From nobody Thu Mar  2 22:29:01 2017
Return-Path: <takeshi_takahashi@nict.go.jp>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D33CE129736 for <mile@ietfa.amsl.com>; Thu,  2 Mar 2017 22:28:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ofi2mIT8RoOi for <mile@ietfa.amsl.com>; Thu,  2 Mar 2017 22:28:57 -0800 (PST)
Received: from ns2.nict.go.jp (ns2.nict.go.jp [IPv6:2001:df0:232:300::2]) by ietfa.amsl.com (Postfix) with ESMTP id ACF541296FA for <mile@ietf.org>; Thu,  2 Mar 2017 22:28:57 -0800 (PST)
Received: from gw2.nict.go.jp (gw2.nict.go.jp [133.243.18.251]) by ns2.nict.go.jp  with ESMTP id v236SrFQ026119; Fri, 3 Mar 2017 15:28:53 +0900 (JST)
Received: from mail2.nict.go.jp (mail2.nict.go.jp [133.243.18.15]) by gw2.nict.go.jp  with ESMTP id v236SrBu026116; Fri, 3 Mar 2017 15:28:53 +0900 (JST)
Received: from VAIO (unknown [133.243.28.221]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail2.nict.go.jp (NICT Mail Spool Server2) with ESMTPS id 508419DA5; Fri,  3 Mar 2017 15:28:53 +0900 (JST)
From: "Takeshi Takahashi" <takeshi_takahashi@nict.go.jp>
To: "'Panos Kampanakis \(pkampana\)'" <pkampana@cisco.com>, "'Banghart, Stephen A. \(Fed\)'" <stephen.banghart@nist.gov>, <mile@ietf.org>, <alexey.melnikov@isode.com>
References: <SN1PR09MB0960603877E8415F6A3A8D0AF0840@SN1PR09MB0960.namprd09.prod.outlook.com> <2b5ba8381eea42549686cfe6c5e63bf3@XCH-ALN-010.cisco.com>
In-Reply-To: <2b5ba8381eea42549686cfe6c5e63bf3@XCH-ALN-010.cisco.com>
Date: Fri, 3 Mar 2017 15:28:52 +0900
Message-ID: <01bc01d293e7$6d1a3c10$474eb430$@nict.go.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQHfC+EUyWppBbk3sZNwfEoFaELDXgGugcTCoVw5tPA=
Content-Language: ja
X-Virus-Scanned: clamav-milter 0.98.7 at zenith2
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/6pCe2ZylJZmQIimNqZGSjqtDLfE>
Subject: Re: [mile] ROLIE Service and Category Document Location Issue
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 03 Mar 2017 06:29:00 -0000

Hi Stephen,

I like the option A, but let me ask a clarification questions.
In some cases, I've seen a description like the followings in the header
section of an HTML page:

Case 1:
<link rel=3D"alternate" type=3D"application/atom+xml" title=3D"Feed for =
question
&#39;How To Tell Web Browsers About Atom Feeds&#39;"
href=3D"/feeds/question/440391">

Case 2:
<link rel=3D"service" type=3D"application/atomsvc+xml"
href=3D"http://www.example.org/atomsvc.xml" />
<link rel=3D"service" class=3D"preferred" =
type=3D"application/atomsvc+xml"
href=3D"http://www.example.org/atomsvc.xml" />

I think these descriptions try to identify the location of the service
documents.
If we find such a description, and if it points to a location that is =
not
the well-known location, are we going to use the pointed location, or =
are we
going to use the well-known location?

Thank you,
Take



From: mile [mailto:mile-bounces@ietf.org] On Behalf Of Panos Kampanakis
(pkampana)
Sent: Wednesday, January 4, 2017 1:24 AM
To: Banghart, Stephen A. (Fed); mile@ietf.org; alexey.melnikov@isode.com
Subject: Re: [mile] ROLIE Service and Category Document Location Issue

+1 on A.=A0 As someone mentioned in IETF97, the /.well-known directory =
is
commonly used in many other occasions. For ROLIE, a
/.well-known/rolie/servicedoc or repositorydoc URI would suffice I =
think.=20
Panos

From: mile [mailto:mile-bounces@ietf.org] On Behalf Of Banghart, Stephen =
A.
(Fed)
Sent: Thursday, December 08, 2016 4:07 PM
To: mile@ietf.org; alexey.melnikov@isode.com
Subject: [mile] ROLIE Service and Category Document Location Issue

As requested at the IETF 97 MILE meeting, I=92ve put together some Use =
Case
examples of using service and category documents that highlight the =
primary
differences between the choices for this issue. Those options are:

A: Require that ROLIE repositories place the Service and Category =
documents
in a pre-determined location based on a standardized URL template. This
location may be a link or redirect to the actual location.
B: ROLIE repositories are not required to place their Service and =
Category
documents at a pre-determined location.

The use cases below highlight the need for a well-defined location for =
the
service and category documents to support automated discovery. The use =
cases
illustrate that option B is not really an option if our goal is to =
support
automated discovery and use of ROLIE repositories. Feedback on the
approaches described below would be appreciated. If you are not a fan of
using well-defined URL templates, then alternate proposals that support
these automation use cases would also be appreciated.
Thanks,
Stephen Banghart

Defined Service Document and Category Document Location Examples
Service Document
Use Case: A ROLIE user agent becomes aware of a host
(examplesecurityorg.com) that hosts a ROLIE repository. The host is
identified by some means, such as by DNS Service Record lookup. However, =
as
the agent only knows the server host name, the agent knows neither the
location of the ROLIE feeds nor information about a given feed=92s =
contents.=20
Goal: In order to locate the feeds, the operator must find the Atom =
service
document located somewhere on the server.=20
With Defined Location: If the user agent sends a GET request to
=93https://examplesecurityorg.com/rolie/servicedocument=94, as this is =
the
pre-specified location. This is handled on the server as a redirect to =
its
preferred service document location:
=93https://examplesecurityorg.com/1234/sec/srvdoc=94.
Without Defined Location: The agent must manually search the =
front-facing
section of the site, looking for a stated Atom service document =
location.
Failing that search, the operator must search website documentation or
contact admins of the site and request the URL. Neither of these methods
support automation and require human interaction. If the URL can be
identified using these manual methods, , the agent can now send a GET
request to =93https://examplesecurityorg.com/1234/sec/srvdoc=94 to =
retrieve the
service document.
This use case is best supported if the ROLIE repository contents can be
discovered in an automatable way. A well-defined location for the =
service
document provides a predictable means for collection discovery as long =
as
the host name of the ROLIE repository is known.=20
Category Document
Use Case: A ROLIE user agent wants to programmatically populate a list =
that
contains all of the categories provided by a ROLIE repository. The =
category
list will be used to generate search queries tailored to this =
repository, as
the repository may be using any number of global or local categories, =
such
as information-type. This ROLIE repository is also configured to only =
allow
POST requests if they belong to one of the categories specified in the
category document. If the user agent intends to write to this repository =
it
must locate the category document.
=A0Goal: The tool needs to know the full list of categories supported by =
the
repository.
With Defined Location: The user agent sends a get request to
=93https://examplesecurityorg.com/rolie/categorydocument=94, and parses =
it to
generate a full list of supported categories. This is handled on the =
server
as a redirect to its preferred category document location:
=93https://examplesecurityorg.com/1234/sec/catdoc=94.
Without Defined Location: If the user agent is only interested in the
currently provided categories, it must parse all feeds provided by the
repository to generate a list. This activity must be repeated on every
connection, incurring a heavy performance and bandwidth cost.=20
If the user agent intends to write to the repository, it must manually
search the front-facing section of the site, looking for a stated Atom
category document location. Failing that search, the operator must =
contact
admins of the site and request the URL. Neither of these methods support
automation and require human interaction. Having completed this task, =
the
agent can now send a GET request to
=93https://examplesecurityorg.com/1234/sec/catdoc=94.
Having a well-defined location for the category document can simplify =
and
optimize category information discovery.



From nobody Thu Mar  2 22:46:27 2017
Return-Path: <takeshi_takahashi@nict.go.jp>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 227B312979D for <mile@ietfa.amsl.com>; Thu,  2 Mar 2017 22:46:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iMQ7WurYNQZK for <mile@ietfa.amsl.com>; Thu,  2 Mar 2017 22:46:23 -0800 (PST)
Received: from ns2.nict.go.jp (ns2.nict.go.jp [IPv6:2001:df0:232:300::2]) by ietfa.amsl.com (Postfix) with ESMTP id 4B9C4129793 for <mile@ietf.org>; Thu,  2 Mar 2017 22:46:23 -0800 (PST)
Received: from gw2.nict.go.jp (gw2.nict.go.jp [133.243.18.251]) by ns2.nict.go.jp  with ESMTP id v236kJ6M045109; Fri, 3 Mar 2017 15:46:19 +0900 (JST)
Received: from VAIO (ssh1.nict.go.jp [133.243.3.49]) by gw2.nict.go.jp  with ESMTP id v236kJvK045086; Fri, 3 Mar 2017 15:46:19 +0900 (JST)
From: "Takeshi Takahashi" <takeshi_takahashi@nict.go.jp>
To: "'Panos Kampanakis \(pkampana\)'" <pkampana@cisco.com>, "'Banghart, Stephen A. \(Fed\)'" <stephen.banghart@nist.gov>, <mile@ietf.org>
References: <SN1PR09MB09602C26522BDBDEFD9C9235F0980@SN1PR09MB0960.namprd09.prod.outlook.com> <c23b982531134738af5b6fc7efc040ce@XCH-ALN-010.cisco.com>
In-Reply-To: <c23b982531134738af5b6fc7efc040ce@XCH-ALN-010.cisco.com>
Date: Fri, 3 Mar 2017 15:46:18 +0900
Message-ID: <023501d293e9$dcc9ee50$965dcaf0$@nict.go.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQFVls7gm16Ptqc2cBMzE2InwYTCIgIkpUKYomuAvuA=
Content-Language: ja
X-Virus-Scanned: clamav-milter 0.98.7 at zenith2
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/2gwGRxVnUl21r3gmF3182zQVKsg>
Subject: Re: [mile] ROLIE Data Model Enumeration
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 03 Mar 2017 06:46:25 -0000

+1 to the proposal and to Panos's comment.

Thank you,
Take

From: mile [mailto:mile-bounces@ietf.org] On Behalf Of Panos Kampanakis
(pkampana)
Sent: Wednesday, January 4, 2017 1:18 AM
To: Banghart, Stephen A. (Fed); mile@ietf.org
Subject: Re: [mile] ROLIE Data Model Enumeration

Happy New Year to everyone!=20

+1. I think registering formats will be challenging and could slow down
adopters.
I think it would be beneficial if the ROLIE draft included text for an
example representation in section 6.2.3 though. The IODEFv2 XML schema =
could
be one example.=20

Panos


From: mile [mailto:mile-bounces@ietf.org] On Behalf Of Banghart, Stephen =
A.
(Fed)
Sent: Monday, December 12, 2016 11:01 AM
To: mile@ietf.org
Subject: [mile] ROLIE Data Model Enumeration

All,
=9A
The other issue discussed at the IETF 97 MILE meeting was the =
Enumeration
and Registration of Data Models.
=9A
Data model enumeration/registration would involve requiring extension
documents to register their supported data models for a given =
information
type with IANA.
=9A
Pros:
=81=9A=9A=9A=9A=9A=9A Provides one location that lists all officially =
registered data
formats.
Cons:
=81=9A=9A=9A=9A=9A=9A Requires document authors to choose (often =
arbitrarily!) and
register data format namespaces
=81=9A=9A=9A=9A=9A=9A Registered identifiers don't help implementations =
understand data
formats, and if chosen arbitrarily may not even help identify the format =
in
a way that is meaningful to clients.
=81=9A=9A=9A=9A=9A=9A Provides no additional automation support.
=81=9A=9A=9A=9A=9A=9A Increases work load on extension authors
=81=9A=9A=9A=9A=9A=9A Extensions must provide IANA considerations =
section that specifies
data model registration and perhaps an additional table for the data =
models.
=81=9A=9A=9A=9A=9A=9A Extensions must have a separate section describing =
the data model in
addition to the IANA consideration
=9A
Proposal:
=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A=9A Do not require data format =
registration in extension drafts.
This does not preclude an extension from establishing a registry for
supported data models if needed. Extension specifications may =
additionally
discuss the data models intended to be used for a given information =
type. We
believe this provides for adequate coverage of the model namespaces to =
be
used in the extension specification, without requiring the extra burden =
of
dealing with IANA considerations for models.
=9A
Any feedback on this proposal? I personally feel like requiring =
registration
is not worth the price.
=9A
Thanks,
Stephen Banghart


From nobody Fri Mar  3 16:00:09 2017
Return-Path: <agenda@ietf.org>
X-Original-To: mile@ietf.org
Delivered-To: mile@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8603D129A0F; Fri,  3 Mar 2017 15:55:31 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: "\"IETF Secretariat\"" <agenda@ietf.org>
To: <smccammon@amsl.com>, <mile-chairs@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.46.1
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <148858533154.15846.1523664263673741495.idtracker@ietfa.amsl.com>
Date: Fri, 03 Mar 2017 15:55:31 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/U8NujDzSmxVzTePesJZq6qu9roY>
Cc: mile@ietf.org
Subject: [mile] mile - Requested session has been scheduled for IETF 98
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.17
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 03 Mar 2017 23:55:31 -0000

Dear Stephanie McCammon,

The session(s) that you have requested have been scheduled.
Below is the scheduled session information followed by
the original request. 

mile Session 1 (1:00:00)
    Monday, Afternoon Session II 1520-1650
    Room Name: Montreux 3 size: 80
    ---------------------------------------------
    


Request Information:


---------------------------------------------------------
Working Group Name: Managed Incident Lightweight Exchange
Area Name: Security Area
Session Requester: Stephanie McCammon

Number of Sessions: 1
Length of Session(s):  1 Hour
Number of Attendees: 30
Conflicts to Avoid: 
 First Priority: core anima dots i2nsf ipsecme saag sacm
 Second Priority: 6tisch appsawg httpbis tls



People who must be present:
  Kathleen Moriarty
  Nancy Cam-Winget
  David Waltermire
  Takeshi Takahashi

Resources Requested:
  Meetecho support in room

Special Requests:
  
---------------------------------------------------------


From nobody Tue Mar  7 01:09:44 2017
Return-Path: <takeshi_takahashi@nict.go.jp>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 739EA12940A for <mile@ietfa.amsl.com>; Tue,  7 Mar 2017 01:09:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g1NT1JWaQVMo for <mile@ietfa.amsl.com>; Tue,  7 Mar 2017 01:09:41 -0800 (PST)
Received: from ns1.nict.go.jp (ns1.nict.go.jp [IPv6:2001:df0:232:300::1]) by ietfa.amsl.com (Postfix) with ESMTP id 55990129434 for <mile@ietf.org>; Tue,  7 Mar 2017 01:09:41 -0800 (PST)
Received: from gw1.nict.go.jp (gw1.nict.go.jp [133.243.18.250]) by ns1.nict.go.jp  with ESMTP id v2799dNe020611 for <mile@ietf.org>; Tue, 7 Mar 2017 18:09:40 +0900 (JST)
Received: from VAIO (ssh1.nict.go.jp [133.243.3.49]) by gw1.nict.go.jp  with ESMTP id v2799dAg020606 for <mile@ietf.org>; Tue, 7 Mar 2017 18:09:39 +0900 (JST)
From: "Takeshi Takahashi" <takeshi_takahashi@nict.go.jp>
To: <mile@ietf.org>
Date: Tue, 7 Mar 2017 18:09:39 +0900
Message-ID: <010501d29722$8d0d7f80$a7287e80$@nict.go.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AdKXIfj6iCL9tVmxTsyZPfM/VS1CEA==
Content-Language: ja
X-Virus-Scanned: clamav-milter 0.98.7 at zenith1
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/HMmr31nnj400ke3EB014rHlg42g>
Subject: [mile] MILE session in IETF 98
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Mar 2017 09:09:43 -0000

Hi all,

We will hold our session in IETF98.
Though I do not expect such a lot of agenda this time, it would be nice to
meet up and share the status.

mile Session 1 (1:00:00)
     Monday, Afternoon Session II 1520-1650
     Room Name: Montreux 3 size: 80

Please let us know if you are willing to present your work at the session.
So long as I know, the authors of the guidance draft were planning to ask
the WGLC at the meeting.

