DFCE962635144B8FAE8CA11D0BF1E058D0EF98C@MX14A.corp.emc.com> Date: Fri, 28 Oct 2011 15:24:05 +0900 Message-ID: <000c01cc953a$31764ca0$9462e5e0$@nict.go.jp> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQJv36GmFITll4+v6N5EU7qoHNnByQETEcqTlEIXfjA= Content-Language: ja Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Oct 2011 06:24:07 -0000 Hello Kathleen and all, I also would like to see the RFC6045-bis to be adopted by the MILE WG. I've already read the document, and in my understanding, the draft is carefully designed to handle IODEF document and its extension documents. Kind Regards, Take -----Original Message----- From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of david.black@emc.com Sent: Wednesday, October 26, 2011 11:04 PM To: kathleen.moriarty@emc.com; mile@ietf.org Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis Congratulations on the formation of the WG! The RFC6045-bis draft should be adopted by the mile WG; the draft = contains some important improvements over RFC 6045. I've already reviewed the draft, and would be willing to take another = look ... as my time availability permits ;-). Thanks, --David ---------------------------------------------------- David L. Black, Distinguished Engineer EMC Corporation, 176 South St., Hopkinton, MA=A0 01748 +1 (508) 293-7953=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 FAX: +1 (508) = 293-7786 david.black@emc.com=A0=A0=A0=A0=A0=A0=A0 Mobile: +1 (978) 394-7754 ---------------------------------------------------- > -----Original Message----- > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf=20 > Of kathleen.moriarty@emc.com > Sent: Tuesday, October 25, 2011 6:26 PM > To: mile@ietf.org > Subject: [mile] MILE WG draft adoption for RFC6045-bis >=20 > Hello, >=20 > Thank you all for your hard work in helping to move us to a WG status! = =20 > The next step is to ask for adoption of drafts. >=20 > The first document in which I would like to request working group=20 > adoption is RFC6045-bis with my hat on as editor of the document. =20 > Please respond to the mailing list within a week (Nov 2nd) stating if=20 > you support RFC6045-bis adoption by the working group. Also, please include if you are willing to review the draft in your response on = adoption. >=20 > http://tools.ietf.org/html/draft-moriarty-mile-rfc6045-bis-01 >=20 > A consensus call will follow from Brian Trammell as Working Group = chair. >=20 > Thank you! > Kathleen >=20 > -----Original Message----- > From: IESG Secretary [mailto:iesg-secretary@ietf.org] > Sent: Tuesday, October 25, 2011 12:46 PM > To: IETF Announcement list > Cc: Moriarty, Kathleen; trammell@tik.ee.ethz.ch; mile@ietf.org > Subject: WG Action: Managed Incident Lightweight Exchange (mile) >=20 > A new IETF working group has been formed in the Security Area. For=20 > additional information, please contact the Area Directors or the WG=20 > Chairs. >=20 > Managed Incident Lightweight Exchange (mile) > -------------------------------------------- > Status: Proposed Working Group Charter Last Updated: 2011-09-21 >=20 > Chairs: > Kathleen Moriarty > Brian Trammell >=20 > Security Area Directors: > Stephen Farrell > Sean Turner >=20 > Security Area Advisor: > Sean Turner >=20 > Mailing Lists: > General Discussion: mile@ietf.org > To Subscribe: http://www.ietf.org/mailman/listinfo/mile > Archive: http://www.ietf.org/mail-archive/web/mile >=20 > Description: >=20 > The Managed Incident Lightweight Exchange (MILE) working group will=20 > develop standards and extensions for the purpose of improving incident = > information sharing and handling capabilities based on the work=20 > developed in the IETF Extended INCident Handling (INCH) working group. > The Incident Object Description Exchange Format (IODEF) in RFC5070 and = > Real-time Inter-network Defense (RID) in RFC6045 were developed in the = > INCH working group by international Computer Security Incident=20 > Response Teams (CSIRTs) and industry to meet the needs of a global=20 > community interested in sharing, handling, and exchanging incident information. > The extensions and guidance created by the MILE working group assists=20 > with the daily operations of CSIRTs at an organization, service=20 > provider, law enforcement, and at the country level. The application=20 > of IODEF and RID to interdomain incident information cooperative=20 > exchange and sharing has recently expanded and the need for extensions = > has become more important. Efforts continue to deploy IODEF and RID,=20 > as well as to extend them to support specific use cases covering=20 > reporting and mitigation of current threats such as anti-phishing extensions. >=20 > An incident could be a benign configuration issue, IT incident, an=20 > infraction to a service level agreement (SLA), a system compromise,=20 > socially engineered phishing attack, or a denial-of-service (DoS)=20 > attack, etc. When an incident is detected, the response may include=20 > simply filing a report, notification to the source of the incident, a=20 > request to a third party for resolution/mitigation, or a request to=20 > locate the source. IODEF defines a data representation that provides=20 > a standard format for sharing information commonly exchanged about=20 > computer security incidents. RID enables the secure exchange of=20 > incident related information in an IODEF format providing options for=20 > security, privacy, and policy setting. >=20 > MILE leverages collaboration and sharing experiences with the work=20 > developed in the INCH working group which includes the data model=20 > detailed in the IODEF, existing extensions to the IODEF for=20 > Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure=20 > exchange of information. MILE will also leverage the experience=20 > gained in using IODEF and RID in operational contexts. Related work,=20 > drafted outside of INCH will also be reviewed and includes RFC5941,=20 > Sharing Transaction Fraud Data. >=20 > The MILE working group provides coordination for these various=20 > extension efforts to improve the capabilities for exchanging incident information. > MILE has several objectives with the first being a description a=20 > subset of IODEF focused on ease of deployment and applicability to=20 > current information security data sharing use cases. MILE also=20 > describes a generalization of RID for secure exchange of other=20 > security-relevant XML formats. MILE produces additional guidance=20 > needed for the successful exchange of incident information for new use = > cases according to policy, security, and privacy requirements. =20 > Finally, MILE produces a document template with guidance for defining=20 > IODEF extensions to be followed when producing extensions to IODEF as appropriate, for: >=20 > * labeling incident reports with data protection, data retention, = and > other policies, regulations, and > laws restricting the handling of those reports > * referencing structured security information from within incident > reports > * reporting forensic data generated during an incident investigation > (computer or accounting) >=20 > The WG will produce the following: >=20 > * An