Thank you.
Take



> -----Original Message-----
> From: mile [mailto:mile-bounces@ietf.org] On Behalf Of "IETF Secretariat"
> Sent: Saturday, March 4, 2017 8:56 AM
> To: smccammon@amsl.com; mile-chairs@ietf.org
> Cc: mile@ietf.org
> Subject: [mile] mile - Requested session has been scheduled for IETF 98
> 
> Dear Stephanie McCammon,
> 
> The session(s) that you have requested have been scheduled.
> Below is the scheduled session information followed by the original
request.
> 
> mile Session 1 (1:00:00)
>     Monday, Afternoon Session II 1520-1650
>     Room Name: Montreux 3 size: 80
>     ---------------------------------------------
> 
> 
> 
> Request Information:
> 
> 
> ---------------------------------------------------------
> Working Group Name: Managed Incident Lightweight Exchange Area Name:
> Security Area Session Requester: Stephanie McCammon
> 
> Number of Sessions: 1
> Length of Session(s):  1 Hour
> Number of Attendees: 30
> Conflicts to Avoid:
>  First Priority: core anima dots i2nsf ipsecme saag sacm  Second Priority:
> 6tisch appsawg httpbis tls
> 
> 
> 
> People who must be present:
>   Kathleen Moriarty
>   Nancy Cam-Winget
>   David Waltermire
>   Takeshi Takahashi
> 
> Resources Requested:
>   Meetecho support in room
> 
> Special Requests:
> 
> ---------------------------------------------------------
> 
> _______________________________________________
> mile mailing list
> mile@ietf.org
> https://www.ietf.org/mailman/listinfo/mile


From nobody Sun Mar 12 21:40:09 2017
Return-Path: <internet-drafts@ietf.org>
X-Original-To: mile@ietf.org
Delivered-To: mile@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FEDB129511; Sun, 12 Mar 2017 21:40:08 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <i-d-announce@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.47.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <148938000836.24641.5121540165874706197@ietfa.amsl.com>
Date: Sun, 12 Mar 2017 21:40:08 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/vG5t6Sa_4NIDLC_TXElozfeR-Ik>
Cc: mile@ietf.org
Subject: [mile] I-D Action: draft-ietf-mile-iodef-guidance-08.txt
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.17
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Mar 2017 04:40:08 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Managed Incident Lightweight Exchange of the IETF.

        Title           : IODEF Usage Guidance
        Authors         : Panos Kampanakis
                          Mio Suzuki
	Filename        : draft-ietf-mile-iodef-guidance-08.txt
	Pages           : 32
	Date            : 2017-03-12

Abstract:
   The Incident Object Description Exchange Format v2 [RFC7970] defines
   a data representation that provides a framework for sharing
   information commonly exchanged by Computer Security Incident Response
   Teams (CSIRTs) about computer security incidents.  Since the IODEF
   model includes a wealth of available options that can be used to
   describe a security incident or issue, it can be challenging for
   security practitioners to develop tools that can leverage IODEF for
   incident sharing.  This document provides guidelines for IODEF
   practitioners.  It also addresses how common security indicators can
   be represented in IODEF and use-cases of how IODEF is being.  The
   goal of this document is to make IODEF's adoption by vendors easier
   and encourage faster and wider adoption of the model by Computer
   Security Incident Response Teams (CSIRTs) around the world.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-mile-iodef-guidance-08

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-iodef-guidance-08


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Mon Mar 13 13:46:11 2017
Return-Path: <internet-drafts@ietf.org>
X-Original-To: mile@ietf.org
Delivered-To: mile@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 117771294E6; Mon, 13 Mar 2017 13:46:07 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <i-d-announce@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.47.1
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <148943796705.20323.4261954215261863914@ietfa.amsl.com>
Date: Mon, 13 Mar 2017 13:46:07 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/eCFvb9sjkA95Xszorj4-1LM7o7E>
Cc: mile@ietf.org
Subject: [mile] I-D Action: draft-ietf-mile-rolie-06.txt
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.17
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Mar 2017 20:46:07 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Managed Incident Lightweight Exchange of the IETF.

        Title           : Resource-Oriented Lightweight Information Exchange
        Authors         : John P. Field
                          Stephen A. Banghart
                          David Waltermire
	Filename        : draft-ietf-mile-rolie-06.txt
	Pages           : 40
	Date            : 2017-03-13

Abstract:
   This document defines a resource-oriented approach for security
   automation information publication, discovery, and sharing.  Using
   this approach, producers may publish, share, and exchange
   representations of security incidents, attack indicators, software
   vulnerabilities, configuration checklists, and other security
   automation information as Web-addressable resources.  Furthermore,
   consumers and other stakeholders may access and search this security
   information as needed, establishing a rapid and on-demand information
   exchange network for restricted internal use or public access
   repositories.  This specification extends the Atom Publishing
   Protocol and Atom Syndication Format to transport and share security
   automation resource representations.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-rolie/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-mile-rolie-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-rolie-06


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Mon Mar 13 13:46:18 2017
Return-Path: <internet-drafts@ietf.org>
X-Original-To: mile@ietf.org
Delivered-To: mile@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 231C4129B5C; Mon, 13 Mar 2017 13:46:07 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <mile@ietf.org>, <mile-chairs@tools.ietf.org>, "Nancy Cam-Winget" <ncamwing@cisco.com>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.47.1
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <148943796714.20323.827000743115698754.idtracker@ietfa.amsl.com>
Date: Mon, 13 Mar 2017 13:46:07 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/5uIi8l33I-9yLBFeBkuSKTwCm8s>
Subject: [mile] New Version Notification - draft-ietf-mile-rolie-06.txt
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.17
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Mar 2017 20:46:07 -0000

A new version (-06) has been submitted for draft-ietf-mile-rolie:
https://www.ietf.org/internet-drafts/draft-ietf-mile-rolie-06.txt


The IETF datatracker page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-rolie/

Diff from previous version:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-rolie-06

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

IETF Secretariat.


From nobody Thu Mar 16 07:21:42 2017
Return-Path: <Richard.Struse@hq.dhs.gov>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 417A41294E5 for <mile@ietfa.amsl.com>; Thu, 16 Mar 2017 07:21:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=usdhs.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M7UYrTZa2jiO for <mile@ietfa.amsl.com>; Thu, 16 Mar 2017 07:21:31 -0700 (PDT)
Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0051.outbound.protection.outlook.com [23.103.200.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3648129532 for <mile@ietf.org>; Thu, 16 Mar 2017 07:21:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=usdhs.onmicrosoft.com;  s=selector1-hq-dhs-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=+OAWN9KXHeV4BZmDhCsczutYLSlf7EOavkAnFWPmxBw=; b=kSwW4Y2/cg5e/a2nxSs+6oOMYzxaZ+KDJfIX7e6saoOTcL5p6gwNXArq09kAFT3nHmDaYr6yRtbSxTj6FZkdSIfmGvVSM59ib1Ln7TEiJvccXvSkD9nF1NtIGiUxIP9eoBJIDQx1NERUla4rZDeIXAegOdwQpXuX67rBkOHLRZw=
Received: from CY4PR09CA0004.namprd09.prod.outlook.com (10.172.65.14) by CY4PR09MB1254.namprd09.prod.outlook.com (10.172.66.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.11; Thu, 16 Mar 2017 14:21:29 +0000
Received: from BL2FFO11FD042.protection.gbl (2a01:111:f400:7c09::141) by CY4PR09CA0004.outlook.office365.com (2603:10b6:910:2::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.11 via Frontend Transport; Thu, 16 Mar 2017 14:21:29 +0000
Authentication-Results: spf=pass (sender IP is 216.81.85.157) smtp.mailfrom=hq.dhs.gov; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=HQ.DHS.GOV;
Received-SPF: Pass (protection.outlook.com: domain of hq.dhs.gov designates 216.81.85.157 as permitted sender) receiver=protection.outlook.com; client-ip=216.81.85.157; helo=D2IAPPREACIP5.dhs.gov;
Received: from D2IAPPREACIP5.dhs.gov (216.81.85.157) by BL2FFO11FD042.mail.protection.outlook.com (10.173.161.138) with Microsoft SMTP Server id 15.1.961.10 via Frontend Transport; Thu, 16 Mar 2017 14:21:29 +0000
Received: from unknown (HELO D2ASEVPEMHU08.DSA.DHS) ([10.239.234.231]) by D2IAPPREACIP5.dhs.gov with ESMTP; 16 Mar 2017 14:21:28 +0000
Received: from D2ASEPREA009.DSA.DHS ([10.232.104.26]) by D2ASEVPEMHU08.DSA.DHS ([fe80::401a:494d:85bb:1adc%15]) with mapi id 14.03.0279.002; Thu, 16 Mar 2017 10:21:28 -0400
From: "Struse, Richard" <Richard.Struse@HQ.DHS.GOV>
To: "mile@ietf.org" <mile@ietf.org>
Thread-Topic: Cross-Posting: Request for Public Comments on STIX 2.0
Thread-Index: AdKeYJeA47V4l1BGQaGZJYn+lHsGcA==
Date: Thu, 16 Mar 2017 14:21:28 +0000
Message-ID: <DE637B85E99BDF4DBA1D1C1DF89189390169633FCC@D2ASEPREA009>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: 
x-originating-ip: [10.239.235.225]
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_01AB_01D29E3F.107F6B80"
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-MS-Office365-Filtering-HT: Tenant
X-Forefront-Antispam-Report: CIP:216.81.85.157; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10009020)(39850400002)(39840400002)(39860400002)(39410400002)(39450400003)(2980300002)(438002)(189002)(252514010)(199003)(9170700003)(33716001)(189998001)(55846006)(110136004)(45126002)(38730400002)(54356999)(33656002)(50986999)(77096006)(81166006)(99936001)(2501003)(71636004)(512954002)(5890100001)(5660300001)(3846002)(53416004)(356003)(6916009)(5640700003)(236005)(606005)(16799955002)(54896002)(9686003)(8936002)(1730700003)(6306002)(42882006)(8676002)(53936002)(260700001)(106466001)(8558605004)(568964002)(2920100001)(7736002)(270700001)(2900100001)(7066003)(7826002)(19609705001)(63266004)(6116002)(102836003)(790700001)(2906002)(7906003)(2351001)(84326002)(2930100002)(86362001)(19623455009); DIR:OUT; SFP:1101; SCL:1; SRVR:CY4PR09MB1254; H:D2IAPPREACIP5.dhs.gov; FPR:; SPF:Pass; MLV:sfv; MX:1; A:0; LANG:en; 
X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11FD042; 1:luASBzIySmPTG/yejYku6jmq4y5AHNKXK+h7tOrxXhhjimbO3Arz2qBLBW7KlZISYZrgCMnpHkHaVCI4Q7FdlgM0HoY9dAY8tUxMtIU2TxId+kF7nOgzSMN2A4TcZYUZDIoriWBFV7N054Rn0geJMVYQXxhcH/0a3bHxtXN48EB7Pq+lVj2WWsR0yavdV6eupUItryUP/x6jlGzf7G940L8HXkRwVkWPU4bq+enw2krOlP8PBP9yzdkagRQMW9BoT34FVZVSnZE6MgwctrcOCbWHZn6qfHEZuF1ee4mmEGAbj/281F7L5sjXuSe7a8hRkm2BEH3HoYi9NYNG+h8F1nFOqDB0b5azFeC1nr9mxc/nUvdlEitmSJtMdSZ+G1wwftQdbHJMuuXt3KTPvyLoB8EJLJVjv9Yhfxr+utMGNwZlMjA0s01Tf5i6evLQNzyX3enlBQR/stVfXZa59+4X6IpitNUn3HCt4fnWX6Y0Jl9xhP3Xzo1TGcCuiLEhlT0Dr1iTTQi3wq0gWz1KPOdCCg==
X-MS-Office365-Filtering-Correlation-Id: ab2dc727-3f85-4680-c42a-08d46c77bcf4
X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(8251501002); SRVR:CY4PR09MB1254; 
X-Microsoft-Exchange-Diagnostics: 1; CY4PR09MB1254; 3:FoehkLr3ZBmnpK9lG6POsYfNFgEPUesymcuHL49UFiKQPbUU7oXd29EL/UMI/ZeiYHsAX3gNaidMRj5pit7n4G6q+jyNfpDgSXEUOPvYeIlegcwBjuO+hqBL0vQIBZw8KxozYrWRiUR+nBNHTW21NRxldX8UVtyQa08A2bFKOiAONp1ePHZph22BEYkN/geDTM4f8z7zFSbBgF22sNZ/VIMBHCPLtRWdfwIpemTZ706bo525yZa4+sHkEXnJD+reKaImP2WDBzV0w4hqi2YB8XqRP7cpVRGisreRML9K05w5VPOeWn5QKY3vgeTAzEch5BvoHjeB96R2dGfcz1rS5qxfiJgulCMfm0AVirAqC5FVcP29z6UAG/IexGoNzCQ1B50jadZRBN0377KdlAhnEw==; 25:nnZx1dbBdwcO1V92si2evfYkNX019XmhfeETkLyavJtLwrBDowIIb89lEHVLKeaNCZVFha9zzRM8x44W41j+RoCp56g0Ke5pIWh+22QMhqU5rsDorayJt4s0ctsqNPpjDjPiUxMX7o1L/QDzRw5KL+X9t7fdo0SH2lfO5K6np0UFu/Frk0SCJkWj5/nNYU9dTpfPhpeKD0wOxmhQsaOF680VIjAVaYmuXA8Sf2DVgusHkZuPa/jPML7XsXGWkYjBrT4D2Jdidi17LDTMDhDBhEhte5aKz/LQ9EHCOU2z/YgZ7yqcQOZ0mMQTXVWZfgaPzH8RePPH+PDqmF5gmOiFQtIC8SK4I5eBcjZ8f3ZCjZSygFQu9bUjg2NbINtwraoR8MXTguAH5HEnAvpLJof6w+ojKO4uDvX0KqW7oGX3Ni7/TGl9jlOEHAiVEkd4InN5PWka59tq/rBUTqE8ZdDbtQ==
X-Microsoft-Exchange-Diagnostics: 1; CY4PR09MB1254; 31:Hj8FP7LJ1pWzSSleNV7DKL371D6Z7thJbG/Jhav+u+z4REnbhPbEI7kIBhq7d4kBGQKG8NimdtHZFzfubM85DXlTHWO1uVD0NhGaIZjDinYCfnaUn1+epXJKLXb726+ugY3VyYzkj888tTe8946DsTpLeBmIV8kp6SKOspUaXuSTJX9iVz2SPOuADcC5fw5VLTge/aVxMxsaLyd5Dlm6LeR+cm2VoYWajREbSp/7u6XF5eoScyUyz26AmGnw/NEcYCKDGgoSPbpuRLPqgeuOgA==; 20:vSk815i8N6nLH5IyiwEiCt/JZykoj1+UIWygIoIUZDQLaI1udbFexZJhUSnirGn/wdzgTZXUP1kCam7yDcdvub2lxN9pxPw8wK5MoQxXWAjanyPyI51tCf6M+3I+79P1rEOy0afF+menyaOKbi59+JacWhtG8ftXaIwYcT+wjTAGoEcoSe41MxL06PgWEbPqz8HkgpxcL3FSJXvRfc0U4oG8pWnq9FtymJoNnjX0m/4NU7FzHQ6wzTd44KExOt+OtfVxueVVX3lWRmejSbOInEVQMKZqUxVopibHk9fJCUSjqUfaGWSWsk4YKwhxjWD1PmECppTIMp9IPmkj2XupZbD4QtKRSh3VfU8bBwvacwauME6GlijSLlh1aCFpgUnM5aWrOB5Tn/0v3P/muRzRcUYg6TTW546fTplcpZdEMONy1NX3CU+pYPefj7XtUHuWoQb5iU8xx9asEfc0lZLNUC84JHRIoGD+Vf6WG++pmcmdbJRFX2F14WaZ1JGrfsQ7
X-Microsoft-Antispam-PRVS: <CY4PR09MB125404045F93161629899BFBBD260@CY4PR09MB1254.namprd09.prod.outlook.com>
X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(38170694233816)(152865683959669)(21748063052155); 
X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(13017025)(5005006)(13015025)(13023025)(13018025)(13024025)(3002001)(10201501046)(6055026)(6041248)(20161123564025)(20161123555025)(20161123560025)(20161123558025)(20161123562025)(6072148); SRVR:CY4PR09MB1254; BCL:0; PCL:0; RULEID:; SRVR:CY4PR09MB1254; 
X-Microsoft-Exchange-Diagnostics: 1; CY4PR09MB1254; 4:RpNL4P4wP+ZOIgJd0ZSAd2En1ta0WxHeZbFQmBPDUnWRfjZaLtjpPV2kvARvU1EVuMkdPxoPWJV2V5GHk4yNZKgVa0TxEKtnMQ1MifFIEdialZCA7Sdh7KHr2KQrUDRjBxebBF6fqBdnCo/nOwdskruAILe/ZBKDwCU4MsKuEd3SSrVp2OsTlPxXc5QDo9Fswm27XkOfWryukB9agUtL9j6OnHeneMInAIk+y89icL/s9EOsq4lkWleEKASBPUddbaL9vPxqrdyZRHZoOkJSPYAQou2k/pbo+ClduxQ5LSSqX9XAIBLmbMDPJGBkwq4chVg1Wgal3ya/m3L5jcWSyyK4itce3DHaoWWrRNYMfyM0mtwyXGsH7wywXPGrTiZyv4KXRgNXn0Al5cVvyHyKJ4cyIYhh4AN1SM/Lx4DSCvEkRbRlC0B7baZSrO1XmY/5F/uAE/W176eXM1wA/nOnjw2yLUox4jTuZIZNQiKhtMVOVEzdGoQdjq7AT2kxssjZ+vyOGiZzvRrRaDyToKk4TX4g3nZy49p2+gySI+TiwlmHn4NJqGQGlkXbGy1oSbN9xk/7TD/7eeCFSgttZ4qw8M3OqmiB5meTi6WVFyixfmo4O+OWU3Et09W5alRpi71HgkXhA774pOYGO2ikKA4ULnmYIQgj7FUK33yjIdgzxMuSoK5y6CCkcmqJVfbpCJ/iPGsLOh87unI38ekQe6X5r+76gaP21L+H72c3HsBdGH9QrSzp91b3bCx+2UZjdfDwiSH8xVgfmLtY4EvCPRGGHVT3kOdyxHi0DsusnFqdGClbQRIGR4phY3e/+HRiDL+KzXjjslCw9xyhkQvryHtXRIaMOmq/2IdQWGFoNzU0Fy8=
X-Forefront-PRVS: 024847EE92
X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; CY4PR09MB1254; 23:bA/ZYjFF3IEAcFRvrR6aj9GDtrO74fPgc9/QqgkRm?= =?us-ascii?Q?E9K2dNApXcVzFbv6t8+EJuUg3EAzsxG8H+m+pJ+6W3x1wJgGJE2bdn/Adj/2?= =?us-ascii?Q?CmMQPW/ndoezw+wCROazNL+Zr77msTpnbCE3gOgKRsq2yKM1wo+RhpJUaBMT?= =?us-ascii?Q?zyEPb53RHg9KUlKUSXd2hjG81Mi21xzgHrCG5kZY2zbXyO3CWzjjUTTVONfS?= =?us-ascii?Q?J2VILNdt5lk8o8x5ze+ERWtr6pgPQaG0aXknxKcAVhNCSs9hofusVYJbPIst?= =?us-ascii?Q?LvZg357M550Ka4C3dcS5gu/iWkuXfkR70GXs/2N6l6pa+TkgYUXWzezg/67k?= =?us-ascii?Q?WdE91JQ8ERY+j3eVr2MsVgZR9oQbJ7zdp9+mxrb69cLLG++wK2Kv3tjpIC4k?= =?us-ascii?Q?dYsft02tgpLcNMIR3kc5cwM1yWYutBgHpDAxHVJuBk6uPHYRabdYZsomRqYK?= =?us-ascii?Q?B2ZjXeNRFc0OLuW3UBvt/L2Kdkfjqj80N5G38No9DQcCHjFzXyHhlU2eI789?= =?us-ascii?Q?TU3vmLavWGiyVNibk2EdnrptHnuNHkIm49bOAX5k8eZ9quczQ6EYWefBCw9S?= =?us-ascii?Q?UIHMZ3IbV3bpItkXGdR/wJv+etpLZt8Zo+cVaKayn3n3cncsuFtJdKM55/G4?= =?us-ascii?Q?rTSnfjaR+FQXS2wLrb/+iiMbBe5LpJr74tYiFNoihYB1ON5caL1r4BzEVN3Q?= =?us-ascii?Q?8h7+1bwZJby1RV8VCPC30nAAjO6h1ObPpjXQ1HKclzzfzUOW1Q8rAz7w+xI0?= =?us-ascii?Q?c36dxXYlTFE4lPxqzj2dMv74+SUWkJM/IrdGrTtAtfPkQLTuWgUf15s4mjIq?= =?us-ascii?Q?XjaTf9YHGcuz9N9HGoUuVMn72Kyt81M8JHz0YRU31BlBaUcoo0+UKZkrGbPb?= =?us-ascii?Q?4R1sYsD3r6vntULb4Cec5WvrjE2i87YKqTWn5Y/BHMTXUUlI2Jv2AcN+9gAl?= =?us-ascii?Q?FmNhDe+ypjnMJKfzo4CfDMAVaGvvsuue+cWL0SPcbuOrBabz2Rxz1J8VWDN4?= =?us-ascii?Q?rF9obLj844MMODwtzraPCnjAS/SnnwClCQhTS425nw6cQfZekRV0cXO6FA+i?= =?us-ascii?Q?1eJOlhquncHpYI4OfvOw2h3xDTeuw9nZSmD5FC1cr46xE5JQUqZu6vkwhlwW?= =?us-ascii?Q?il0k8lq0dq/pji0hOzUs7Bw9oyul3w5H3AceASJOugxlRwb7gd+t7J821c9y?= =?us-ascii?Q?rTxqv99WI5tzisKNn0JUjdjaA2FhbB3/yPmmZ5MoEHYMXTfoI3UjLFN3kaKQ?= =?us-ascii?Q?yTG4UXWNA93DrSCrSPZerxhWyJj5evnRl0wky7F1gQtnUSU5FBNUCZOGMPhY?= =?us-ascii?Q?DaZvVrEpyE7IIfQ+8htrZWFA4vmwHFifNMekJTFgcIw57FnxCJdmjkNYq/Op?= =?us-ascii?Q?aiyqQ09EBKg3cxCbOfbUgZsKhn3231cDMTraI90+eX7hP59C6HnkTjRVPvub?= =?us-ascii?Q?yjQ+d0nSt1aQWlDVaMpHYPR3Jzk2x4wstwWVcEGr8HAB+Dv1Dr73oMB+DCBn?= =?us-ascii?Q?Ost3t7AKjITkaIuIp9qaGtwbp6r1S/yVf9iYHYB3NV5TQDFzJT+VUm9/7/HF?= =?us-ascii?Q?MMOpG9xiAvNLTZUXgdomjpvHlRMz343WHusNf3a2EUsOXTV7GzvGrAOfPA5?=
X-Microsoft-Exchange-Diagnostics: 1; CY4PR09MB1254; 6:AU6LPyROI0qG60vcCtxDVoqd5hC9/eeq9HO7dZPZkpFaOLAnxQhk/g6tv/563KPP0hW29qoVpQiQNdfly2W8UgKYYIvf5z2HVjC7wf8VloRBZnoXZPhQXx041L2AlDxljvA689ayhRi1rRRQhfqKBhp+Ov/bM89R+kl3bK9HoIfK/c7TP37m+1ZPy17eFJQGY1pHnhbEmQmNYqmyy0TyhnnMhAaxO8pMCLN9FNoRqAQypzLMNDy6KWIKhAI4ZHBFweWFqAmYp7lqzERFqV4yQnTHM1W3cGrxE/WUGGtr42/oH7JgFp3i6rVpkLWrgWBsBtBO/pArOKj0DaRNx4ZBM1ojfkX9zttNb3uSM6H+zjG9sWfk03IDHfcqRt9epen8nYOCLyL/epKz+rhoyJSj+AxRPGd/ngMyDvivl/Y0J4I=; 5:f2YVsaxwqzewiqmUqKo5SZXH4lAdBYNuW0fGBF3G8I8oFAg5XktIEeeQMsaGNY+upwVe0YzhByiavZDXtbkDo3HjBKSNvXpBzypZIZf576INL3Yzwx9uPxHpUgqFm/sSAePHWVbCwfLS/TFb5nfOOw==; 24:ywqPdc8IWVeunj59aEqxrB7levl/aIrY44VsL+PgGBt+aO5cdantTPTkY3u1XLJof5nr7GYiysTlHLPL5jASn233CBIq3KqPoALDchW926A=
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-Microsoft-Exchange-Diagnostics: 1; CY4PR09MB1254; 7:DipasXSg/7g5WPDozoi/R3q5M3txVp+TWSR6Q47dbX8N/cNOVrKwSDg6IU5HQ4Ov8x+WtKjbIkgKgHctn3U3W5mfxOtDDQJSSmCxgNPsszPcyfF65KCJGmI2EUURNOg7MGdQ+me0DHQ442J+bHS5GQrWO0JvqpJS/qhzREgJJIbz40WjjerDdx1Q94VbXW6uIEmq5/HoKmsvjb+3tSOrjac2riuLChPuhKD7zr8ppuR2qSQq/E1W0Bq2nCOBG5mSCKn/9NDTT63DhgO4KFrmmcEv9nAfRbRql+6slE6403U5TljAJYZZzFQ/Kw6cyzSK/Irz0JS52JJYl7ebvR10KQ==
X-OriginatorOrg: hq.dhs.gov
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Mar 2017 14:21:29.2524 (UTC)
X-MS-Exchange-CrossTenant-Id: 3ccde76c-946d-4a12-bb7a-fc9d0842354a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3ccde76c-946d-4a12-bb7a-fc9d0842354a; Ip=[216.81.85.157];  Helo=[D2IAPPREACIP5.dhs.gov]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR09MB1254
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/dOiKYhZG_lI15zB2VGSMKgH2EpA>
Subject: [mile] Cross-Posting: Request for Public Comments on STIX 2.0
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Mar 2017 14:21:38 -0000

------=_NextPart_000_01AB_01D29E3F.107F6B80
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_01AC_01D29E3F.107F6B80"


------=_NextPart_001_01AC_01D29E3F.107F6B80
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Dear Cybersecurity Community Member,

 

The OASIS Cyber Threat Intelligence Technical Committee (CTI TC
<https://www.oasis-open.org/committees/cti/> ) members have recently
approved STIX 2.0 as a Committee Specification Draft (CSD) and submitted it
for 30-day public review.  The public review started 08 March 2017 at 00:00
UTC and ends 06 April 2017 at 23:59 UTC. 

 

This is an open invitation to comment. OASIS solicits feedback from
potential users, developers and others, whether OASIS members or not, for
the sake of improving the interoperability and quality of its technical
work.

 

What is STIX?

Structured Threat Information Expression (STIX) is a language and
serialization format used to exchange cyber threat intelligence (CTI). STIX
enables organizations to share CTI with one another in a consistent and
machine readable manner, allowing security communities to better understand
what computer-based attacks they are most likely to see and to anticipate
and/or respond to those attacks faster and more effectively. STIX is
designed to improve many different capabilities, such as collaborative
threat analysis, automated threat exchange, automated detection and
response, and more.  More information can be found here
<https://oasis-open.github.io/cti-documentation/stix/about> .

 

What's New in STIX 2.0?

STIX 2.0 represents a significant evolution in the design and implementation
of STIX.  To date, STIX has been very successful in demonstrating that
machine-readable cyber threat intelligence can be widely shared and used
operationally. Both commercial and government threat intelligence feeds
provide it and many threat intelligence tools produce and/or consume it.  As
with anything, however, in developing and implementing STIX 1.x the
community (both vendors and consumers) have found that it also had some
shortcomings. These included excessive complexity and excessive flexibility.
In addition, STIX 1.x used XML, which has fallen out of favor with much of
the developer community.

 

STIX 2 is a redesign of STIX that has the same goals and builds on the same
foundational concepts but in a way that addresses those shortcomings. It is
not backwards-compatible but is intended to be a replacement for STIX 1.x.
STIX 2.0 is the first release of STIX 2 and is intended to be a framework on
which future capabilities can be built. In fact, while STIX 2.0 is currently
under review, the community is already working on additional capabilities to
add in STIX 2.1. All of the releases in the STIX 2 series will build on each
other such that upgrading from one version to the next should be easy
(unlike the change from STIX 1 to STIX 2).  For more information, consult
the FAQ <https://oasis-open.github.io/cti-documentation/stix/review> .

 

STIX 2.0 Documents

STIX Version 2.0 is a five-part specification. The prose documents and
related files are available here:

 


Part #

Title

Links


1

STIX Core Concepts

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/stix-v2.0-
csprd01-part1-stix-core.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/stix-v2.0-
csprd01-part1-stix-core.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/stix-v2.0-
csprd01-part1-stix-core.pdf> 


2

STIX Objects

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objects/stix-v2
.0-csprd01-part2-stix-objects.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objects/stix-v2
.0-csprd01-part2-stix-objects.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objects/stix-v2
.0-csprd01-part2-stix-objects.pdf> 


3

Cyber Observable Core Concepts

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-observable-cor
e/stix-v2.0-csprd01-part3-cyber-observable-core.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-observable-cor
e/stix-v2.0-csprd01-part3-cyber-observable-core.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-observable-cor
e/stix-v2.0-csprd01-part3-cyber-observable-core.pdf> 


4

Cyber Observable Objects

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-observable-obj
ects/stix-v2.0-csprd01-part4-cyber-observable-objects.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-observable-obj
ects/stix-v2.0-csprd01-part4-cyber-observable-objects.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-observable-obj
ects/stix-v2.0-csprd01-part4-cyber-observable-objects.pdf> 


5

STIX Patterning

Editable Authoritative Source (DOCX)
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patterning/stix
-v2.0-csprd01-part5-stix-patterning.docx> 

HTML
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patterning/stix
-v2.0-csprd01-part5-stix-patterning.html> 

PDF
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patterning/stix
-v2.0-csprd01-part5-stix-patterning.pdf> 

 

For your convenience, OASIS also provides a complete package of the prose
documents and related files in a ZIP distribution file. You can download the
ZIP file here
<http://docs.oasis-open.org/cti/stix/v2.0/csprd01/stix-v2.0-csprd01.zip> .

 

How To Comment on STIX 2.0

Comments on STIX 2.0 may be submitted to the TC by any person through the
use of the OASIS TC Comment Facility
<https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=cti> .
Comments submitted by TC non-members for this work and for other work of
this TC are publicly archived and can be viewed here
<https://lists.oasis-open.org/archives/cti-comment/> .  Please submit any
comments before the public comment period ends on April 6, 2017.

 

By submitting comments you implicitly agree to the terms of the OASIS
Feedback License
<https://www.oasis-open.org/policies-guidelines/ipr#appendixa> , which
ensures that any alterations made to the specifications based upon your
feedback are covered by the same IPR protections under which TC members
operate.  In addition, in connection with this public review of STIX 2.0, we
call your attention to the OASIS IPR Policy
<https://www.oasis-open.org/policies-guidelines/ipr#Non-Assertion-Mode>
applicable to the work of this technical committee. While all members of the
TC should already be familiar with this document (which may create
obligations regarding the disclosure and availability of a member's patent,
copyright, trademark and license rights that read on an approved OASIS
specification), public reviewers who are not TC members are encouraged to
review the OASIS IPR Policy.  OASIS invites any persons who know of any such
claims to disclose these if they may be essential to the implementation of
the above specification, so that notice of them may be posted to the notice
page for this TC's work.

 

Invitation to Forward This Call for Comments

OASIS and the CTI TC encourage widespread public review of the STIX 2.0
specifications.  Therefore, please feel free to forward this call for
comments onto any and all interested parties.



Thank you.

 

Regards,

 

Richard J. Struse 

Chair, OASIS Cyber Threat Intelligence (CTI) Technical Committee

 

Chief Advanced Technology Officer

National Cybersecurity and Communications Integration Center (NCCIC) 

Cyber Security & Communications

U.S. Department of Homeland Security


e-mail:   <mailto:Richard.Struse@dhs.gov> Richard.Struse@dhs.gov
Phone:  202-527-2361

 