informational document on IODEF Guidance. > * A Standards Track document specifying the Real-time Inter-network > Defense (RID). > * A Standards Track document specifying the transport for RID. > * An informational template for extensions to IODEF. > * A Standards Track document for IODEF Extensions in IANA XML = Registry. > * A Standards Track document for IODEF Extension to support > structured cybersecurity information. > * A Standards Track document for Labeling for data protection, > retention, policies, and regulations. > * A Standards Track document for GRC Report Exchange. > * A Standards Track document for IODEF Extension to support = forensics. >=20 > The drafts under consideration as WG items include: > * Real-time Inter-network Defense (RID) bis: > draft-moriarty-mile-rfc6045-bis-01 > * Transport of Real-time Inter-network Defense (RID) Messages bis: > draft-trammell-mile-rfc6046-bis-00 > * Template for extensions to IODEF: > draft-trammell-mile-template-01.txt > * IODEF Extensions in IANA XML Registry: > draft-trammell-mile-iodef-xmlreg-00.txt > * GRC Report Exchange (Generalized RID for XML reports/documents): > draft-moriarty-mile-grc-exchange-00.txt > * IODEF-extension to support structured cybersecurity information: > draft-takahashi-mile-sci-00.txt >=20 > Milestones >=20 > WGLC =3D Working Group Last Call >=20 > 2011-11 - WGLC Real-time Inter-network Defense (RID) > 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) > 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for > consideration as Standards Track document > 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to > IESG for consideration as Standards Track document > 2011-12 - WGLC Template for extensions to IODEF > 2011-12 - WGLC IODEF Extensions in IANA XML Registry > 2011-12 - WGLC IODEF Extension to support structured cybersecurity > information > 2012-02 - Submit Template for extensions to IODEF to IESG for > consideration as Informational document > 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for > consideration as Standards Track document > 2012-02 - Submit IODEF Extension to support structured cybersecurity > information to IESG for consideration as Standards Track > document > 2012-03 - WGLC IODEF Extension Labeling for data protection, = retention, > policies, and regulations > 2012-03 - WGLC IODEF Guidance > 2012-04 - Submit IODEF Extension Labeling for data protection, > retention, policies, and regulations to IESG for > consideration as Standards Track document > 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as > Informational document > 2012-05 - WGLC GRC Report Exchange > 2012-06 - Submit GRC Report Exchange to IESG for consideration as > Standards Track document > 2012-06 - WGLC Forensics extension > 2012-07 - Submit IODEF Forensics extension to IESG for consideration = as > Standards Track document >=20 >=20 > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile From ramartin@mitre.org Fri Oct 28 10:31:10 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAE0F21F86D0 for ; Fri, 28 Oct 2011 10:31:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E+j-4R+-Fj6O for ; Fri, 28 Oct 2011 10:31:10 -0700 (PDT) Received: from smtpksrv1.mitre.org (smtpksrv1.mitre.org [198.49.146.77]) by ietfa.amsl.com (Postfix) with ESMTP id C9F5C21F84BA for ; Fri, 28 Oct 2011 10:31:09 -0700 (PDT) Received: from smtpksrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 31F1721B0E2F; Fri, 28 Oct 2011 13:31:07 -0400 (EDT) Received: from IMCCAS04.MITRE.ORG (imccas04.mitre.org [129.83.29.81]) by smtpksrv1.mitre.org (Postfix) with ESMTP id 29CEE21B0A9D; Fri, 28 Oct 2011 13:31:07 -0400 (EDT) Received: from MM169528-pc.local (129.83.31.51) by IMCCAS04.MITRE.ORG (129.83.29.81) with Microsoft SMTP Server id 14.1.339.1; Fri, 28 Oct 2011 13:31:06 -0400 Message-ID: <4EAAE6DA.4080708@mitre.org> Date: Fri, 28 Oct 2011 13:31:06 -0400 From: "Martin, Robert A." User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1 MIME-Version: 1.0 To: "kathleen.moriarty@emc.com" References: In-Reply-To: Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit Cc: "mile@ietf.org" Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Oct 2011 17:31:11 -0000 Congratualations to all for getting this work area started. RFC6045 should definetly be adopted by the MILE Working Group. It fills a needed and critical part of the functionality needed to support automation in incident handling amongst organizations. Bob On 10/25/11 6:25 PM, kathleen.moriarty@emc.com wrote: > Hello, > > Thank you all for your hard work in helping to move us to a WG status! The next step is to ask for adoption of drafts. > > The first document in which I would like to request working group adoption is RFC6045-bis with my hat on as editor of the document. Please respond to the mailing list within a week (Nov 2nd) stating if you support RFC6045-bis adoption by the working group. Also, please include if you are willing to review the draft in your response on adoption. > > http://tools.ietf.org/html/draft-moriarty-mile-rfc6045-bis-01 > > A consensus call will follow from Brian Trammell as Working Group chair. > > Thank you! > Kathleen > > -----Original Message----- > From: IESG Secretary [mailto:iesg-secretary@ietf.org] > Sent: Tuesday, October 25, 2011 12:46 PM > To: IETF Announcement list > Cc: Moriarty, Kathleen; trammell@tik.ee.ethz.ch; mile@ietf.org > Subject: WG Action: Managed Incident Lightweight Exchange (mile) > > A new IETF working group has been formed in the Security Area. For > additional information, please contact the Area Directors or the WG > Chairs. > > Managed Incident Lightweight Exchange (mile) > -------------------------------------------- > Status: Proposed Working Group Charter > Last Updated: 2011-09-21 > > Chairs: > Kathleen Moriarty > Brian Trammell > > Security Area Directors: > Stephen Farrell > Sean Turner > > Security Area Advisor: > Sean Turner > > Mailing Lists: > General Discussion: mile@ietf.org > To Subscribe: http://www.ietf.org/mailman/listinfo/mile > Archive: http://www.ietf.org/mail-archive/web/mile > > Description: > > The Managed Incident Lightweight Exchange (MILE) working group will > develop standards and extensions for the purpose of improving incident > information sharing and handling capabilities based on the work > developed in the IETF Extended INCident Handling (INCH) working group. > The Incident Object Description Exchange Format (IODEF) in RFC5070 and > Real-time Inter-network Defense (RID) in RFC6045 were developed in the > INCH working group by international Computer Security Incident Response > Teams (CSIRTs) and industry to meet the needs of a global community > interested in sharing, handling, and exchanging incident information. > The extensions and guidance created by the MILE working group assists > with the daily operations of CSIRTs at an organization, service > provider, law enforcement, and at the country level. The application of > IODEF and RID to interdomain incident information cooperative exchange > and sharing has recently expanded and the need for extensions has become > more important. Efforts continue to deploy IODEF and RID, as well as to > extend