------=_NextPart_001_01AC_01D29E3F.107F6B80
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 14 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal>Dear =
Cybersecurity Community Member,<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>The OASIS =
Cyber Threat Intelligence Technical Committee (<a =
href=3D"https://www.oasis-open.org/committees/cti/">CTI TC</a>) members =
have recently approved STIX 2.0 as a Committee Specification Draft (CSD) =
and submitted it for 30-day public review.&nbsp; The public review =
started 08 March 2017 at 00:00 UTC and <b><span style=3D'color:red'>ends =
06 April 2017 at 23:59 UTC</span></b>.&nbsp;<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>This is an =
<b>open invitation to comment</b>. OASIS solicits feedback from =
potential users, developers and others, whether OASIS members or not, =
for the sake of improving the interoperability and quality of its =
technical work.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><b><span =
style=3D'font-family:"Arial","sans-serif"'>What is =
STIX?<o:p></o:p></span></b></p><p class=3DMsoNormal>Structured Threat =
Information Expression (STIX) is a language and serialization format =
used to exchange cyber threat intelligence (CTI). STIX enables =
organizations to share CTI with one another in a consistent and machine =
readable manner, allowing security communities to better understand what =
computer-based attacks they are most likely to see and to anticipate =
and/or respond to those attacks faster and more effectively. STIX is =
designed to improve many different capabilities, such as collaborative =
threat analysis, automated threat exchange, automated detection and =
response, and more.&nbsp; More information can be found <a =
href=3D"https://oasis-open.github.io/cti-documentation/stix/about">here</=
a>.<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><b><span =
style=3D'font-family:"Arial","sans-serif"'>What&#8217;s New in STIX =
2.0?<o:p></o:p></span></b></p><p class=3DMsoNormal>STIX 2.0 represents a =
significant evolution in the design and implementation of STIX.&nbsp; To =
date, STIX has been very successful in demonstrating that =
machine-readable cyber threat intelligence can be widely shared and used =
operationally. Both commercial and government threat intelligence feeds =
provide it and many threat intelligence tools produce and/or consume =
it.&nbsp; As with anything, however, in developing and implementing STIX =
1.x the community (both vendors and consumers) have found that it also =
had some shortcomings. These included excessive complexity and excessive =
flexibility. In addition, STIX 1.x used XML, which has fallen out of =
favor with much of the developer community.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>STIX 2 is a =
redesign of STIX that has the same goals and builds on the same =
foundational concepts but in a way that addresses those shortcomings. It =
is not backwards-compatible but is intended to be a replacement for STIX =
1.x.&nbsp; STIX 2.0 is the first release of STIX 2 and is intended to be =
a framework on which future capabilities can be built. In fact, while =
STIX 2.0 is currently under review, the community is already working on =
additional capabilities to add in STIX 2.1. All of the releases in the =
STIX 2 series will build on each other such that upgrading from one =
version to the next should be easy (unlike the change from STIX 1 to =
STIX 2).&nbsp; For more information, consult the <a =
href=3D"https://oasis-open.github.io/cti-documentation/stix/review">FAQ</=
a>.<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><b><span =
style=3D'font-family:"Arial","sans-serif"'>STIX 2.0 =
Documents<o:p></o:p></span></b></p><p class=3DMsoNormal>STIX Version 2.0 =
is a five-part specification. The prose documents and related files are =
available here:<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><table class=3DMsoTableGrid =
border=3D1 cellspacing=3D0 cellpadding=3D0 =
style=3D'border-collapse:collapse;border:none'><tr><td width=3D65 =
style=3D'width:49.1pt;border:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal align=3Dcenter =
style=3D'text-align:center'><b>Part #<o:p></o:p></b></p></td><td =
width=3D240 valign=3Dtop style=3D'width:2.5in;border:solid windowtext =
1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt'><p =
class=3DMsoNormal><b>Title<o:p></o:p></b></p></td><td width=3D390 =
colspan=3D3 style=3D'width:292.5pt;border:solid windowtext =
1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt'><p class=3DMsoNormal =
align=3Dcenter =
style=3D'text-align:center'><b>Links<o:p></o:p></b></p></td></tr><tr><td =
width=3D65 style=3D'width:49.1pt;border:solid windowtext =
1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=3DMsoNormal =
align=3Dcenter style=3D'text-align:center'>1<o:p></o:p></p></td><td =
width=3D240 valign=3Dtop =
style=3D'width:2.5in;border-top:none;border-left:none;border-bottom:solid=
 windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal>STIX Core =
Concepts<o:p></o:p></p></td><td width=3D276 valign=3Dtop =
style=3D'width:207.0pt;border-top:none;border-left:none;border-bottom:sol=
id windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in =
5.4pt 0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/=
stix-v2.0-csprd01-part1-stix-core.docx">Editable Authoritative Source =
(DOCX)</a><o:p></o:p></p></td><td width=3D60 valign=3Dtop =
style=3D'width:45.0pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/=
stix-v2.0-csprd01-part1-stix-core.html">HTML</a><o:p></o:p></p></td><td =
width=3D54 valign=3Dtop =
style=3D'width:40.5pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part1-stix-core/=
stix-v2.0-csprd01-part1-stix-core.pdf">PDF</a><o:p></o:p></p></td></tr><t=
r><td width=3D65 style=3D'width:49.1pt;border:solid windowtext =
1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=3DMsoNormal =
align=3Dcenter style=3D'text-align:center'>2<o:p></o:p></p></td><td =
width=3D240 valign=3Dtop =
style=3D'width:2.5in;border-top:none;border-left:none;border-bottom:solid=
 windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal>STIX Objects<o:p></o:p></p></td><td =
width=3D276 valign=3Dtop =
style=3D'width:207.0pt;border-top:none;border-left:none;border-bottom:sol=
id windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in =
5.4pt 0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objec=
ts/stix-v2.0-csprd01-part2-stix-objects.docx">Editable Authoritative =
Source (DOCX)</a><o:p></o:p></p></td><td width=3D60 valign=3Dtop =
style=3D'width:45.0pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objec=
ts/stix-v2.0-csprd01-part2-stix-objects.html">HTML</a><o:p></o:p></p></td=
><td width=3D54 valign=3Dtop =
style=3D'width:40.5pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part2-stix-objec=
ts/stix-v2.0-csprd01-part2-stix-objects.pdf">PDF</a><o:p></o:p></p></td><=
/tr><tr><td width=3D65 style=3D'width:49.1pt;border:solid windowtext =
1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=3DMsoNormal =
align=3Dcenter style=3D'text-align:center'>3<o:p></o:p></p></td><td =
width=3D240 valign=3Dtop =
style=3D'width:2.5in;border-top:none;border-left:none;border-bottom:solid=
 windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal>Cyber Observable Core =
Concepts<o:p></o:p></p></td><td width=3D276 valign=3Dtop =
style=3D'width:207.0pt;border-top:none;border-left:none;border-bottom:sol=
id windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in =
5.4pt 0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-obse=
rvable-core/stix-v2.0-csprd01-part3-cyber-observable-core.docx">Editable =
Authoritative Source (DOCX)</a><o:p></o:p></p></td><td width=3D60 =
valign=3Dtop =
style=3D'width:45.0pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-obse=
rvable-core/stix-v2.0-csprd01-part3-cyber-observable-core.html">HTML</a><=
o:p></o:p></p></td><td width=3D54 valign=3Dtop =
style=3D'width:40.5pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part3-cyber-obse=
rvable-core/stix-v2.0-csprd01-part3-cyber-observable-core.pdf">PDF</a><o:=
p></o:p></p></td></tr><tr><td width=3D65 =
style=3D'width:49.1pt;border:solid windowtext =
1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=3DMsoNormal =
align=3Dcenter style=3D'text-align:center'>4<o:p></o:p></p></td><td =
width=3D240 valign=3Dtop =
style=3D'width:2.5in;border-top:none;border-left:none;border-bottom:solid=
 windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal>Cyber Observable =
Objects<o:p></o:p></p></td><td width=3D276 valign=3Dtop =
style=3D'width:207.0pt;border-top:none;border-left:none;border-bottom:sol=
id windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in =
5.4pt 0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-obse=
rvable-objects/stix-v2.0-csprd01-part4-cyber-observable-objects.docx">Edi=
table Authoritative Source (DOCX)</a><o:p></o:p></p></td><td width=3D60 =
valign=3Dtop =
style=3D'width:45.0pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-obse=
rvable-objects/stix-v2.0-csprd01-part4-cyber-observable-objects.html">HTM=
L</a><o:p></o:p></p></td><td width=3D54 valign=3Dtop =
style=3D'width:40.5pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part4-cyber-obse=
rvable-objects/stix-v2.0-csprd01-part4-cyber-observable-objects.pdf">PDF<=
/a><o:p></o:p></p></td></tr><tr><td width=3D65 =
style=3D'width:49.1pt;border:solid windowtext =
1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=3DMsoNormal =
align=3Dcenter style=3D'text-align:center'>5<o:p></o:p></p></td><td =
width=3D240 valign=3Dtop =
style=3D'width:2.5in;border-top:none;border-left:none;border-bottom:solid=
 windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal>STIX Patterning<o:p></o:p></p></td><td =
width=3D276 valign=3Dtop =
style=3D'width:207.0pt;border-top:none;border-left:none;border-bottom:sol=
id windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in =
5.4pt 0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patte=
rning/stix-v2.0-csprd01-part5-stix-patterning.docx">Editable =
Authoritative Source (DOCX)</a><o:p></o:p></p></td><td width=3D60 =
valign=3Dtop =
style=3D'width:45.0pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patte=
rning/stix-v2.0-csprd01-part5-stix-patterning.html">HTML</a><o:p></o:p></=
p></td><td width=3D54 valign=3Dtop =
style=3D'width:40.5pt;border-top:none;border-left:none;border-bottom:soli=
d windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt =
0in 5.4pt'><p class=3DMsoNormal><a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/part5-stix-patte=
rning/stix-v2.0-csprd01-part5-stix-patterning.pdf">PDF</a><o:p></o:p></p>=
</td></tr></table><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>For your convenience, OASIS also provides a complete =
package of the prose documents and related files in a ZIP distribution =
file. You can download the ZIP file <a =
href=3D"http://docs.oasis-open.org/cti/stix/v2.0/csprd01/stix-v2.0-csprd0=
1.zip">here</a>.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><b><span =
style=3D'font-family:"Arial","sans-serif"'>How To Comment on STIX =
2.0<o:p></o:p></span></b></p><p class=3DMsoNormal>Comments on STIX 2.0 =
may be submitted to the TC <b><i>by any person</i></b> through the use =
of the <a =
href=3D"https://www.oasis-open.org/committees/comments/index.php?wg_abbre=
v=3Dcti">OASIS TC Comment Facility</a>. &nbsp;Comments submitted by TC =
non-members for this work and for other work of this TC are publicly =
archived and can be viewed <a =
href=3D"https://lists.oasis-open.org/archives/cti-comment/">here</a>.&nbs=
p; <b>Please submit any comments before the public comment period ends =
on April 6, 2017.</b><o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>By =
submitting comments you implicitly agree to the terms of the <a =
href=3D"https://www.oasis-open.org/policies-guidelines/ipr#appendixa">OAS=
IS Feedback License</a>, which ensures that any alterations made to the =
specifications based upon your feedback are covered by the same IPR =
protections under which TC members operate.&nbsp; In addition, in =
connection with this public review of STIX 2.0, we call your attention =
to the <a =
href=3D"https://www.oasis-open.org/policies-guidelines/ipr#Non-Assertion-=
Mode">OASIS IPR Policy</a> applicable to the work of this technical =
committee. While all members of the TC should already be familiar with =
this document (which may create obligations regarding the disclosure and =
availability of a member's patent, copyright, trademark and license =
rights that read on an approved OASIS specification), public reviewers =
who are <i>not</i> TC members are encouraged to review the OASIS IPR =
Policy.&nbsp; OASIS invites any persons who know of any such claims to =
disclose these if they may be essential to the implementation of the =
above specification, so that notice of them may be posted to the notice =
page for this TC's work.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><b><span =
style=3D'font-family:"Arial","sans-serif"'>Invitation to Forward This =
Call for Comments<o:p></o:p></span></b></p><p class=3DMsoNormal>OASIS =
and the CTI TC encourage widespread public review of the STIX 2.0 =
specifications.&nbsp; Therefore, please feel free to forward this call =
for comments onto any and all interested =
parties.<br><br><o:p></o:p></p><p class=3DMsoNormal>Thank =
you.<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>Regards,<span =
style=3D'font-size:12.0pt;font-family:"Times New =
Roman","serif"'><o:p></o:p></span></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><b>Richard =
J. Struse&nbsp;<o:p></o:p></b></p><p class=3DMsoNormal><i>Chair, OASIS =
Cyber Threat Intelligence (CTI) Technical Committee<o:p></o:p></i></p><p =
class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p>&nbsp;</=
o:p></span></b></p><p class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'>Chief =
Advanced Technology Officer<o:p></o:p></span></b></p><p =
class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'>National =
Cybersecurity and Communications Integration Center (NCCIC) =
<o:p></o:p></span></b></p><p class=3DMsoNormal><i><span =
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'>Cyber =
Security &amp; Communications<o:p></o:p></span></i></p><p =
class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'>U.S. =
Department of Homeland Security</span></b><o:p></o:p></p><p =
class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Arial","sans-serif"'><br></span><s=
pan =
style=3D'font-size:9.0pt;font-family:"Arial","sans-serif"'>e-mail:&nbsp; =
<a href=3D"mailto:Richard.Struse@dhs.gov"><span =
style=3D'color:blue'>Richard.Struse@dhs.gov</span></a></span><span =
style=3D'font-size:9.0pt'><br></span><span =
style=3D'font-size:9.0pt;font-family:"Arial","sans-serif"'>Phone:&nbsp; =
202-527-2361</span><o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p></div></body></html>
------=_NextPart_001_01AC_01D29E3F.107F6B80--