them to support specific use cases covering reporting and > mitigation of current threats such as anti-phishing extensions. > > An incident could be a benign configuration issue, IT incident, an > infraction to a service level agreement (SLA), a system compromise, > socially engineered phishing attack, or a denial-of-service (DoS) > attack, etc. When an incident is detected, the response may include > simply filing a report, notification to the source of the incident, a > request to a third party for resolution/mitigation, or a request to > locate the source. IODEF defines a data representation that provides a > standard format for sharing information commonly exchanged about > computer security incidents. RID enables the secure exchange of > incident related information in an IODEF format providing options for > security, privacy, and policy setting. > > MILE leverages collaboration and sharing experiences with the work > developed in the INCH working group which includes the data model > detailed in the IODEF, existing extensions to the IODEF for > Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure > exchange of information. MILE will also leverage the experience gained > in using IODEF and RID in operational contexts. Related work, drafted > outside of INCH will also be reviewed and includes RFC5941, Sharing > Transaction Fraud Data. > > The MILE working group provides coordination for these various extension > efforts to improve the capabilities for exchanging incident information. > MILE has several objectives with the first being a description a > subset of IODEF focused on ease of deployment and applicability to > current information security data sharing use cases. MILE also > describes a generalization of RID for secure exchange of other > security-relevant XML formats. MILE produces additional guidance needed > for the successful exchange of incident information for new use cases > according to policy, security, and privacy requirements. Finally, MILE > produces a document template with guidance for defining IODEF extensions > to be followed when producing extensions to IODEF as appropriate, for: > > * labeling incident reports with data protection, data retention, and > other policies, regulations, and > laws restricting the handling of those reports > * referencing structured security information from within incident > reports > * reporting forensic data generated during an incident investigation > (computer or accounting) > > The WG will produce the following: > > * An informational document on IODEF Guidance. > * A Standards Track document specifying the Real-time Inter-network > Defense (RID). > * A Standards Track document specifying the transport for RID. > * An informational template for extensions to IODEF. > * A Standards Track document for IODEF Extensions in IANA XML Registry. > * A Standards Track document for IODEF Extension to support > structured cybersecurity information. > * A Standards Track document for Labeling for data protection, > retention, policies, and regulations. > * A Standards Track document for GRC Report Exchange. > * A Standards Track document for IODEF Extension to support forensics. > > The drafts under consideration as WG items include: > * Real-time Inter-network Defense (RID) bis: > draft-moriarty-mile-rfc6045-bis-01 > * Transport of Real-time Inter-network Defense (RID) Messages bis: > draft-trammell-mile-rfc6046-bis-00 > * Template for extensions to IODEF: > draft-trammell-mile-template-01.txt > * IODEF Extensions in IANA XML Registry: > draft-trammell-mile-iodef-xmlreg-00.txt > * GRC Report Exchange (Generalized RID for XML reports/documents): > draft-moriarty-mile-grc-exchange-00.txt > * IODEF-extension to support structured cybersecurity information: > draft-takahashi-mile-sci-00.txt > > Milestones > > WGLC = Working Group Last Call > > 2011-11 - WGLC Real-time Inter-network Defense (RID) > 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) > 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for > consideration as Standards Track document > 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to > IESG for consideration as Standards Track document > 2011-12 - WGLC Template for extensions to IODEF > 2011-12 - WGLC IODEF Extensions in IANA XML Registry > 2011-12 - WGLC IODEF Extension to support structured cybersecurity > information > 2012-02 - Submit Template for extensions to IODEF to IESG for > consideration as Informational document > 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for > consideration as Standards Track document > 2012-02 - Submit IODEF Extension to support structured cybersecurity > information to IESG for consideration as Standards Track > document > 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, > policies, and regulations > 2012-03 - WGLC IODEF Guidance > 2012-04 - Submit IODEF Extension Labeling for data protection, > retention, policies, and regulations to IESG for > consideration as Standards Track document > 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as > Informational document > 2012-05 - WGLC GRC Report Exchange > 2012-06 - Submit GRC Report Exchange to IESG for consideration as > Standards Track document > 2012-06 - WGLC Forensics extension > 2012-07 - Submit IODEF Forensics extension to IESG for consideration as > Standards Track document > > > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile > . > From Kent_Landfield@mcafee.com Fri Oct 28 10:42:54 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33C7421F861E for ; Fri, 28 Oct 2011 10:42:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.799 X-Spam-Level: X-Spam-Status: No, score=-3.799 tagged_above=-999 required=5 tests=[AWL=2.800, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AMmFfALK4x4n for ; Fri, 28 Oct 2011 10:42:53 -0700 (PDT) Received: from dalsmrelay2.nai.com (dalsmrelay2.nai.com [205.227.136.216]) by ietfa.amsl.com (Postfix) with ESMTP id 1F26F21F8610 for ; Fri, 28 Oct 2011 10:42:53 -0700 (PDT) Received: from (unknown [10.64.5.51]) by dalsmrelay2.nai.com with smtp id 0768_5316_3faadcd2_018c_11e1_a94b_00219b929abd; Fri, 28 Oct 2011 12:42:46 -0500 Received: from AMERDALEXMB1.corp.nai.org ([fe80::387d:3d79:ad3b:b517]) by DALEXHT1.corp.nai.org ([::1]) with mapi; Fri, 28 Oct 2011 12:42:47 -0500 From: To: , Date: Fri, 28 Oct 2011 12:42:53 -0500 Thread-Topic: [mile] MILE WG draft adoption for RFC6045-bis Thread-Index: AcyVmQE3aR7I4AFxQ5q1B/zaPjZ8qA== Message-ID: In-Reply-To: <4EAAE6DA.4080708@mitre.