------=_NextPart_000_01AB_01D29E3F.107F6B80
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIX9jCCBGAw
ggNIoAMCAQICAgEwMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMu
IEdvdmVybm1lbnQxDTALBgNVBAsTBEZQS0kxITAfBgNVBAMTGEZlZGVyYWwgQ29tbW9uIFBvbGlj
eSBDQTAeFw0xMDEyMDExNjQ1MjdaFw0zMDEyMDExNjQ1MjdaMFkxCzAJBgNVBAYTAlVTMRgwFgYD
VQQKEw9VLlMuIEdvdmVybm1lbnQxDTALBgNVBAsTBEZQS0kxITAfBgNVBAMTGEZlZGVyYWwgQ29t
bW9uIFBvbGljeSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANh1+zUWNFpBv1qv
XDAEFByteES16ibqdWHHzTZ5+HzYvSlRZlkh43mr1Hi+sC2wodWyNRYj0Mwevg7oq9zDydYS16dy
aBgxuBcisj5+ughtxv3RWCxpoAPwKqP2PyElPd+3MsWOJ7MjpeBSs12W6bC4xcWfu8WgboJAu8Un
BTZJ1iYnaQw0j88neioKo0FfjR0DhoMV4FXBxZgsnuwactxIwT75hNKEgsEbw3Q2t7nHNjJ6+DK2
0DauIhgxjFBzIZ7+gzswiCTj6cF+3u2Yxx+SEIqfW2IvnaS81YVvOv3JU6cgS6rbIKshTh0NTuaY
heWrEUddnT/EI8DjFAZu/p0CAwEAAaOCATAwggEsMA8GA1UdEwEB/wQFMAMBAf8wgekGCCsGAQUF
BwELBIHcMIHZMD8GCCsGAQUFBzAFhjNodHRwOi8vaHR0cC5mcGtpLmdvdi9mY3BjYS9jYUNlcnRz
SXNzdWVkQnlmY3BjYS5wN2MwgZUGCCsGAQUFBzAFhoGIbGRhcDovL2xkYXAuZnBraS5nb3YvY249
RmVkZXJhbCUyMENvbW1vbiUyMFBvbGljeSUyMENBLG91PUZQS0ksbz1VLlMuJTIwR292ZXJubWVu
dCxjPVVTP2NBQ2VydGlmaWNhdGU7YmluYXJ5LGNyb3NzQ2VydGlmaWNhdGVQYWlyO2JpbmFyeTAO
BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFK0MenVc5fOYxHmYDqwo/Zf05wL8MA0GCSqGSIb3DQEB
CwUAA4IBAQCPc9rhf4Cxh/bsLM/RhGMe9vGIt5ryEbXvVK2Kbhg3KO9cG+TvULdsJhgjIk0dJkcg
6Qmc4nBicasRz5GJ6LP1KqBHwBTLTkLB3QwOG/CHW+zld9eq4FTXRfSFPuy0Hd58in9bTZyWitCi
Mp/abDEM+KTvfnPokdwIenBaoK9igVn4AHSiyN1UykFWR73pwE/tIN3jpQnfrijC/NHIF9gSx2/e
Lum9mpHyPFqULpEigImhjFjMg3omGXUCpQ59CiZzUeqGyweoyP1jWjWb0q+/TzFIwYRw2zV7mhkP
5Y/0agxvM9nrHHCiDeO5UANhAv9K7JKk3C3uKjSTB7cs5xiPMIIF2zCCBMOgAwIBAgICNm4wDQYJ
KoZIhvcNAQELBQAwWTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD1UuUy4gR292ZXJubWVudDENMAsG
A1UECxMERlBLSTEhMB8GA1UEAxMYRmVkZXJhbCBDb21tb24gUG9saWN5IENBMB4XDTE2MDQxODE1
MTA0MloXDTE5MDQxODE1MDY0N1owgY4xCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVy
bm1lbnQxIzAhBgNVBAsTGkRlcGFydG1lbnQgb2YgdGhlIFRyZWFzdXJ5MSIwIAYDVQQLExlDZXJ0
aWZpY2F0aW9uIEF1dGhvcml0aWVzMRwwGgYDVQQLExNVUyBUcmVhc3VyeSBSb290IENBMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6CQEWcyYx3xksWrXOylIx7tY6t+ixCqT0WjWi4PC
KkDmauxuGt/pI+9UYdrlou12AGkE1Uzyv8QbaIVRrgenONkKs1IRNp8igd4ESHe+qK+y8XgurMRY
h1CGAgx7N2gInWJNtQm38RZz2wToRumIkyXI2m2jqIwh38bXNlgg2632jBKAIpdY9ONCi33R9H65
f1bvujG8SewSrwiAueKXYmB/74P5Y97rcG6rxE8PNBKmy60mQ8uPA8bzniQeKoOwauYp/1cesW5f
T0DVQrWq1bRR5LJ7Wwb8gqLMsRa/PkTHo2S3gvZoctvm/nth2/6udXbM3GxS2bwHqDlm64+aywID
AQABo4ICdTCCAnEwDwYDVR0TAQH/BAUwAwEB/zCBswYDVR0gBIGrMIGoMAwGCmCGSAFlAwIBAwEw
DAYKYIZIAWUDAgEDAjAMBgpghkgBZQMCAQMGMAwGCmCGSAFlAwIBAwcwDAYKYIZIAWUDAgEDCDAM
BgpghkgBZQMCAQMkMAwGCmCGSAFlAwIBAw0wDAYKYIZIAWUDAgEDEDAMBgpghkgBZQMCAQMRMAwG
CmCGSAFlAwIBAycwDAYKYIZIAWUDAgEDKDAMBgpghkgBZQMCAQMpME8GCCsGAQUFBwEBBEMwQTA/
BggrBgEFBQcwAoYzaHR0cDovL2h0dHAuZnBraS5nb3YvZmNwY2EvY2FDZXJ0c0lzc3VlZFRvZmNw
Y2EucDdjMIGNBgNVHSEEgYUwgYIwGAYKYIZIAWUDAgEDAQYKYIZIAWUDAgEFAjAYBgpghkgBZQMC
AQMCBgpghkgBZQMCAQUDMBgGCmCGSAFlAwIBAwYGCmCGSAFlAwIBBQcwGAYKYIZIAWUDAgEDBwYK
YIZIAWUDAgEFBDAYBgpghkgBZQMCAQMQBgpghkgBZQMCAQUFMEAGCCsGAQUFBwELBDQwMjAwBggr
BgEFBQcwBYYkaHR0cDovL3BraS50cmVhc3VyeS5nb3Yvcm9vdF9zaWEucDdjMA4GA1UdDwEB/wQE
AwIBBjAfBgNVHSMEGDAWgBStDHp1XOXzmMR5mA6sKP2X9OcC/DA1BgNVHR8ELjAsMCqgKKAmhiRo
dHRwOi8vaHR0cC5mcGtpLmdvdi9mY3BjYS9mY3BjYS5jcmwwHQYDVR0OBBYEFGiEFUiMVHB/LRJY
DuwceO88LllkMA0GCSqGSIb3DQEBCwUAA4IBAQCsE7pwaCpISt8zUAUCjefyt81PrIGLTl3RmIQK
BCVwfGiqUksRrHU7GAo+oabc6vbc4InAZGpvlQ4uCpBEdQ5mkzgTeawzzyj0lZZ5c/I0wsJVXYzu
5RjEJS0WtlT2jtQhUnpgmbIa6RQbHJ1VvBnsvD2isr3SUajJBPqt8fUsSCc69lTTQpCrZJYKqzQS
FayPzLdi8GFS4mPEa6R4Zzxu74TODy2Fac/f3OI7g7TvdboB8C7yhEkQlTsvNhXHrf14Kl3lk+VR
Y3hvmGqJH/rgBJzmWNhY0sAhenuNLmXN6jXsvBjiX2VarDXMTIAEUFy+mTwijMzsaXFQJVJxggLH
MIIGDTCCBPWgAwIBAgIETjmBKDANBgkqhkiG9w0BAQsFADCBjjELMAkGA1UEBhMCVVMxGDAWBgNV
BAoTD1UuUy4gR292ZXJubWVudDEjMCEGA1UECxMaRGVwYXJ0bWVudCBvZiB0aGUgVHJlYXN1cnkx
IjAgBgNVBAsTGUNlcnRpZmljYXRpb24gQXV0aG9yaXRpZXMxHDAaBgNVBAsTE1VTIFRyZWFzdXJ5
IFJvb3QgQ0EwHhcNMTUwNjEzMTQzNTA0WhcNMjUwNjEzMTUwNTA0WjCBhzELMAkGA1UEBhMCVVMx
GDAWBgNVBAoTD1UuUy4gR292ZXJubWVudDEoMCYGA1UECxMfRGVwYXJ0bWVudCBvZiBIb21lbGFu
ZCBTZWN1cml0eTEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRob3JpdGllczEQMA4GA1UECxMH
REhTIENBNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ6z5QKA2hjOSvwVu0SWd/TJ
sJv2Xd2WN7yTo9OCSPiQ+U89oAE8xlIpo+97mMK3DjwU4GdeMP0cdpKarcL7BBSPCK2j1f3o5PNi
YU6RDJBR6pgfuvE6LJDAmpKZGcJITnLjui25aMAy6dlNX0aNFu2JApB9yDE9VrIODNhZsD6LG4iC
a1mATxtGQfIqfZhT/aSNnfcbzIddZYvhQlYMF53S9+oAJv21XyHLHO91PW75UteWVxWZvxLfQZmk
wzeAxJI37YnpRrHGvtjjeRVgtUKi3wj3CpvRSVLMy05CAKlgsG56vvG3lgkeIoJrwiBV+sY4G3ao
T7+efJgRnJpxCYcCAwEAAaOCAnYwggJyMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/
MIGXBgNVHSAEgY8wgYwwDAYKYIZIAWUDAgEDBjAMBgpghkgBZQMCAQMHMAwGCmCGSAFlAwIBAwgw
DAYKYIZIAWUDAgEDDTAMBgpghkgBZQMCAQMQMAwGCmCGSAFlAwIBAxEwDAYKYIZIAWUDAgEDJDAM
BgpghkgBZQMCAQMnMAwGCmCGSAFlAwIBAygwDAYKYIZIAWUDAgEDKTBBBggrBgEFBQcBAQQ1MDMw
MQYIKwYBBQUHMAKGJWh0dHA6Ly9wa2kudHJlYXN1cnkuZ292L2Roc2NhX2FpYS5wN2MwQQYIKwYB
BQUHAQsENTAzMDEGCCsGAQUFBzAFhiVodHRwOi8vcGtpLnRyZWFzdXJ5Lmdvdi9kaHNjYV9zaWEu
cDdjMIHuBgNVHR8EgeYwgeMwNaAzoDGGL2h0dHA6Ly9wa2kudHJlYXN1cnkuZ292L1VTX1RyZWFz
dXJ5X1Jvb3RfQ0EuY3JsMIGpoIGmoIGjpIGgMIGdMQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5T
LiBHb3Zlcm5tZW50MSMwIQYDVQQLExpEZXBhcnRtZW50IG9mIHRoZSBUcmVhc3VyeTEiMCAGA1UE
CxMZQ2VydGlmaWNhdGlvbiBBdXRob3JpdGllczEcMBoGA1UECxMTVVMgVHJlYXN1cnkgUm9vdCBD
QTENMAsGA1UEAxMEQ1JMMTAfBgNVHSMEGDAWgBRohBVIjFRwfy0SWA7sHHjvPC5ZZDAdBgNVHQ4E
FgQUfMNKXLofNquDUX304OUOkH8cE0EwDQYJKoZIhvcNAQELBQADggEBAFOQwIQWhIzLNbzkya8Z
+U7BoFSrsg+aVXT4StNJjdWPCZO5fP6KU9OW2gcHAz/GylC65JrbFM6Wo7Zn+rrTrZZvDnd7uyja
feUDnnI4VwPwYrPUQllyru7YC9aZjp6fMm8S+MUN69Dpb7NMFHt2876CYRco+q0t/ESN1T+YLrqG
AhPjwz1+opTyrhY3NSBRtJ8xUzNIcDP34r9td0SXtiidmxX/dDLiGi0YvzD90sSWNAKOANl3MyhI
PerCuADFqpALUkkY5zTa+ZlPHDf/4pfedZN4cJDpv9X49/RterYIj0cGw8UyWFaObSAOVEBrYe+T
z+l0RQ3GVQ8mhpBK2YIwggeeMIIGhqADAgECAgRXJqwQMA0GCSqGSIb3DQEBCwUAMIGHMQswCQYD
VQQGEwJVUzEYMBYGA1UEChMPVS5TLiBHb3Zlcm5tZW50MSgwJgYDVQQLEx9EZXBhcnRtZW50IG9m
IEhvbWVsYW5kIFNlY3VyaXR5MSIwIAYDVQQLExlDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVzMRAw
DgYDVQQLEwdESFMgQ0E0MB4XDTE2MDUyNDE3MzkzMVoXDTE5MDUyMzA0MDAwMFowga8xCzAJBgNV
BAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxKDAmBgNVBAsTH0RlcGFydG1lbnQgb2Yg
SG9tZWxhbmQgU2VjdXJpdHkxDzANBgNVBAsTBkRIUyBIUTEPMA0GA1UECxMGUGVvcGxlMTowFwYD
VQQDExBSSUNIQVJEIEogU1RSVVNFMB8GCgmSJomT8ixkAQETETAyMjczMTQ4NDQuREhTIEhRMIIB
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzi/wOfzuSkqwBvhkh/ZBaVQx+qVgiae7huck
KM+NMLpsf9xx3CJvNpHZkoQh2DpAwDC8yc8FKynmIhv4j+bozuSmTApPyNdmIaenGiOOUsHu3VOm
yok2TxoRhyBOq7jy52rZNVQ0NqqCvBY2G1g9nJhI80dJeadtxSnFW//kyFNoRni47FglGN0lT0Xr
KmsozWEcF9StdLlJWSHFTLN2QdgsaFPt0TqF19okkrbLARc8RpIoy58qMcHwQ8tIsrKPYJ/JSH5U
oQkBVSjv184QxwmEuyW/RSLBd5ZziG1IC3KxSjSuTtjzvn5ggcAHRa9mnBTAjA342bkkqfLD6Sv+
kQIDAQABo4ID5jCCA+IwDgYDVR0PAQH/BAQDAgeAMBcGA1UdIAQQMA4wDAYKYIZIAWUDAgEDDTAl
BgNVHSUEHjAcBgorBgEEAYI3FAICBggrBgEFBQcDAgYEVR0lADAQBglghkgBZQMGCQEEAwEB/zCC
ARsGCCsGAQUFBwEBBIIBDTCCAQkwNAYIKwYBBQUHMAKGKGh0dHA6Ly9wa2kuZGltYy5kaHMuZ292
L2Roc2NhX2VlX2FpYS5wN2MwgaoGCCsGAQUFBzAChoGdbGRhcDovL2xkYXAwMS5kaW1jLmRocy5n
b3Yvb3U9REhTJTIwQ0E0LG91PUNlcnRpZmljYXRpb24lMjBBdXRob3JpdGllcyxvdT1EZXBhcnRt
ZW50JTIwb2YlMjBIb21lbGFuZCUyMFNlY3VyaXR5LG89VS5TLiUyMEdvdmVybm1lbnQsYz1VUz9j
QUNlcnRpZmljYXRlO2JpbmFyeTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGltYy5kaHMuZ292
MG0GA1UdEQRmMGSBEjAyMjczMTQ4NDRAZGhzLmdvdqAlBgorBgEEAYI3FAIDoBcMFTAyMjczMTQ4
NDRASFEuREhTLkdPVqAnBghghkgBZQMGBqAbBBnXAhDYIQwtMgW5DYNoWChHMwIIhIcCEMPiMIIB
kwYDVR0fBIIBijCCAYYwggFXoIIBU6CCAU+kgZwwgZkxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9V
LlMuIEdvdmVybm1lbnQxKDAmBgNVBAsTH0RlcGFydG1lbnQgb2YgSG9tZWxhbmQgU2VjdXJpdHkx
IjAgBgNVBAsTGUNlcnRpZmljYXRpb24gQXV0aG9yaXRpZXMxEDAOBgNVBAsTB0RIUyBDQTQxEDAO
BgNVBAMTB0NSTDQxNDWGga1sZGFwOi8vbGRhcDAxLmRpbWMuZGhzLmdvdi9jbj1DUkw0MTQ1LG91
PURIUyUyMENBNCxvdT1DZXJ0aWZpY2F0aW9uJTIwQXV0aG9yaXRpZXMsb3U9RGVwYXJ0bWVudCUy
MG9mJTIwSG9tZWxhbmQlMjBTZWN1cml0eSxvPVUuUy4lMjBHb3Zlcm5tZW50LGM9VVM/Y2VydGlm
aWNhdGVSZXZvY2F0aW9uTGlzdDApoCegJYYjaHR0cDovL3BraS5kaW1jLmRocy5nb3YvREhTX0NB
Mi5jcmwwHwYDVR0jBBgwFoAUfMNKXLofNquDUX304OUOkH8cE0EwHQYDVR0OBBYEFHRjSQMozkn0
cRQkVWeiycDcRh4yMBkGCSqGSIb2fQdBAAQMMAobBFY4LjEDAgQwMA0GCSqGSIb3DQEBCwUAA4IB
AQBvuwLTyECvhvh6YQvlIsKNJ3Rq66c5rSc68cdhY2yrb/g2ovXRBnE9U6zVLcwzxVChMG8IXTZ1
tv/mF4zntHFvGbpFeMbsOM2HtKs650vfSQseWn721OGNlBy7Bb/qEgwH1lM7Qzg1uQ+QRvblBV6F
X6l1J8OWt3xwgEcZsH6ngr5kXTAUNtVCZiPSnwLHE01HyVXI/7wFEzoaxJJWd0ZrvlN0DfwDwV0A
UFGpUBdk8t0tFcQUx4+9KJqS/draBm5xJhE1xwU5BOk8LIUIHWFuiQT8nSroYOi75ih8cnSciy63
HIuR30UK2TMgttZCMwNiRBUtzxhS7jUubDsnMNfQMYICMTCCAi0CAQEwgZAwgYcxCzAJBgNVBAYT
AlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxKDAmBgNVBAsTH0RlcGFydG1lbnQgb2YgSG9t
ZWxhbmQgU2VjdXJpdHkxIjAgBgNVBAsTGUNlcnRpZmljYXRpb24gQXV0aG9yaXRpZXMxEDAOBgNV
BAsTB0RIUyBDQTQCBFcmrBAwCQYFKw4DAhoFAKB3MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw
GAYJKoZIhvcNAQkPMQswCTAHBgUrDgMCGjAcBgkqhkiG9w0BCQUxDxcNMTcwMzE2MTQyMTI0WjAj
BgkqhkiG9w0BCQQxFgQUWksiTuZMGJT7jlz7Aq+BfQggDZ4wDQYJKoZIhvcNAQEBBQAEggEAtCEK
0NDNM2dVLRXverfjnL1wAITbrxNnj5IgIEQs5UIoJjnshYpavrs9qIlIxOBmuyhMF/51iHWPqONC
11/Ty/6FduhQcLOkRU7PXaw2S2KP7O/ru5MGvkbVAlt7oAOZioie+PDBd14mPxHlZ7wLiaP507Kv
b0exFRora0u6gGKihheAeulm/ozWfJe+NkM1pufOTtEiUmbcZWlwOC3DOlG+DWvox73AsCV4VylO
ot4MSLuf3dbvAgaBMDcPqQYlU6fl+SIjuZnkbaILwiYEJqdtnVtHfKCT2OU2xa4O4H+k6ZVNFuRi
uL0GHREo7RM2eEXo/8ib1IDxBd7q5+naVwAAAAAAAA==

------=_NextPart_000_01AB_01D29E3F.107F6B80--


From nobody Sun Mar 26 15:34:15 2017
Return-Path: <david.waltermire@nist.gov>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25DD01286CA; Sun, 26 Mar 2017 15:34:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YtBT3vI4UCiU; Sun, 26 Mar 2017 15:34:04 -0700 (PDT)
Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0118.outbound.protection.outlook.com [23.103.201.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66B75126BF6; Sun, 26 Mar 2017 15:34:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=kRlebIrkaonK3beZ9dRyY9pgdGDvNaR4lhvQAvggURM=; b=Nz+1adadMyBd+R5mPsCCjAWwV3/mUg05e+3l3RA8LFc0cirSGWtxy8G+C69XlE/f+FQSdtr8LQQk8DRNadqxVVDH8MjJo2VaByslC1ap8gp4yBx/MeoJ6Zv83VUenVZEf0wdtoX/SJgEYrYvxRhUYtXgKLmaSN5XSKUFGAvOgp4=
Received: from MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) by MWHPR09MB1439.namprd09.prod.outlook.com (10.173.50.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.991.14; Sun, 26 Mar 2017 22:34:02 +0000
Received: from MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) by MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) with mapi id 15.01.0991.020; Sun, 26 Mar 2017 22:34:01 +0000
From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
To: "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>, "mile@ietf.org" <mile@ietf.org>
Thread-Topic: PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8g==
Date: Sun, 26 Mar 2017 22:34:01 +0000
Message-ID: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=nist.gov;
x-originating-ip: [129.6.220.139]
x-microsoft-exchange-diagnostics: 1; MWHPR09MB1439; 7:hClKWSPOlpJaHaSusXNqvUn2+aKbt/Rr9pKEAoIfd9jzNKkjkWBjiwZpyodwJaX9pfqcZcmO0PUki2D7LW58cV8awv2NPXwL48+xcCiBOatbRJsm9OK+ZDb4CgqfkDrgvQn8WbVhDoJ7EUej1Dxk7Wn4RNf4u3/jyn7OQnNOq03us3436SEWN4D3EDi8ko187EY0r65cXVhLCr02nopa9Uz55QKED6R1pCLFujK5kmM6EIxS4k5JHQKCZYi0l5mgp7hcbrPNosPefSCwWb7Y6gCYDFBDbK/JIxedaL1Uq1IAw1RX9gBjs4AOzD0tHwNRgX55loptWGMw+xpb58LJgQ==
x-ms-office365-filtering-correlation-id: d1714e22-885a-4c53-e580-08d4749833d9
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081); SRVR:MWHPR09MB1439; 
x-microsoft-antispam-prvs: <MWHPR09MB14395B7A365F82580CA115FBF0300@MWHPR09MB1439.namprd09.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(192374486261705)(211171220733660)(148717330147763); 
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123562025)(20161123555025)(20161123564025)(20161123560025)(20161123558025)(6072148); SRVR:MWHPR09MB1439; BCL:0; PCL:0; RULEID:; SRVR:MWHPR09MB1439; 
x-forefront-prvs: 0258E7CCD4
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(979002)(6009001)(39840400002)(39450400003)(39410400002)(39850400002)(5660300001)(2501003)(6116002)(102836003)(3846002)(8936002)(74316002)(97736004)(122556002)(7736002)(189998001)(25786009)(2201001)(450100002)(53936002)(8676002)(7696004)(81166006)(38730400002)(86362001)(305945005)(33656002)(99286003)(9686003)(55016002)(6506006)(6436002)(77096006)(2900100001)(3660700001)(66066001)(2906002)(50986999)(54356999)(3280700002)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR09MB1439; H:MWHPR09MB1440.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; 
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Mar 2017 22:34:01.8200 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR09MB1439
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/_2XNBcNTLmKln3fh9ONxh9uTcsY>
Subject: [mile] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 26 Mar 2017 22:34:07 -0000

The US Government has been working within the IETF SACM work group to stand=
ardize the collection of endpoint configuration and other posture informati=
on from enterprise endpoints. Collecting this information is critical to su=
pport automation of common network security tasks, including asset, softwar=
e, vulnerability, and configuration management. Thus far, our efforts have =
focused primarily on standards to collect information in support of asset, =
software and vulnerability management use cases, and has worked with other =
IETF members to determine what data would need to be to be collected, and h=
ow that data would be securely communicated across the network. Through suc=
h exchanges an organization can know what client endpoints are connected to=
 their network, and if they are vulnerable to attack.