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.13.0.110805 acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: mile@ietf.org Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Oct 2011 17:42:54 -0000 I too support RFC6045-bis being adopted by the working group. Kent Landfield Director Content Strategy, Architecture and Standards McAfee, Inc. 5000 Headquarters Dr. Plano, Texas 75024 Direct: +1.972.963.7096 Mobile: +1.817.637.8026 Web: www.mcafee.com From: Bob Martin > Date: Fri, 28 Oct 2011 12:31:06 -0500 To: Kathleen Moriarty > Cc: "mile@ietf.org" > Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis Congratualations to all for getting this work area started. RFC6045 should definetly be adopted by the MILE Working Group. It fills a needed and critical part of the functionality needed to support automation in incident handling amongst organizations. Bob On 10/25/11 6:25 PM, kathleen.moriarty@emc.com wrote: Hello, Thank you all for your hard work in helping to move us to a WG status! The= next step is to ask for adoption of drafts. The first document in which I would like to request working group adoption = is RFC6045-bis with my hat on as editor of the document. Please respond to= the mailing list within a week (Nov 2nd) stating if you support RFC6045-bi= s adoption by the working group. Also, please include if you are willing t= o review the draft in your response on adoption. http://tools.ietf.org/html/draft-moriarty-mile-rfc6045-bis-01 A consensus call will follow from Brian Trammell as Working Group chair. Thank you! Kathleen -----Original Message----- From: IESG Secretary [mailto:iesg-secretary@ietf.org] Sent: Tuesday, October 25, 2011 12:46 PM To: IETF Announcement list Cc: Moriarty, Kathleen; trammell@tik.ee.ethz.ch; mile@ietf.org Subject: WG Action: Managed Incident Lightweight Exchange (mile) A new IETF working group has been formed in the Security Area. For additional information, please contact the Area Directors or the WG Chairs. Managed Incident Lightweight Exchange (mile) -------------------------------------------- Status: Proposed Working Group Charter Last Updated: 2011-09-21 Chairs: Kathleen Moriarty> Brian Trammell> Security Area Directors: Stephen Farrell> Sean Turner> Security Area Advisor: Sean Turner> Mailing Lists: General Discussion: mile@ietf.org To Subscribe: http://www.ietf.org/mailman/listinfo/mile Archive: http://www.ietf.org/mail-archive/web/mile Description: The Managed Incident Lightweight Exchange (MILE) working group will develop standards and extensions for the purpose of improving incident information sharing and handling capabilities based on the work developed in the IETF Extended INCident Handling (INCH) working group. The Incident Object Description Exchange Format (IODEF) in RFC5070 and Real-time Inter-network Defense (RID) in RFC6045 were developed in the INCH working group by international Computer Security Incident Response Teams (CSIRTs) and industry to meet the needs of a global community interested in sharing, handling, and exchanging incident information. The extensions and guidance created by the MILE working group assists with the daily operations of CSIRTs at an organization, service provider, law enforcement, and at the country level. The application of IODEF and RID to interdomain incident information cooperative exchange and sharing has recently expanded and the need for extensions has become more important. Efforts continue to deploy IODEF and RID, as well as to extend them to support specific use cases covering reporting and mitigation of current threats such as anti-phishing extensions. An incident could be a benign configuration issue, IT incident, an infraction to a service level agreement (SLA), a system compromise, socially engineered phishing attack, or a denial-of-service (DoS) attack, etc. When an incident is detected, the response may include simply filing a report, notification to the source of the incident, a request to a third party for resolution/mitigation, or a request to locate the source. IODEF defines a data representation that provides a standard format for sharing information commonly exchanged about computer security incidents. RID enables the secure exchange of incident related information in an IODEF format providing options for security, privacy, and policy setting. MILE leverages collaboration and sharing experiences with the work developed in the INCH working group which includes the data model detailed in the IODEF, existing extensions to the IODEF for Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure exchange of information. MILE will also leverage the experience gained in using IODEF and RID in operational contexts. Related work, drafted outside of INCH will also be reviewed and includes RFC5941, Sharing Transaction Fraud Data. The MILE working group provides coordination for these various extension efforts to improve the capabilities for exchanging incident information. MILE has several objectives with the first being a description a subset of IODEF focused on ease of deployment and applicability to current information security data sharing use cases. MILE also describes a generalization of RID for secure exchange of other security-relevant XML formats. MILE produces additional guidance needed for the successful exchange of incident information for new use cases according to policy, security, and privacy requirements. Finally, MILE produces a document template with guidance for defining IODEF extensions to be followed when producing extensions to IODEF as appropriate, for: * labeling incident reports with data protection, data retention, and other policies, regulations, and laws restricting the handling of those reports * referencing structured security information from within incident reports * reporting forensic data generated during an incident investigation (computer or accounting) The WG will produce the following: * An informational document on IODEF Guidance. * A Standards Track document specifying the Real-time Inter-network Defense (RID). * A Standards Track document specifying the transport for RID. * An informational template for extensions to IODEF. * A Standards Track document for IODEF Extensions in IANA XML Registry. * A Standards Track document for IODEF Extension to support structured cybersecurity information. * A Standards Track document for Labeling for data protection, retention, policies, and regulations. * A Standards Track document for GRC Report Exchange. * A Standards Track document for IODEF Extension to support forensics. The drafts under consideration as WG items include: * Real-time Inter-network Defense (RID) bis: draft-moriarty-mile-rfc6045-bis-01 * Transport of Real-time Inter-network Defense (RID) Messages bis: draft-trammell-mile-rfc6046-bis-00 * Template for extensions to IODEF: draft-trammell-mile-template-01.txt * IODEF Extensions in IANA XML Registry: draft-trammell-mile-iodef-xmlreg-00.txt * GRC Report Exchange (Generalized RID for XML reports/documents): draft-moriarty-mile-grc-exchange-00.txt * IODEF-extension to support structured cybersecurity information: draft-takahashi-mile-sci-00.txt Milestones WGLC =3D Working Group Last Call 2011-11 - WGLC Real-time Inter-network Defense (RID) 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID) 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document 2011-12 - WGLC Template for extensions to IODEF 2011-12 - WGLC IODEF Extensions in IANA XML Registry 2011-12 - WGLC IODEF Extension to support structured cybersecurity information 2012-02 - Submit Template for extensions to IODEF to IESG for consideration as Informational document 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for consideration as Standards Track document 2012-02 - Submit IODEF Extension to support structured cybersecurity information to IESG for consideration as Standards Track document 2012-03 - WGLC IODEF Extension Labeling for data protection, retention, policies, and regulations 2012-03 - WGLC IODEF Guidance 2012-04 - Submit IODEF Extension Labeling for data protection, retention, policies, and regulations to IESG for consideration as Standards Track document 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as Informational document 2012-05 - WGLC GRC Report Exchange 2012-06 - Submit GRC Report Exchange to IESG for consideration as Standards Track document 2012-06 - WGLC Forensics extension 2012-07 - Submit IODEF Forensics extension to IESG for consideration as Standards Track document _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile . _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile From david.black@emc.com Sat Oct 29 19:04:22 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 494D221F84D2 for ; Sat, 29 Oct 2011 19:04:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id anEJc4+Fu-SM for ; Sat, 29 Oct 2011 19:04:21 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id E309121F84C1 for ; Sat, 29 Oct 2011 19:04:20 -0700 (PDT) Received: from hop04-l1d11-si01.isus.emc.com (HOP04-L1D11-SI01.isus.emc.com [10.254.111.54]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9U24H6M030416 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 29 Oct 2011 22:04:18 -0400 Received: from mailhub.lss.emc.com (mailhub.lss.emc.com [10.254.222.130]) by hop04-l1d11-si01.isus.emc.com (RSA Interceptor); Sat, 29 Oct 2011 22:03:55 -0400 Received: from mxhub02.corp.emc.com (mxhub02.corp.emc.com [10.254.141.104]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9U23to9002521; Sat, 29 Oct 2011 22:03:55 -0400 Received: from mx14a.corp.emc.com ([169.254.1.78]) by mxhub02.corp.emc.com ([10.254.141.104]) with mapi; Sat, 29 Oct 2011 22:03:54 -0400 From: To: , Date: Sat, 29 Oct 2011 22:03:53 -0400 Thread-Topic: [mile] Documents for consideration as MILE WG items Thread-Index: AcyTsTO+CjIZIJ/HTnSGYwY/HMrvtQC9JbD7 Message-ID: <7C4DFCE962635144B8FAE8CA11D0BF1E058CE79952@MX14A.corp.emc.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Subject: Re: [mile] Documents for consideration as MILE WG items X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Oct 2011 02:04:22 -0000 Brian, To state the obvious, the 6046bis draft (RID transport) should clearly be a= dopted by the WG, as it will need to be normatively referenced by Kathleen's 6045bis = draft (RID), and both should be published as RFCs together. I wonder whether it would be possible to combine the other two drafts into = one, as the iodef-xmlreg draft is effectively the actual IANA considerations for= the use of the IODEF template. If the drafts are combined, it's still possible to hav= e those IANA considerations apply to all IODEF extensions, not just those that use the t= emplate. The different tracks (informational vs. standard) that are currently intend= ed for the two drafts are a potential problem, on which I'll defer to Sean (AD), noting th= at Brian's message below reproduces all of the normative text in the iodef-xmlreg draf= t (2 sentences). Thanks, --David ________________________________________ From: mile-bounces@ietf.org [mile-bounces@ietf.org] On Behalf Of Brian Tram= mell [trammell@tik.ee.ethz.ch] Sent: Wednesday, October 26, 2011 3:23 AM To: mile@ietf.org Subject: [mile] Documents for consideration as MILE WG items Greetings, all, and welcome to the MILE working group! As a contributor, I'd like to put forward three documents for consideration= as working group items under the initial charter; these are all relatively= lightweight, and I believe should be easy to come to agreement on. 1. For * An informational template for extensions to IODEF: "Guidelines for Extensions to IODEF for Managed Incident Lightweight Exchan= ge" http://tools.ietf.org/html/draft-trammell-mile-template This is an informational document primarily intended to speed the work of t= he MILE WG itself. It contains an Internet-Draft template for IODEF extensi= ons. 2. For * A Standards Track document for IODEF Extensions in IANA XML Regist= ry: "Expert Review for IODEF Extensions in IANA XML Registry" http://tools.ietf.org/html/draft-trammell-mile-iodef-xmlreg This is a housekeeping and process document, which specifies a change to IO= DEF-related XML schema registrations in order to ensure an expert review of= those schemas. It's really short; indeed, I'll quote the important part of= the document here: Changes to the XML Schema registry for schema names beginning with "urn:ietf:params:xml:schema:iodef" are subject to an additional IODEF Expert Review [RFC5226]. The IODEF expert(s) for these reviews will be designated by the IETF Security Area Directors. 3. For * A Standards Track document specifying the transport for RID: "Transport of Real-time Inter-network Defense (RID) Messages" http://tools.ietf.org/html/draft-trammell-mile-rfc6046-bis This document is a straight update of RFC6046, making minor editorial chang= es and updating its status to Standards Track; there are no substantive tec= hnical changes from the HTTP-based protocol specified in RFC6046. As a contributor, I'd appreciate comments to the list on these documents by= 2 November, stating whether you support the documents for adoption as WG i= tems, and whether you would be willing to review them. (Okay, if you've rea= d this message this far, you've essentially already reviewed mile-iodef-xml= reg, but the other two could use a critical eye.) After 2 November, Kathleen will hold a consensus call on these documents. Many thanks, and best regards, Brian _______________________________________________ mile mailing list mile@ietf.org https://www.ietf.org/mailman/listinfo/mile= From takeshi_takahashi@nict.go.jp Sat Oct 29 22:29:22 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E344721F846C for ; Sat, 29 Oct 2011 22:29:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.355 X-Spam-Level: X-Spam-Status: No, score=-1.355 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_JP=1.244] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1zIha9pR-g2d for ; Sat, 29 Oct 2011 22:29:22 -0700 (PDT) Received: from ns1.nict.go.jp (ns1.nict.go.jp [IPv6:2001:df0:232:300::1]) by ietfa.amsl.com (Postfix) with ESMTP id 455A621F8449 for ; Sat, 29 Oct 2011 22:29:21 -0700 (PDT) Received: from gw1.nict.go.jp (gw1 [133.243.18.250]) by ns1.nict.go.jp with ESMTP id p9U5TKw8018178 for ; Sun, 30 Oct 2011 14:29:20 +0900 (JST) Received: from gw1.nict.go.jp (localhost [127.0.0.1]) by gw1.nict.go.jp with ESMTP id p9U5TKNc000839 for ; Sun, 30 Oct 2011 14:29:20 +0900 (JST) Received: from mail2.nict.go.jp (mail.nict.go.jp [133.243.18.3]) by gw1.nict.go.jp with ESMTP id p9U5TKc5000836 for ; Sun, 30 Oct 2011 14:29:20 +0900 (JST) Received: from mail2.nict.go.jp (localhost [127.0.0.1]) by mail2.nict.go.jp (NICT Mail) with ESMTP id 62DB62C514 for ; Sun, 30 Oct 2011 14:29:20 +0900 (JST) Received: from TakeVAIO (unknown [133.243.119.172]) by mail2.nict.go.jp (NICT Mail) with ESMTP id 5E5C62C4EF for ; Sun, 30 Oct 2011 14:29:20 +0900 (JST) From: "Takeshi Takahashi" To: Date: Sun, 30 Oct 2011 14:29:20 +0900 Message-ID: <000101cc96c4$dfed77a0$9fc866e0$@nict.go.jp> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AcyWxJZZwVpV8aiySai6ywMQ/aXFoA== Content-Language: ja Subject: [mile] Fw: New Version Notification for draft-takahashi-mile-sci-02.txt X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Oct 2011 05:29:23 -0000 Hello all, The new version of our draft is available online. http://tools.ietf.org/html/draft-takahashi-mile-sci-02 The major change to previous version is its schema. I would appreciate any comments on this draft. Thank you. Take 2011/10/29 : > A new version of I-D, draft-takahashi-mile-sci-02.txt has been successfully > submitted by Takeshi Takahashi and posted to the IETF repository. > > Filename: draft-takahashi-mile-sci > Revision: 02 > Title: IODEF-extension to support structured cybersecurity information > Creation date: 2011-10-29 > WG ID: Individual Submission > Number of pages: 26 > > Abstract: > This document extends the Incident Object Description Exchange Format > (IODEF) defined in RFC 5070 [RFC5070] to facilitate enriched > cybersecurity information exchange among cybersecurity entities by > embedding structured information formatted by specifications, > including CAPEC[TM] [CAPEC], CEE[TM] [CEE], CPE[TM] [CPE], CVE(R) > [CVE], CVRF [CVRF], CVSS [CVSS], CWE[TM] [CWE], CWSS[TM] [CWSS], ISO/ > IEC 19770-2 [ISOIEC19770-2], OCIL [OCIL], OVAL(R) [OVAL], XCCDF > [XCCDF], and XDAS [XDAS]. > > > > > The IETF Secretariat > From trammell@tik.ee.ethz.ch Sun Oct 30 01:35:51 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1474A21F8509 for ; Sun, 30 Oct 2011 01:35:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SBYpQoTwXN0f for ; Sun, 30 Oct 2011 01:35:50 -0700 (PDT) Received: from smtp.ee.ethz.ch (smtp.ee.ethz.ch [129.132.2.219]) by ietfa.amsl.com (Postfix) with ESMTP id 1235021F84B1 for ; Sun, 30 Oct 2011 01:35:49 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by smtp.ee.ethz.ch (Postfix) with ESMTP id 6A37CD9305; Sun, 30 Oct 2011 09:35:48 +0100 (MET) X-Virus-Scanned: by amavisd-new on smtp.ee.ethz.ch Received: from smtp.ee.ethz.ch ([127.0.0.1]) by localhost (.ee.ethz.ch [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Nd3o3OjnOJl3; Sun, 30 Oct 2011 09:35:48 +0100 (MET) Received: from [10.0.1.2] (cust-integra-121-161.antanet.ch [80.75.121.161]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: briant) by smtp.ee.ethz.ch (Postfix) with ESMTPSA id E4048D9303; Sun, 30 Oct 2011 09:35:47 +0100 (MET) Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Brian Trammell In-Reply-To: <7C4DFCE962635144B8FAE8CA11D0BF1E058CE79952@MX14A.corp.emc.com> Date: Sun, 30 Oct 2011 09:35:46 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: References: <7C4DFCE962635144B8FAE8CA11D0BF1E058CE79952@MX14A.corp.emc.com> To: "david.black@emc.com> , Sean Turner X-Mailer: Apple Mail (2.1084) Cc: mile@ietf.org Subject: Re: [mile] Documents for consideration as MILE WG items X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Oct 2011 08:35:51 -0000 Hi, David, Thanks for the comments! An excellent point on the template and = iodef-xmlreg... Indeed, the primary reason that these _are_ two drafts = is to address the situation that a document template is clearly = Informational: a Standards Track document with what is essentially a = convenience template for other documents might be incorrectly read as = process to further standardize the form of MILE documents, which is 1. = not the intention and 2. IMO a bad idea for its inflexibility. I had assumed after discussion with IANA that changes to the IANA XML = Registry itself, or the process for handling it, would require a = Standards Track document. Practically speaking, the change would be = implemented with a note added to the top of the Registry noting that any = registration of an IODEF-relevant schema would require additional Expert = Review. However, looking at 3688, the BCP that defines the registry, it = is probably sufficient to update it with a BCP, and a BCP status for the = template is not at all inappropriate IMO. Will also wait for Sean's = guidance on this point, but it would be possible to get such an -02 of = mile-template out before the Taipei cutoff, especially given that the = new text in the template would be half the length of this message. :) Thanks again, and best regards, Brian On Oct 30, 2011, at 3:03 AM, = wrote: > Brian, >=20 > To state the obvious, the 6046bis draft (RID transport) should clearly = be adopted by > the WG, as it will need to be normatively referenced by Kathleen's = 6045bis draft (RID), > and both should be published as RFCs together. >=20 > I wonder whether it would be possible to combine the other two drafts = into one, > as the iodef-xmlreg draft is effectively the actual IANA = considerations for the use of > the IODEF template. If the drafts are combined, it's still possible = to have those IANA > considerations apply to all IODEF extensions, not just those that use = the template. >=20 > The different tracks (informational vs. standard) that are currently = intended for the two > drafts are a potential problem, on which I'll defer to Sean (AD), = noting that Brian's > message below reproduces all of the normative text in the iodef-xmlreg = draft (2 sentences). >=20 > Thanks, > --David > ________________________________________ > From: mile-bounces@ietf.org [mile-bounces@ietf.org] On Behalf Of Brian = Trammell [trammell@tik.ee.ethz.ch] > Sent: Wednesday, October 26, 2011 3:23 AM > To: mile@ietf.org > Subject: [mile] Documents for consideration as MILE WG items >=20 > Greetings, all, and welcome to the MILE working group! >=20 > As a contributor, I'd like to put forward three documents for = consideration as working group items under the initial charter; these = are all relatively lightweight, and I believe should be easy to come to = agreement on. >=20 >=20 > 1. For * An informational template for extensions to IODEF: >=20 > "Guidelines for Extensions to IODEF for Managed Incident Lightweight = Exchange" > http://tools.ietf.org/html/draft-trammell-mile-template >=20 > This is an informational document primarily intended to speed the work = of the MILE WG itself. It contains an Internet-Draft template for IODEF = extensions. >=20 >=20 > 2. For * A Standards Track document for IODEF Extensions in IANA XML = Registry: >=20 > "Expert Review for IODEF Extensions in IANA XML Registry" > http://tools.ietf.org/html/draft-trammell-mile-iodef-xmlreg >=20 > This is a housekeeping and process document, which specifies a change = to IODEF-related XML schema registrations in order to ensure an expert = review of those schemas. It's really short; indeed, I'll quote the = important part of the document here: >=20 > Changes to the XML Schema registry for schema names beginning with > "urn:ietf:params:xml:schema:iodef" are subject to an additional = IODEF > Expert Review [RFC5226]. >=20 > The IODEF expert(s) for these reviews will be designated by the IETF > Security Area Directors. >=20 >=20 > 3. For * A Standards Track document specifying the transport for RID: >=20 > "Transport of Real-time Inter-network Defense (RID) Messages" > http://tools.ietf.org/html/draft-trammell-mile-rfc6046-bis >=20 > This document is a straight update of RFC6046, making minor editorial = changes and updating its status to Standards Track; there are no = substantive technical changes from the HTTP-based protocol specified in = RFC6046. >=20 >=20 > As a contributor, I'd appreciate comments to the list on these = documents by 2 November, stating whether you support the documents for = adoption as WG items, and whether you would be willing to review them. = (Okay, if you've read this message this far, you've essentially already = reviewed mile-iodef-xmlreg, but the other two could use a critical eye.) >=20 > After 2 November, Kathleen will hold a consensus call on these = documents. >=20 > Many thanks, and best regards, >=20 > Brian > _______________________________________________ > mile mailing list > mile@ietf.org > https://www.ietf.org/mailman/listinfo/mile From david.black@emc.com Sun Oct 30 12:17:33 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4A9421F8B02 for ; Sun, 30 Oct 2011 12:17:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.013 X-Spam-Level: X-Spam-Status: No, score=-106.013 tagged_above=-999 required=5 tests=[AWL=0.586, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1e2-1wUIAWWz for ; Sun, 30 Oct 2011 12:17:33 -0700 (PDT) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by ietfa.amsl.com (Postfix) with ESMTP id C609921F8AF2 for ; Sun, 30 Oct 2011 12:17:32 -0700 (PDT) Received: from hop04-l1d11-si02.isus.emc.com (HOP04-L1D11-SI02.isus.emc.com [10.254.111.55]) by mexforward.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9UJHU5V021068 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 30 Oct 2011 15:17:30 -0400 Received: from mailhub.lss.emc.com (mailhubhoprd04.lss.emc.com [10.254.222.226]) by hop04-l1d11-si02.isus.emc.com (RSA Interceptor); Sun, 30 Oct 2011 15:17:20 -0400 Received: from mxhub15.corp.emc.com (mxhub15.corp.emc.com [128.221.56.104]) by mailhub.lss.emc.com (Switch-3.4.3/Switch-3.4.3) with ESMTP id p9UJHJOt004241; Sun, 30 Oct 2011 15:17:19 -0400 Received: from mx14a.corp.emc.com ([169.254.1.78]) by mxhub15.corp.emc.com ([128.221.56.104]) with mapi; Sun, 30 Oct 2011 15:17:18 -0400 From: To: , Date: Sun, 30 Oct 2011 15:17:17 -0400 Thread-Topic: [mile] Documents for consideration as MILE WG items Thread-Index: AcyW3xc1A/d+pP8jSuecJJtnKgz0ggAVrwmg Message-ID: <7C4DFCE962635144B8FAE8CA11D0BF1E058D0F02A5@MX14A.corp.emc.com> References: <7C4DFCE962635144B8FAE8CA11D0BF1E058CE79952@MX14A.corp.emc.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-EMM-MHVC: 1 Cc: mile@ietf.org Subject: Re: [mile] Documents for consideration as MILE WG items X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Oct 2011 19:17:33 -0000 Hi Brian, > Thanks for the comments! An excellent point on the template and iodef-xml= reg... Indeed, the primary > reason that these _are_ two drafts is to address the situation that a doc= ument template is clearly > Informational: a Standards Track document with what is essentially a conv= enience template for other > documents might be incorrectly read as process to further standardize the= form of MILE documents, > which is 1. not the intention and 2. IMO a bad idea for its inflexibility= . Hmm - the following sentence in section 4 may need some tweaking to align w= ith that intention: Documents describing an IODEF extension should follow the document template given in this section. > I had assumed after discussion with IANA that changes to the IANA XML Reg= istry itself, or the process > for handling it, would require a Standards Track document. Practically sp= eaking, the change would be > implemented with a note added to the top of the Registry noting that any = registration of an IODEF- > relevant schema would require additional Expert Review. However, looking = at 3688, the BCP that defines > the registry, it is probably sufficient to update it with a BCP, and a BC= P status for the template is > not at all inappropriate IMO. That sounds promising - a BCP is a standards-track document, and I agree th= at sections 2 and 3 of the mile-template draft look like BCP material. Ther= e should be no problem putting the template itself into an informative appe= ndix of a BCP, and doing so may improve the document structure (e.g., reduc= es the opportunity to confuse the template's IANA Considerations section wi= th the enclosing draft's IANA Considerations section). It may also make se= nse to add a section to the draft with strong recommendations (SHOULD) on w= hat to include as part of specifying an IODEF extension, independent of whe= ther the template is used or not. That said, I would *definitely* wait for Sean's guidance. With mile not me= eting until late Wednesday in Taipei, a -02 version could be submitted when= submissions reopen on Monday. Thanks, --David > -----Original Message----- > From: Brian Trammell [mailto:trammell@tik.ee.ethz.ch] > Sent: Sunday, October 30, 2011 4:36 AM > To: Black, David; Sean Turner > Cc: mile@ietf.org > Subject: Re: [mile] Documents for consideration as MILE WG items >=20 > Hi, David, >=20 > Thanks for the comments! An excellent point on the template and iodef-xml= reg... Indeed, the primary > reason that these _are_ two drafts is to address the situation that a doc= ument template is clearly > Informational: a Standards Track document with what is essentially a conv= enience template for other > documents might be incorrectly read as process to further standardize the= form of MILE documents, > which is 1. not the intention and 2. IMO a bad idea for its inflexibility= . >=20 > I had assumed after discussion with IANA that changes to the IANA XML Reg= istry itself, or the process > for handling it, would require a Standards Track document. Practically sp= eaking, the change would be > implemented with a note added to the top of the Registry noting that any = registration of an IODEF- > relevant schema would require additional Expert Review. However, looking = at 3688, the BCP that defines > the registry, it is probably sufficient to update it with a BCP, and a BC= P status for the template is > not at all inappropriate IMO. Will also wait for Sean's guidance on this = point, but it would be > possible to get such an -02 of mile-template out before the Taipei cutoff= , especially given that the > new text in the template would be half the length of this message. :) >=20 > Thanks again, and best regards, >=20 > Brian >=20 > On Oct 30, 2011, at 3:03 AM, = wrote: >=20 > > Brian, > > > > To state the obvious, the 6046bis draft (RID transport) should clearly = be adopted by > > the WG, as it will need to be normatively referenced by Kathleen's 6045= bis draft (RID), > > and both should be published as RFCs together. > > > > I wonder whether it would be possible to combine the other two drafts i= nto one, > > as the iodef-xmlreg draft is effectively the actual IANA considerations= for the use of > > the IODEF template. If the drafts are combined, it's still possible to= have those IANA > > considerations apply to all IODEF extensions, not just those that use t= he template. > > > > The different tracks (informational vs. standard) that are currently