Given the proliferation of attacks against network infrastructure devices, =
it is clear that the next step in our enterprise security automation effort=
 must be to enable standardized reporting of similar information from netwo=
rk infrastructure devices. With the growing number of Yang models and incre=
ased adoption of NETCONF, RESTCONF, and related protocol work, the time is =
right to work out how these standards can be used to measure the health of =
network devices. This information will, as in our efforts in SACM for clien=
t devices, support asset, software, vulnerability, and configuration manage=
ment use cases. Standards-based reporting of this information from network =
infrastructure devices will help network defenders protect against known at=
tacks, and provide the necessary knowledge to detect and mitigate future at=
tacks.=20

We would like to start a discussion about how to leverage the existing IETF=
 network management protocols to best address security automation for netwo=
rk infrastructure devices. We would like your ideas on how to best pursue t=
his work, and your insights into network infrastructure security problems t=
hat will impact our networks in the future. We are holding a side meeting a=
t IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion abou=
t how to move forward. We will be meeting in Vevey 4 at the IETF meeting ve=
nue.

Here is a summary of the meeting details:

PANIC (Posture Assessment through Network Information Collection) Bar BoF
Wednesday, March 29th, 2017 @ 6:30pm CDT
Swissotel Conference Center - Vevey 4

We look forward to working with you, and hope to see you in Chicago at the =
PANIC Bar BoF.

Regards,
Dave

David Waltermire
Information Technology Laboratory | Computer Security Division
National Institute of Standards and Technology


From nobody Mon Mar 27 10:45:50 2017
Return-Path: <takeshi_takahashi@nict.go.jp>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4180129442 for <mile@ietfa.amsl.com>; Mon, 27 Mar 2017 10:45:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wZ2x4ETxzhkr for <mile@ietfa.amsl.com>; Mon, 27 Mar 2017 10:45:47 -0700 (PDT)
Received: from ns2.nict.go.jp (ns2.nict.go.jp [IPv6:2001:df0:232:300::2]) by ietfa.amsl.com (Postfix) with ESMTP id E41701294B5 for <mile@ietf.org>; Mon, 27 Mar 2017 10:45:46 -0700 (PDT)
Received: from gw2.nict.go.jp (gw2.nict.go.jp [133.243.18.251]) by ns2.nict.go.jp  with ESMTP id v2RHjk5l070390 for <mile@ietf.org>; Tue, 28 Mar 2017 02:45:46 +0900 (JST)
Received: from DESKTOP2JPR8KD (ssh1.nict.go.jp [133.243.3.49]) by gw2.nict.go.jp  with ESMTP id v2RHjjRM069822 for <mile@ietf.org>; Tue, 28 Mar 2017 02:45:45 +0900 (JST)
From: "Takeshi Takahashi" <takeshi_takahashi@nict.go.jp>
To: <mile@ietf.org>
References: <010501d29722$8d0d7f80$a7287e80$@nict.go.jp>
In-Reply-To: <010501d29722$8d0d7f80$a7287e80$@nict.go.jp>
Date: Tue, 28 Mar 2017 02:45:43 +0900
Message-ID: <001601d2a721$f5ec5030$e1c4f090$@nict.go.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQK1p2Lg7GVl/DkHMLggIyqdvaBf+5/i9J3Q
Content-Language: ja
X-Virus-Scanned: clamav-milter 0.98.7 at zenith2
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/XkU1uyc4hLwuMPqEadhIgWhJ7Zo>
Subject: Re: [mile] MILE session in IETF 98
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 27 Mar 2017 17:45:50 -0000

Hi all,

This is a friendly reminder: we will hold our MILE session today.

mile Session 1 (1:00:00)
     Monday, Afternoon Session II 1520-1650
     Room Name: Montreux 3 size: 80

We are looking for note taker and jabber scribe.
If you could assist us by taking care of one of them, please kindly let us
know.
We will appreciate that very much.

Thank you, and regards,
Take



-----Original Message-----
From: mile [mailto:mile-bounces@ietf.org] On Behalf Of Takeshi Takahashi
Sent: Tuesday, March 7, 2017 6:10 PM
To: mile@ietf.org
Subject: [mile] MILE session in IETF 98

Hi all,

We will hold our session in IETF98.
Though I do not expect such a lot of agenda this time, it would be nice to
meet up and share the status.

mile Session 1 (1:00:00)
     Monday, Afternoon Session II 1520-1650
     Room Name: Montreux 3 size: 80

Please let us know if you are willing to present your work at the session.
So long as I know, the authors of the guidance draft were planning to ask
the WGLC at the meeting.

Thank you.
Take



> -----Original Message-----
> From: mile [mailto:mile-bounces@ietf.org] On Behalf Of "IETF Secretariat"
> Sent: Saturday, March 4, 2017 8:56 AM
> To: smccammon@amsl.com; mile-chairs@ietf.org
> Cc: mile@ietf.org
> Subject: [mile] mile - Requested session has been scheduled for IETF 
> 98
> 
> Dear Stephanie McCammon,
> 
> The session(s) that you have requested have been scheduled.
> Below is the scheduled session information followed by the original
request.
> 
> mile Session 1 (1:00:00)
>     Monday, Afternoon Session II 1520-1650
>     Room Name: Montreux 3 size: 80
>     ---------------------------------------------
> 
> 
> 
> Request Information:
> 
> 
> ---------------------------------------------------------
> Working Group Name: Managed Incident Lightweight Exchange Area Name:
> Security Area Session Requester: Stephanie McCammon
> 
> Number of Sessions: 1
> Length of Session(s):  1 Hour
> Number of Attendees: 30
> Conflicts to Avoid:
>  First Priority: core anima dots i2nsf ipsecme saag sacm  Second Priority:
> 6tisch appsawg httpbis tls
> 
> 
> 
> People who must be present:
>   Kathleen Moriarty
>   Nancy Cam-Winget
>   David Waltermire
>   Takeshi Takahashi
> 
> Resources Requested:
>   Meetecho support in room
> 
> Special Requests:
> 
> ---------------------------------------------------------
> 
> _______________________________________________
> mile mailing list
> mile@ietf.org
> https://www.ietf.org/mailman/listinfo/mile

_______________________________________________
mile mailing list
mile@ietf.org
https://www.ietf.org/mailman/listinfo/mile


From nobody Tue Mar 28 08:42:06 2017
Return-Path: <takeshi_takahashi@nict.go.jp>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78C7C129654 for <mile@ietfa.amsl.com>; Tue, 28 Mar 2017 08:42:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qZTbEqar8z9j for <mile@ietfa.amsl.com>; Tue, 28 Mar 2017 08:41:54 -0700 (PDT)
Received: from ns2.nict.go.jp (ns2.nict.go.jp [IPv6:2001:df0:232:300::2]) by ietfa.amsl.com (Postfix) with ESMTP id 16AA0129687 for <mile@ietf.org>; Tue, 28 Mar 2017 08:41:48 -0700 (PDT)
Received: from gw2.nict.go.jp (gw2.nict.go.jp [133.243.18.251]) by ns2.nict.go.jp  with ESMTP id v2SFffx8046663; Wed, 29 Mar 2017 00:41:41 +0900 (JST)
Received: from DESKTOP2JPR8KD (ssh1.nict.go.jp [133.243.3.49]) by gw2.nict.go.jp  with ESMTP id v2SFfdQc046648; Wed, 29 Mar 2017 00:41:40 +0900 (JST)
From: "Takeshi Takahashi" <takeshi_takahashi@nict.go.jp>
To: <mile@ietf.org>
Cc: <mile-chairs@tools.ietf.org>, <inacio@cert.org>, "'Roman D. Danyliw'" <rdd@cert.org>
Date: Wed, 29 Mar 2017 00:41:37 +0900
Message-ID: <a29a01d2a7d9$ca695c10$5f3c1430$@nict.go.jp>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_A29B_01D2A825.3A510410"
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AdKn2YnL0VFKzrHQS6mKWMxXYS/zOQ==
Content-Language: ja
X-Virus-Scanned: clamav-milter 0.98.7 at zenith2
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/qWfvYfoPGm-qPmy0hwpGfIIiqOc>
Subject: [mile] minutes of the MILE meeting at IETF98
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Mar 2017 15:42:02 -0000

This is a multipart message in MIME format.

------=_NextPart_000_A29B_01D2A825.3A510410
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Dear all,

 

The minutes of the MILE meeting at IETF98 is now available online:

https://datatracker.ietf.org/doc/minutes-98-mile/

 

Let us thank Chris Inacio and Roman Danyliw very much for taking care of the
note takes and jabber scribe.

 

Cheers,

Take

 

 


------=_NextPart_000_A29B_01D2A825.3A510410
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><META =
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:\6E38\30B4\30B7\30C3\30AF;
	panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
	{font-family:"\@\6E38\30B4\30B7\30C3\30AF";
	panose-1:2 11 4 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0mm;
	margin-bottom:.0001pt;
	text-align:justify;
	text-justify:inter-ideograph;
	font-size:10.5pt;
	font-family:\6E38\30B4\30B7\30C3\30AF;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;}
span.17
	{mso-style-type:personal-compose;
	font-family:\6E38\30B4\30B7\30C3\30AF;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:\6E38\30B4\30B7\30C3\30AF;}
/* Page Definitions */
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:99.25pt 30.0mm 30.0mm 30.0mm;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026">
<v:textbox inset=3D"5.85pt,.7pt,5.85pt,.7pt" />
</o:shapedefaults></xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DJA =
link=3D"#0563C1" vlink=3D"#954F72" =
style=3D'text-justify-trim:punctuation'><div class=3DWordSection1><p =
class=3DMsoNormal><span lang=3DEN-US style=3D'font-size:11.0pt'>Dear =
all,<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US style=3D'font-size:11.0pt'>The =
minutes of the MILE meeting at IETF98 is now available =
online:<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt'><a =
href=3D"https://datatracker.ietf.org/doc/minutes-98-mile/">https://datatr=
acker.ietf.org/doc/minutes-98-mile/</a><o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US style=3D'font-size:11.0pt'>Let us =
thank Chris Inacio and Roman Danyliw very much for taking care of the =
note takes and jabber scribe.<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt'>Cheers,<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt'>Take<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt'><o:p>&nbsp;</o:p></span></p></div></body></htm=
l>
------=_NextPart_000_A29B_01D2A825.3A510410--


From nobody Tue Mar 28 10:58:07 2017
Return-Path: <internet-drafts@ietf.org>
X-Original-To: mile@ietf.org
Delivered-To: mile@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C5D61293E8; Tue, 28 Mar 2017 10:58:05 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <i-d-announce@ietf.org>
Cc: mile@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 6.48.1
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <149072388532.1299.17148611493568013144@ietfa.amsl.com>
Date: Tue, 28 Mar 2017 10:58:05 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/wJPsaZqIPjAdOtjuv0bHeQ42F7I>
Subject: [mile] I-D Action: draft-ietf-mile-xmpp-grid-02.txt
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Mar 2017 17:58:05 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Managed Incident Lightweight Exchange of the IETF.

        Title           : XMPP Protocol Extensions for Use with IODEF
        Authors         : Nancy Cam-Winget
                          Syam Appala
                          Scott Pope
	Filename        : draft-ietf-mile-xmpp-grid-02.txt
	Pages           : 46
	Date            : 2017-03-28

Abstract:
   This document describes the extensions made to Extensible Messaging
   and Presence Protocol (XMPP) [RFC6120]that enables the use of XMPP as
   a transport protocol for collecting and distributing any security
   telemetry information between and among network platforms, endpoints,
   and most any network connected device.  Specifically, this document
   will focus on how these extensions can be used to transport the
   Incident Object Description Exchange Format (IODEF) information.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-xmpp-grid/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-mile-xmpp-grid-02
https://datatracker.ietf.org/doc/html/draft-ietf-mile-xmpp-grid-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-xmpp-grid-02


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Tue Mar 28 10:58:19 2017
Return-Path: <internet-drafts@ietf.org>
X-Original-To: mile@ietf.org
Delivered-To: mile@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7076E129712; Tue, 28 Mar 2017 10:58:05 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <mile@ietf.org>, <mile-chairs@tools.ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.48.1
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <149072388545.1299.15472172310602482399.idtracker@ietfa.amsl.com>
Date: Tue, 28 Mar 2017 10:58:05 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/AidOpZD3FqmgBcl4NJs22R-jrfs>
Subject: [mile] New Version Notification - draft-ietf-mile-xmpp-grid-02.txt
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Mar 2017 17:58:05 -0000

A new version (-02) has been submitted for draft-ietf-mile-xmpp-grid:
https://www.ietf.org/internet-drafts/draft-ietf-mile-xmpp-grid-02.txt


The IETF datatracker page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-xmpp-grid/

Diff from previous version:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-xmpp-grid-02

Please note that it may take a couple of minutes from the time of submission
until the diff is available at tools.ietf.org.

IETF Secretariat.


From nobody Tue Mar 28 16:27:24 2017
Return-Path: <ncamwing@cisco.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E7FD12949D for <mile@ietfa.amsl.com>; Tue, 28 Mar 2017 16:27:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.522
X-Spam-Level: 
X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WLipxl7A0Vc6 for <mile@ietfa.amsl.com>; Tue, 28 Mar 2017 16:27:20 -0700 (PDT)
Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6465F126D73 for <mile@ietf.org>; Tue, 28 Mar 2017 16:27:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4214; q=dns/txt; s=iport; t=1490743640; x=1491953240; h=from:to:subject:date:message-id:mime-version; bh=xQfk3rwISOjruiqEgebVjbdQc0orKcE4zAhPDZ97ock=; b=CjECc5KQYn7lrUOpEk6bsPfC8o83OHeHyqDTnJu0FcR3yW1cWC1ASA18 XcgeK+dj7aJ13XIPcerf2yui4ni019zVXOKxzO4aOXEMJ/WD9Lm4r+p4q Oj1+PVamMbwFScOSTnsvdL3EXGCij6CNltvMXQQjmAjGuwh6rP3A4OwrI E=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DWAgCp8NpY/5pdJa1dGwEBAQMBAQEJA?= =?us-ascii?q?QEBgm5mYYESg1uKD6FsgyKCD4IOKoYUgws/GAECAQEBAQEBAWsdC4U5BmgBDD4?= =?us-ascii?q?CBDAnBIoaDp1lkAaCJiuKIgEBAQEBAQEDAQEBAQEBAQEBGgWIU4pELoIxBZxgA?= =?us-ascii?q?YFThSiLU4F8hSqKDZNpAR84gQRZFVIBhkaJOoENAQEB?=
X-IronPort-AV: E=Sophos;i="5.36,238,1486425600";  d="scan'208,217";a="400504762"
Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Mar 2017 23:27:19 +0000
Received: from XCH-RTP-013.cisco.com (xch-rtp-013.cisco.com [64.101.220.153]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id v2SNRJbQ002186 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for <mile@ietf.org>; Tue, 28 Mar 2017 23:27:19 GMT
Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-013.cisco.com (64.101.220.153) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 28 Mar 2017 19:27:18 -0400
Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1210.000; Tue, 28 Mar 2017 19:27:18 -0400
From: "Nancy Cam-Winget (ncamwing)" <ncamwing@cisco.com>
To: "mile@ietf.org" <mile@ietf.org>
Thread-Topic: Working group last call for ROLIE
Thread-Index: AQHSqBrX3wNPiZjeRUuG2OC1scqiSg==
Date: Tue, 28 Mar 2017 23:27:18 +0000
Message-ID: <CC7AB8C2-66EC-4B75-9CFA-F9A1D7A9C46D@cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/f.1a.0.160910
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.24.91.200]
Content-Type: multipart/alternative; boundary="_000_CC7AB8C266EC4B759CFAF9A1D7A9C46Dciscocom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/wZntYyPm0tZhlBcupohPYn2dn3U>
Subject: [mile] Working group last call for ROLIE
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Mar 2017 23:27:22 -0000

--_000_CC7AB8C266EC4B759CFAF9A1D7A9C46Dciscocom_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

Q29sbGVhZ3VlcywNCg0KR2l2ZW4gdGhlIHNpZ25pZmljYW50IGNoYW5nZXMgbWFkZSB0byB0aGUg
bGFzdCBkcmFmdCwgd2UgYXJlIGRvaW5nIGFub3RoZXIgMzBkYXkgV0dMQyBmb3INCmh0dHBzOi8v
dG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLW1pbGUtcm9saWUtMDYNCg0KUGxlYXNlIHBy
b3ZpZGUgY29tbWVudHMgYmVmb3JlIE1heSAxc3QgYW5kIHByb3ZpZGUgeW91ciBzdXBwb3J0IGFu
ZC8gb3IgcmFpc2UgYW55IGlzc3VlIHlvdSBmZWVsIGFyZSB5ZXQgdG8gYmUgYWRkcmVzc2VkLg0K
DQpSZWdhcmRzLCBOYW5jeQ0K

--_000_CC7AB8C266EC4B759CFAF9A1D7A9C46Dciscocom_
Content-Type: text/html; charset="utf-8"
Content-ID: <FEBC1FCD16ED8B4599B47AAFEAA9740E@emea.cisco.com>
Content-Transfer-Encoding: base64

PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4
bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo
dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo
dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp
dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l
dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu
dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg
KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N
CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0
IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ
cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N
CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN
CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls
eTpDYWxpYnJpO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y
aXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph
OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5
Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFu
LkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQt
ZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLm1zb0lucw0KCXttc28t
c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCgltc28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29y
YXRpb246dW5kZXJsaW5lOw0KCWNvbG9yOnRlYWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0
eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpAcGFnZSBXb3Jk
U2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGlu
IDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9z
dHlsZT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0i
IzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw
IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Db2xsZWFn
dWVzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0
eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj
bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+R2l2ZW4gdGhl
IHNpZ25pZmljYW50IGNoYW5nZXMgbWFkZSB0byB0aGUgbGFzdCBkcmFmdCwgd2UgYXJlIGRvaW5n
IGFub3RoZXIgMzBkYXkgV0dMQyBmb3I8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i
TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PGEgaHJlZj0iaHR0cHM6
Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtbWlsZS1yb2xpZS0wNiI+aHR0cHM6Ly90
b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtbWlsZS1yb2xpZS0wNjwvYT48bzpwPjwvbzpw
Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl
OjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h
bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlBsZWFzZSBwcm92aWRlIGNvbW1lbnRz
IGJlZm9yZSBNYXkgMTxzdXA+c3Q8L3N1cD4gYW5kIHByb3ZpZGUgeW91ciBzdXBwb3J0IGFuZC8g
b3IgcmFpc2UgYW55IGlzc3VlIHlvdSBmZWVsIGFyZSB5ZXQgdG8gYmUgYWRkcmVzc2VkLjxvOnA+
PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250
LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv
Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+UmVnYXJkcywgTmFuY3k8bzpw
PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg==

--_000_CC7AB8C266EC4B759CFAF9A1D7A9C46Dciscocom_--


From nobody Tue Mar 28 16:29:22 2017
Return-Path: <ncamwing@cisco.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6A4B12708C for <mile@ietfa.amsl.com>; Tue, 28 Mar 2017 16:29:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.522
X-Spam-Level: 
X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3eFz6DTvpHQd for <mile@ietfa.amsl.com>; Tue, 28 Mar 2017 16:29:18 -0700 (PDT)
Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA53D1242F7 for <mile@ietf.org>; Tue, 28 Mar 2017 16:29:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4132; q=dns/txt; s=iport; t=1490743758; x=1491953358; h=from:to:subject:date:message-id:mime-version; bh=LS+GW1daLU1sSgK/ukzv0xQ4yZtVAUjFk/IpBwd4dBI=; b=fBGQkNnKSZ04ZzZmYZh0lI9cRNQG/ZEZU/Bw5utzSCDbkSEv+fabIk+1 NoeB2PMxsMxJnFtcgV//89mCvA/y+NN3xMrVcJTU9X7Gxp4ABZMP+Z9Ey dxMYIWOvK9bLgiRoE+hp2XfvMeq2L0linPUi33xBpbCta9v4wswtcMH9K I=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0COAwCp8NpY/4wNJK1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgm5mYYESg1uKD5EykDqDIoIPgg4qhhSDCz8YAQIBAQEBAQEBax0LhTk?= =?us-ascii?q?GaAEMPgIEMCcEihoOnWWQBoImK4oiAQEBAQEBAQMBAQEBAQEBAQEaBYhTCIo8L?= =?us-ascii?q?oIxBZxgAYZ7i1OBfIUqig2TaQEfOIEEWRVSAYZGiTqBDQEBAQ?=
X-IronPort-AV: E=Sophos;i="5.36,238,1486425600";  d="scan'208,217";a="403324596"
Received: from alln-core-7.cisco.com ([173.36.13.140]) by alln-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 28 Mar 2017 23:29:17 +0000
Received: from XCH-RTP-014.cisco.com (xch-rtp-014.cisco.com [64.101.220.154]) by alln-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id v2SNTGCB015509 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for <mile@ietf.org>; Tue, 28 Mar 2017 23:29:17 GMT
Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-014.cisco.com (64.101.220.154) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 28 Mar 2017 19:29:16 -0400
Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1210.000; Tue, 28 Mar 2017 19:29:16 -0400
From: "Nancy Cam-Winget (ncamwing)" <ncamwing@cisco.com>
To: "mile@ietf.org" <mile@ietf.org>
Thread-Topic: Working Group Last Call for IODEF Guidance
Thread-Index: AQHSqBsdzaOykKabgkq+aGKpuqOHZA==
Date: Tue, 28 Mar 2017 23:29:15 +0000
Message-ID: <7CE030B4-2629-4333-AEBA-3305D90FBBD0@cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/f.1a.0.160910
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.24.91.200]
Content-Type: multipart/alternative; boundary="_000_7CE030B426294333AEBA3305D90FBBD0ciscocom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/OOuH9Fr7hp3NYPMVh-Wpf2qwmJw>
Subject: [mile] Working Group Last Call for IODEF Guidance
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Mar 2017 23:29:20 -0000

--_000_7CE030B426294333AEBA3305D90FBBD0ciscocom_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

Q29sbGVhZ3VlcywNCg0KV2UgYXJlIGRvaW5nIGFub3RoZXIgV0dMQyBmb3IgaHR0cHM6Ly9kYXRh
dHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1pZXRmLW1pbGUtaW9kZWYtZ3VpZGFuY2UN
Cg0KUGxlYXNlIHByb3ZpZGUgY29tbWVudHMgYmVmb3JlIE1heSAxc3QgYW5kIHByb3ZpZGUgeW91
ciBzdXBwb3J0IGFuZC8gb3IgcmFpc2UgYW55IGlzc3VlIHlvdSBmZWVsIGFyZSB5ZXQgdG8gYmUg
YWRkcmVzc2VkLg0KDQpSZWdhcmRzLCBOYW5jeQ0KDQo=

--_000_7CE030B426294333AEBA3305D90FBBD0ciscocom_
Content-Type: text/html; charset="utf-8"
Content-ID: <96E94CE94E71DE4E965664BFE5A53D28@emea.cisco.com>
Content-Transfer-Encoding: base64

PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4
bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo
dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo
dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp
dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l
dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu
dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg
KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N
CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0
IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ
cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N
CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN
CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls
eTpDYWxpYnJpO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y
aXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph
OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5
Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFu
LkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQt
ZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLm1zb0lucw0KCXttc28t
c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCgltc28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29y
YXRpb246dW5kZXJsaW5lOw0KCWNvbG9yOnRlYWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0
eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpAcGFnZSBXb3Jk
U2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGlu
IDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9z
dHlsZT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0i
IzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw
IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Db2xsZWFn
dWVzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0
eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj
bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+V2UgYXJlIGRv
aW5nIGFub3RoZXIgV0dMQyBmb3INCjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5v
cmcvZG9jL2h0bWwvZHJhZnQtaWV0Zi1taWxlLWlvZGVmLWd1aWRhbmNlIj5odHRwczovL2RhdGF0
cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LWlldGYtbWlsZS1pb2RlZi1ndWlkYW5jZTwv
YT4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0
eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj
bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+UGxlYXNlIHBy
b3ZpZGUgY29tbWVudHMgYmVmb3JlIE1heSAxPHN1cD5zdDwvc3VwPiBhbmQgcHJvdmlkZSB5b3Vy
IHN1cHBvcnQgYW5kLyBvciByYWlzZSBhbnkgaXNzdWUgeW91IGZlZWwgYXJlIHlldCB0byBiZSBh
ZGRyZXNzZWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw
YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N
CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5SZWdh
cmRzLCBOYW5jeTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz
cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+
DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg==

--_000_7CE030B426294333AEBA3305D90FBBD0ciscocom_--


From nobody Wed Mar 29 03:56:37 2017
Return-Path: <internet-drafts@ietf.org>
X-Original-To: mile@ietf.org
Delivered-To: mile@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 16AE2129477; Wed, 29 Mar 2017 03:56:31 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: <i-d-announce@ietf.org>
Cc: mile@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 6.48.1
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <149078499105.1303.4578218906164088815@ietfa.amsl.com>
Date: Wed, 29 Mar 2017 03:56:31 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/aniPmiyH4Om94d61t4itelU-Bgs>
Subject: [mile] I-D Action: draft-ietf-mile-iodef-guidance-09.txt
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 10:56:31 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Managed Incident Lightweight Exchange of the IETF.

        Title           : IODEF Usage Guidance
        Authors         : Panos Kampanakis
                          Mio Suzuki
	Filename        : draft-ietf-mile-iodef-guidance-09.txt
	Pages           : 34
	Date            : 2017-03-29

Abstract:
   The Incident Object Description Exchange Format v2 [RFC7970] defines
   a data representation that provides a framework for sharing
   information commonly exchanged by Computer Security Incident Response
   Teams (CSIRTs) about computer security incidents.  Since the IODEF
   model includes a wealth of available options that can be used to
   describe a security incident or issue, it can be challenging for
   security practitioners to develop tools that can leverage IODEF for
   incident sharing.  This document provides guidelines for IODEF
   practitioners.  It also addresses how common security indicators can
   be represented in IODEF and use-cases of how IODEF is being.  The
   goal of this document is to make IODEF's adoption by vendors easier
   and encourage faster and wider adoption of the model by Computer
   Security Incident Response Teams (CSIRTs) around the world.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-mile-iodef-guidance-09
https://datatracker.ietf.org/doc/html/draft-ietf-mile-iodef-guidance-09

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-iodef-guidance-09


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Wed Mar 29 04:15:06 2017
Return-Path: <mio@nict.go.jp>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B075F129697 for <mile@ietfa.amsl.com>; Wed, 29 Mar 2017 04:15:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pGhwPbEV3NJS for <mile@ietfa.amsl.com>; Wed, 29 Mar 2017 04:15:02 -0700 (PDT)
Received: from ns2.nict.go.jp (ns2.nict.go.jp [IPv6:2001:df0:232:300::2]) by ietfa.amsl.com (Postfix) with ESMTP id E6BAB126B6E for <mile@ietf.org>; Wed, 29 Mar 2017 04:15:01 -0700 (PDT)
Received: from gw2.nict.go.jp (gw2.nict.go.jp [133.243.18.251]) by ns2.nict.go.jp  with ESMTP id v2TBF1ol072709 for <mile@ietf.org>; Wed, 29 Mar 2017 20:15:01 +0900 (JST)
Received: from mail1.nict.go.jp (mail1.nict.go.jp [133.243.18.14]) by gw2.nict.go.jp  with ESMTP id v2TBF0ft072666; Wed, 29 Mar 2017 20:15:00 +0900 (JST)
Received: from [127.0.0.1] (ssh1.nict.go.jp [133.243.3.49]) by mail1.nict.go.jp (NICT Mail Spool Server1) with ESMTP id DB689A230; Wed, 29 Mar 2017 20:14:59 +0900 (JST)
From: Mio Suzuki <mio@nict.go.jp>
Message-Id: <14680E2D-BA9C-4ED1-9095-E36A5BE2C5DC@nict.go.jp>
Content-Type: multipart/signed; boundary="Apple-Mail=_F97CD41C-9BB7-4023-9D4B-5B8084CD04FE"; protocol="application/pkcs7-signature"; micalg=sha1
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Date: Wed, 29 Mar 2017 06:14:58 -0500
In-Reply-To: <149078499105.1303.4578218906164088815@ietfa.amsl.com>
To: MILE IETF <mile@ietf.org>
References: <149078499105.1303.4578218906164088815@ietfa.amsl.com>
X-Mailer: Apple Mail (2.3273)
X-Virus-Scanned: clamav-milter 0.98.7 at zenith2
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/e64QdelbcZJunmA0H4VfnNJ4bJA>
Subject: Re: [mile] I-D Action: draft-ietf-mile-iodef-guidance-09.txt
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 11:15:05 -0000

--Apple-Mail=_F97CD41C-9BB7-4023-9D4B-5B8084CD04FE
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hello, Roman, Adam, Chris and other reviewers for this draft,=20

I apologize if anyone have already read the old draft. Could you review =
this new version? The change from -08 to -09 is "Appendix B. B.5." only.=20=


Regards,
Mio

> 2017/03/29 5:56=E3=80=81internet-drafts@ietf.org
>=20
>=20
> A New Internet-Draft is available from the on-line Internet-Drafts =
directories.
> This draft is a work item of the Managed Incident Lightweight Exchange =
of the IETF.
>=20
>        Title           : IODEF Usage Guidance
>        Authors         : Panos Kampanakis
>                          Mio Suzuki
> 	Filename        : draft-ietf-mile-iodef-guidance-09.txt
> 	Pages           : 34
> 	Date            : 2017-03-29
>=20
> Abstract:
>   The Incident Object Description Exchange Format v2 [RFC7970] defines
>   a data representation that provides a framework for sharing
>   information commonly exchanged by Computer Security Incident =
Response
>   Teams (CSIRTs) about computer security incidents.  Since the IODEF
>   model includes a wealth of available options that can be used to
>   describe a security incident or issue, it can be challenging for
>   security practitioners to develop tools that can leverage IODEF for
>   incident sharing.  This document provides guidelines for IODEF
>   practitioners.  It also addresses how common security indicators can
>   be represented in IODEF and use-cases of how IODEF is being.  The
>   goal of this document is to make IODEF's adoption by vendors easier
>   and encourage faster and wider adoption of the model by Computer
>   Security Incident Response Teams (CSIRTs) around the world.
>=20
>=20
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance/
>=20
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-mile-iodef-guidance-09
> =
https://datatracker.ietf.org/doc/html/draft-ietf-mile-iodef-guidance-09
>=20
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-mile-iodef-guidance-09
>=20
>=20
> Please note that it may take a couple of minutes from the time of =
submission
> until the htmlized version and diff are available at tools.ietf.org.
>=20
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>=20
> _______________________________________________
> mile mailing list
> mile@ietf.org
> https://www.ietf.org/mailman/listinfo/mile