in= tended for the two > > drafts are a potential problem, on which I'll defer to Sean (AD), notin= g that Brian's > > message below reproduces all of the normative text in the iodef-xmlreg = draft (2 sentences). > > > > Thanks, > > --David > > ________________________________________ > > From: mile-bounces@ietf.org [mile-bounces@ietf.org] On Behalf Of Brian = Trammell > [trammell@tik.ee.ethz.ch] > > Sent: Wednesday, October 26, 2011 3:23 AM > > To: mile@ietf.org > > Subject: [mile] Documents for consideration as MILE WG items > > > > Greetings, all, and welcome to the MILE working group! > > > > As a contributor, I'd like to put forward three documents for considera= tion as working group items > under the initial charter; these are all relatively lightweight, and I be= lieve should be easy to come > to agreement on. > > > > > > 1. For * An informational template for extensions to IODEF: > > > > "Guidelines for Extensions to IODEF for Managed Incident Lightweight Ex= change" > > http://tools.ietf.org/html/draft-trammell-mile-template > > > > This is an informational document primarily intended to speed the work = of the MILE WG itself. It > contains an Internet-Draft template for IODEF extensions. > > > > > > 2. For * A Standards Track document for IODEF Extensions in IANA XML Re= gistry: > > > > "Expert Review for IODEF Extensions in IANA XML Registry" > > http://tools.ietf.org/html/draft-trammell-mile-iodef-xmlreg > > > > This is a housekeeping and process document, which specifies a change t= o IODEF-related XML schema > registrations in order to ensure an expert review of those schemas. It's = really short; indeed, I'll > quote the important part of the document here: > > > > Changes to the XML Schema registry for schema names beginning with > > "urn:ietf:params:xml:schema:iodef" are subject to an additional IODEF > > Expert Review [RFC5226]. > > > > The IODEF expert(s) for these reviews will be designated by the IETF > > Security Area Directors. > > > > > > 3. For * A Standards Track document specifying the transport for RID: > > > > "Transport of Real-time Inter-network Defense (RID) Messages" > > http://tools.ietf.org/html/draft-trammell-mile-rfc6046-bis > > > > This document is a straight update of RFC6046, making minor editorial c= hanges and updating its > status to Standards Track; there are no substantive technical changes fro= m the HTTP-based protocol > specified in RFC6046. > > > > > > As a contributor, I'd appreciate comments to the list on these document= s by 2 November, stating > whether you support the documents for adoption as WG items, and whether y= ou would be willing to review > them. (Okay, if you've read this message this far, you've essentially alr= eady reviewed mile-iodef- > xmlreg, but the other two could use a critical eye.) > > > > After 2 November, Kathleen will hold a consensus call on these document= s. > > > > Many thanks, and best regards, > > > > Brian > > _______________________________________________ > > mile mailing list > > mile@ietf.org > > https://www.ietf.org/mailman/listinfo/mile >=20 From trammell@tik.ee.ethz.ch Mon Oct 31 00:14:58 2011 Return-Path: X-Original-To: mile@ietfa.amsl.com Delivered-To: mile@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A48021F8CB2 for ; Mon, 31 Oct 2011 00:14:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aVOQnE7Is4HU for ; Mon, 31 Oct 2011 00:14:55 -0700 (PDT) Received: from smtp.ee.ethz.ch (smtp.ee.ethz.ch [129.132.2.219]) by ietfa.amsl.com (Postfix) with ESMTP id A8E4C21F86A4 for ; Mon, 31 Oct 2011 00:14:52 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by smtp.ee.ethz.ch (Postfix) with ESMTP id 82687D931D for ; Mon, 31 Oct 2011 08:14:50 +0100 (MET) X-Virus-Scanned: by amavisd-new on smtp.ee.ethz.ch Received: from smtp.ee.ethz.ch ([127.0.0.1]) by localhost (.ee.ethz.ch [127.0.0.1]) (amavisd-new, port 10024) with LMTP id wypYazaLPfMy for ; Mon, 31 Oct 2011 08:14:50 +0100 (MET) Received: from [10.0.1.2] (cust-integra-121-161.antanet.ch [80.75.121.161]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: briant) by smtp.ee.ethz.ch (Postfix) with ESMTPSA id 25CE7D931A for ; Mon, 31 Oct 2011 08:14:50 +0100 (MET) From: Brian Trammell Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Mon, 31 Oct 2011 08:14:49 +0100 Message-Id: <93415E8A-9C38-4CF1-A965-A9143C556CCB@tik.ee.ethz.ch> To: mile@ietf.org Mime-Version: 1.0 (Apple Message framework v1084) X-Mailer: Apple Mail (2.1084) Subject: [mile] DRAFT WG Agenda for IETF 82, Taipei X-BeenThere: mile@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Oct 2011 07:14:58 -0000 Greetings, all, Please see the draft agenda for the MILE meeting in Taipei. If you have = any comments or proposed changes, please send them to the list.=20 Document authors, please indicate whether you're planning on presenting = anything on your document; this will allow us to better manage the short = time slot we have for discussion.=20 Many thanks, Brian =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D Managed Incident Lightweight Exchange (mile) Working Group DRAFT Agenda for IETF 82, Taipei Wednesday 16 November 2011, 15:10-16:10 TICC Room 101D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D Chairs: Kathleen Moriarty Brian Trammell AGENDA: 1. Agenda-bashing =3D 5 min 2. Introduction and WG Status =3D 10 min (K. Moriarty/B. Trammell) 3. Drafts under consideration as MILE WG items =3D 30 min As the drafts have been introduced and discussed on the list, presentations in this section should focus on open issues in these documents, if any. Documents with no open issues need not be presented, but may be discussed. Please note the short time slot for these (30'), and prepare your presentations/comments accordingly. RID and RID-Transport updates draft-moriarty-mile-rfc6045-bis-02 (K. Moriarty) draft-trammell-mile-rfc6046-bis-01 (B. Trammell) =20 IODEF-extension to support structured cybersecurity=20 information draft-takahashi-mile-sci-02 (T. Takahashi) Data markers draft (untitled) draft-goodier-mile-data-markers-00 (K. Goodier) GRC Report Exchange draft-moriarty-mile-grc-exchange-01 (K. Moriarty) Expert Review for IODEF Extensions in IANA XML Registry draft-trammell-mile-iodef-xmlreg-00 (B. Trammell) Guidelines for Extensions to IODEF for Managed Incident Lightweight Exchange draft-trammell-mile-template-01 (B. Trammell) 4. Adoption of MILE WG items =3D 10 min A consensus call will be held for any drafts under=20 consideration as WG items for which have not yet been adopted as of the meeting. 5. Other MILE related drafts / AOB =3D 5 min IODEF Extension to Support Mail Abuse Reporting draft-vesely-mile-mail-abuse-00 (A. Vesely) Remote participation is available... - via Meetecho=20 (see http://ietf82.conf.meetecho.com/)=20 - via audio streaming=20 (see http://www.ietf.org/meeting/82/remote-participation.html#audio) - via jabber=20 (mile@jabber.ietf.org) Remote participants, please note that the meeting takes place in UTC+8,=20= i.e. 07:10-08:10 UTC Wednesday 16 November 2011. Presentation slides will be available at = https://datatracker.ietf.org/public/meeting_materials.cgi?meeting_num=3D82= (search for MILE in the Security Area)