--Apple-Mail=_F97CD41C-9BB7-4023-9D4B-5B8084CD04FE
Content-Disposition: attachment;
	filename=smime.p7s
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIKdTCCBOgw
ggPQoAMCAQICDkgbagkTvYAkyl0i8BTzMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2Jh
bFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxT
aWduMB4XDTE2MDYxNTAwMDAwMFoXDTI0MDYxNTAwMDAwMFowXTELMAkGA1UEBhMCQkUxGTAXBgNV
BAoTEEdsb2JhbFNpZ24gbnYtc2ExMzAxBgNVBAMTKkdsb2JhbFNpZ24gUGVyc29uYWxTaWduIDIg
Q0EgLSBTSEEyNTYgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALaWaJNl/SwB
7GKjDVS/i8ukQ5Gimq+xg/K1bW/Z8OrczxZ71xnjhAOF+cYfcI8fbEnFaRkecJE4NX4CSF05axhE
pmqlyHT0XfWEPmMfcUSCCD7tyaf26W4mQSmAyUm6/9l2oKO7G/Z530so00p7nFHCD2VQoZ+oSp3l
RgSNg0/cssg9z5ghCZhMwPGPeqk/NyZlR9hmj0kmwsNAvmY9bP86rSlG8BOc4fLrmaeLwtNfUG2i
Dm/HBpc4L06hjkcCtIMA2KTjukEHYOXdN1ryB8E7p5yXaC6376lINrzpaaiZqkfpx/ZR0vmxLLbF
SbWYnlNT2vty83wP+HE+1wP6Z8MCAwEAAaOCAbUwggGxMA4GA1UdDwEB/wQEAwIBBjBqBgNVHSUE
YzBhBggrBgEFBQcDAgYIKwYBBQUHAwQGCCsGAQUFBwMJBgorBgEEAYI3FAICBgorBgEEAYI3CgME
BgkrBgEEAYI3FQYGCisGAQQBgjcKAwwGCCsGAQUFBwMHBggrBgEFBQcDETASBgNVHRMBAf8ECDAG
AQH/AgEAMB0GA1UdDgQWBBRpcoJiMWeVRIV3kYDEBDZJnXsLYTAfBgNVHSMEGDAWgBSP8Et/qC5F
JK5NUPpjmove4t0bvDA+BggrBgEFBQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwMi5n
bG9iYWxzaWduLmNvbS9yb290cjMwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxz
aWduLmNvbS9yb290LXIzLmNybDBnBgNVHSAEYDBeMAsGCSsGAQQBoDIBKDAMBgorBgEEAaAyASgK
MEEGCSsGAQQBoDIBXzA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9y
ZXBvc2l0b3J5LzANBgkqhkiG9w0BAQsFAAOCAQEAqJ3NMsx8Z+ILUNelXHCjZuIl7+q0tlMwbocS
N1wz4sIoVuOTvUWV81jYFXFM8+SCiRS+/qXMR73rBlSCPua/vvXqiPV5xCgiC4x69g4L4yquSZoO
m8In8my2G1VKAbYZ4WhQdFi8EkUYT67eXhsTMOdVJjSAov4UigSrB4RhUhGiUAC2cuBy9BFnbhOi
C2AI1+gUl0Q7RxXlD3XW+On+R3+a8yExi7J/QSKaDla4EvO/DuCZ31FkItvcgX5++R2o4nxbzwvr
qp/q3FZ766S4LCzmBv+uJFl/xUR/PpoVXvpnEl98bFKXMSvavby01ba6FP8iVJhAuDnB+XULGxwa
ozCCBYUwggRtoAMCAQICDGOZ7qJg+PRUYAwceDANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJC
RTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEzMDEGA1UEAxMqR2xvYmFsU2lnbiBQZXJzb25h
bFNpZ24gMiBDQSAtIFNIQTI1NiAtIEczMB4XDTE2MTAyNzA1NDgyMVoXDTE3MTAyODA1NDgyMVow
gdAxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIEwVUb2t5bzEQMA4GA1UEBxMHS29nYW5laTFIMEYGA1UE
ChM/TmF0aW9uYWwgSW5zdGl0dXRlIG9mIEluZm9ybWF0aW9uIGFuZCBDb21tdW5pY2F0aW9ucyBU
ZWNobm9sb2d5MSEwHwYDVQQLExhDeWJlcnNlY3VyaXR5IExhYm9yYXRvcnkxEzARBgNVBAMTCk1p
byBTdXp1a2kxHTAbBgkqhkiG9w0BCQEWDm1pb0BuaWN0LmdvLmpwMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEA0cFS+wfgnyC7WP1mvW5HWv8wCctiK0X/YdtMe9Lpl2UspyJnKeGPzHDA
QeGXVJwnBSlZ6DKu2L1MtDz0KthjO61YyA68BPwi3jffg2qTbtZ3OIt+FmtxHx6tYvJApI0tWH2a
K8YuOpu/JMdQmZ+qAtTbNfFktJQAvYNldXTqgNfOh4MhCfcfmJKKAuUnP7r8yUk/rHLok2fX6Boc
h/hIxPINKS5bY4yOVwsNTlrDHUA4skmQ+UxuaKlk6IcNAwHbvYwvDXhKxvCpWxq4oxHxfubAc1BT
dJi1rXmx9yBL0cEw/WtKaSzSym64YfJaA5OYMEhWkEoyWwTeHMvSOtX8xwIDAQABo4IBzzCCAcsw
DgYDVR0PAQH/BAQDAgWgMIGeBggrBgEFBQcBAQSBkTCBjjBNBggrBgEFBQcwAoZBaHR0cDovL3Nl
Y3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3NwZXJzb25hbHNpZ24yc2hhMmczb2NzcC5jcnQw
PQYIKwYBBQUHMAGGMWh0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc3BlcnNvbmFsc2lnbjJz
aGEyZzMwTQYDVR0gBEYwRDBCBgorBgEEAaAyASgKMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3
Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMAkGA1UdEwQCMAAwRAYDVR0fBD0wOzA5oDegNYYz
aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9nc3BlcnNvbmFsc2lnbjJzaGEyZzMuY3JsMBkGA1Ud
EQQSMBCBDm1pb0BuaWN0LmdvLmpwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV
HQ4EFgQUmOYO1/CvMxghg73M+Xkm3hrP9F4wHwYDVR0jBBgwFoAUaXKCYjFnlUSFd5GAxAQ2SZ17
C2EwDQYJKoZIhvcNAQELBQADggEBABKwZW6fG0HhfkHkd7cYky1+IXVhetKUBkxXeAIP/ylG+lED
RgWi4Ozb2B/p0fhqXlcqbrWu4pxsqrPkOWOdfEwLSQd7lpeC7BxFNp6dbpZTAHWMaYzGqbNSQA5N
W7krPDFXgBdb0pXGklMpCTAmqft3d7n50IdbqwzNXH7ACxYHszYWxpHsxvu8M6qQC8MeLMjV1vs1
0GIyj2OhrwWRLreAPdj/wNzvF+ejZyqr/kmFYOrpTqasRVaEVpKJpMeK1OvZj1tzAVXpLrqwundf
FvO7LOP3w5ziqKGoV5Y3H24jILy1EBzTZdRxXROjhhyFP1H/qn2WS0HMY22uaUTlHU0xggLzMIIC
7wIBATBtMF0xCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTMwMQYDVQQD
EypHbG9iYWxTaWduIFBlcnNvbmFsU2lnbiAyIENBIC0gU0hBMjU2IC0gRzMCDGOZ7qJg+PRUYAwc
eDAJBgUrDgMCGgUAoIIBWzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP
Fw0xNzAzMjkxMTE0NTlaMCMGCSqGSIb3DQEJBDEWBBRO5pE9j+N6LetQyAxc7ptMJQxMLDB8Bgkr
BgEEAYI3EAQxbzBtMF0xCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTMw
MQYDVQQDEypHbG9iYWxTaWduIFBlcnNvbmFsU2lnbiAyIENBIC0gU0hBMjU2IC0gRzMCDGOZ7qJg
+PRUYAwceDB+BgsqhkiG9w0BCRACCzFvoG0wXTELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2Jh
bFNpZ24gbnYtc2ExMzAxBgNVBAMTKkdsb2JhbFNpZ24gUGVyc29uYWxTaWduIDIgQ0EgLSBTSEEy
NTYgLSBHMwIMY5nuomD49FRgDBx4MA0GCSqGSIb3DQEBAQUABIIBALlU4JYKb/ZQ+wjqCojHOqoz
bKazFtywx+u/CcuAzHJs1nM3s9L7oHnaG51rfXpUvOgRUQE+0nb7oeLU693l9cUVGyr7Rf8djBF5
gwmkRSaPEa9aQb8Y+2PKTuKEXXINuTQIkh6LqR1PnIx+/m3ENYl0rDN1THpjTMZhKp+J9FqOJuhz
BlB5XSJnW2hRICK3cb+4v28Zu6KcNdkavssTbWxzeq1/TasO+1wgbWcFaLa8Er0JS4KrcH2qZWnV
e3ripHmMsgWq0emCXtHFRh+siZ/K7C8j/GgUybC86qZmZge+pFeblSWuFVTHWnHoI/bE/Tbj+TaJ
y9h+Luk1K4qCmqMAAAAAAAA=
--Apple-Mail=_F97CD41C-9BB7-4023-9D4B-5B8084CD04FE--


From nobody Thu Mar 30 08:06:14 2017
Return-Path: <ietf-secretariat-reply@ietf.org>
X-Original-To: mile@ietf.org
Delivered-To: mile@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id ADC18129681 for <mile@ietf.org>; Thu, 30 Mar 2017 08:06:12 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
To: <mile@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.49.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <149088637270.15473.11081271753459390242.idtracker@ietfa.amsl.com>
Date: Thu, 30 Mar 2017 08:06:12 -0700
From: IETF Secretariat <ietf-secretariat-reply@ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/bKXF_776bzZb4IGwsvuteiT9KpI>
Subject: [mile] Milestones changed for mile WG
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Mar 2017 15:06:13 -0000

Changed milestone "Submit an update of RFC5070 to the IESG for
publication as a Standards Track RFC", resolved as "Done".

Changed milestone "Submit a draft on RESTful indicator exchange using
IODEF/RID to the IESG for publication as an Informational RFC", set
due date to March 2017 from November 2016.

Changed milestone "Submit a draft on XMPP Protocol Extensions for Use
with IODEF", set due date to March 2017 from November 2016.

Changed milestone "Submit a draft on guidance for IODEF applications
to the IESG for publication as an Informational RFC", set due date to
March 2017 from December 2016.

URL: https://datatracker.ietf.org/wg/mile/about/


From nobody Thu Mar 30 14:10:47 2017
Return-Path: <mjethanandani@gmail.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BDC9129583; Thu, 30 Mar 2017 14:10:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B7MuL1UCXfPV; Thu, 30 Mar 2017 14:10:23 -0700 (PDT)
Received: from mail-pg0-x22d.google.com (mail-pg0-x22d.google.com [IPv6:2607:f8b0:400e:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60722129483; Thu, 30 Mar 2017 14:09:32 -0700 (PDT)
Received: by mail-pg0-x22d.google.com with SMTP id g2so49777515pge.3; Thu, 30 Mar 2017 14:09:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;  h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=d7n0OsvI/E7+Yq5EncNM9IcshiVZcXglle39gzrq8Dc=; b=ih8nvURFKBQYdAAxqj3PCbkKDGGUS1bUlcMZMvwAAyBvP1fG38yLaZn79WUrK3U+HM Anoq9z+WGsfkWUoodyGhb/GbsF9+iRSMwPK4OvVq0Hx20Ro2KmxK5Wgwkh5AfEvKMa8R E7Sml4iBo6oVeEQGJ7YYLD3kY8yQOoJgSXaEcJ8SjGACxId1GoPpfJjgp30kd8li5FU8 A79ORrCsbHXkFCCQl2brQfUWPO6DTO04TJ1LCxIcghZO1bAY0hYx/7DvjibAEtGryjEQ 2Q3/fC6BWTTCVebtBixpsYxYu006keBevnABnk3L9YY1wMIV14cTXCQNCVaHS7Ie5t0v KWFA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=d7n0OsvI/E7+Yq5EncNM9IcshiVZcXglle39gzrq8Dc=; b=n+62Z6GQQGvBUky4ktktzai45icgI+TN/HFngZMkhFbHOsiumoQyWUFZwGzhAaH95f bezxVHU4g0j1A/tdkVQmNMvvwB0UE0jCHYddCWUpRWbtQtrrbDWGtvhYsFNfJl5DRJEq i/6b73/S3EMQExTXobywjdcB7JxD5oPU8Mpd7GBR6tqOY+gt7zt7CrtquN7o9WRvmmzd 2Yx7NK/qKUjg8JwS/tVk3Ox8YlVDg6kV22eGbe6/sE/2Pyz/PZYjapM0t4pIxONczuBy 8WMVJZvHMd/QuwKQT+jacuOzabfKd9fjGZ45/uJflnkyekotX2mXpFLL7P7SeU3vYPv/ hdeA==
X-Gm-Message-State: AFeK/H1FThdrfqT9Yk+sPekffJkWhKQQ9ykryI8h8495srZHvSZPFu2vOuSuX6biZUxX2g==
X-Received: by 10.84.149.168 with SMTP id m37mr1342822pla.97.1490908171684; Thu, 30 Mar 2017 14:09:31 -0700 (PDT)
Received: from ?IPv6:2001:420:c0c8:1006::483? ([2001:420:c0c8:1006::483]) by smtp.gmail.com with ESMTPSA id b80sm6178658pfe.87.2017.03.30.14.09.30 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 30 Mar 2017 14:09:30 -0700 (PDT)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Mahesh Jethanandani <mjethanandani@gmail.com>
In-Reply-To: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>
Date: Thu, 30 Mar 2017 16:09:28 -0500
Cc: "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>, "mile@ietf.org" <mile@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>
To: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
X-Mailer: Apple Mail (2.3124)
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/_e7m53g17mwiKtw9fbGIt84SEdk>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Mar 2017 21:10:26 -0000

David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) =
<david.waltermire@nist.gov> wrote:
>=20
>=20
> The US Government has been working within the IETF SACM work group to =
standardize the collection of endpoint configuration and other posture =
information from enterprise endpoints. Collecting this information is =
critical to support automation of common network security tasks, =
including asset, software, vulnerability, and configuration management. =
Thus far, our efforts have focused primarily on standards to collect =
information in support of asset, software and vulnerability management =
use cases, and has worked with other IETF members to determine what data =
would need to be to be collected, and how that data would be securely =
communicated across the network. Through such exchanges an organization =
can know what client endpoints are connected to their network, and if =
they are vulnerable to attack.
>=20
> Given the proliferation of attacks against network infrastructure =
devices, it is clear that the next step in our enterprise security =
automation effort must be to enable standardized reporting of similar =
information from network infrastructure devices. With the growing number =
of Yang models and increased adoption of NETCONF, RESTCONF, and related =
protocol work, the time is right to work out how these standards can be =
used to measure the health of network devices. This information will, as =
in our efforts in SACM for client devices, support asset, software, =
vulnerability, and configuration management use cases. Standards-based =
reporting of this information from network infrastructure devices will =
help network defenders protect against known attacks, and provide the =
necessary knowledge to detect and mitigate future attacks.=20
>=20
> We would like to start a discussion about how to leverage the existing =
IETF network management protocols to best address security automation =
for network infrastructure devices. We would like your ideas on how to =
best pursue this work, and your insights into network infrastructure =
security problems that will impact our networks in the future. We are =
holding a side meeting at IETF 98 on Wednesday, March 29th at 6:30pm CDT =
to start a discussion about how to move forward. We will be meeting in =
Vevey 4 at the IETF meeting venue.

Maybe this was discussed in the BoF =E2=80=A6

The best way to have a discussion would be to present the proposal in =
the form of a draft in the NETCONF WG.

>=20
> Here is a summary of the meeting details:
>=20
> PANIC (Posture Assessment through Network Information Collection) Bar =
BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>=20
> We look forward to working with you, and hope to see you in Chicago at =
the PANIC Bar BoF.
>=20
> Regards,
> Dave
>=20
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>=20
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com




From nobody Thu Mar 30 14:38:34 2017
Return-Path: <david.waltermire@nist.gov>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EC5C12957A; Thu, 30 Mar 2017 14:38:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v7Vjhi8uSBcT; Thu, 30 Mar 2017 14:38:15 -0700 (PDT)
Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0125.outbound.protection.outlook.com [23.103.201.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1EF512953D; Thu, 30 Mar 2017 14:38:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=fhpXRk2GXCuvUgvGh+EBOd5yyb2hEdf9Y+A3Gg7UDCg=; b=sAc443pJMGmmB+rvDgp7auJLvAC5gpLiBEDJZEPjRDx2tjaJxhhxxBBYTBFaNYT7r1L5cEZW4xb2P1+pFGJJt/59jajXXYjQq6my+i+q4m3tW9sqUmVpH3e2B/srI8UyQ6J51tXSkLdqjMusOzw/hadQM6auuofO1ACthGQoF7I=
Received: from MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) by MWHPR09MB1439.namprd09.prod.outlook.com (10.173.50.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.991.14; Thu, 30 Mar 2017 21:38:12 +0000
Received: from MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) by MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) with mapi id 15.01.0991.022; Thu, 30 Mar 2017 21:38:12 +0000
From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
To: Mahesh Jethanandani <mjethanandani@gmail.com>
CC: "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>, "mile@ietf.org" <mile@ietf.org>
Thread-Topic: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8gDGe7oAAAEA4X8=
Date: Thu, 30 Mar 2017 21:38:12 +0000
Message-ID: <A406F4455056956FC17A5EEB332131B682A83BF7@unknown>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>, <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com>
In-Reply-To: <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=nist.gov;
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [2600:1008:b026:3c5b:880a:2104:6fcd:5c70]
x-microsoft-exchange-diagnostics: 1; MWHPR09MB1439; 7:fmv4/kXlxEmSHZh/xh02rUjNmsl0GtUs05jZK7Y5JFRT7yWIkni0cnk2SgQZQiUNjYRZoLTnk2WVzy2tCEDpK/MoPb0+MisFwIhwqY7uvEPHQImImx+ebtTn0hJtnaWMEmV7pq9rZr2QBgjyDuh9QztAe0k32sStINXMDl60EX5w7kYmusucQ30aor9koMF+Y8/Hu2M38uMklSJ8lRhVyow5dlcSQdFVdmvwNSf4UNqt3lKNTYgUjlssksNS34F6d7+giRWkjm1pv2qSf+qBTaFSFyyxEN9VzCtC8O2KSxODbLjhj9Rbo5kQIwP5FXsI/7rkguFdPdU4We0kC7Q3Vg==
x-ms-office365-filtering-correlation-id: 0b91b875-39a5-4d7b-8e91-08d477b510f1
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081);  SRVR:MWHPR09MB1439; 
x-microsoft-antispam-prvs: <MWHPR09MB143994626EFC3F46990E77D0F0340@MWHPR09MB1439.namprd09.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(158342451672863)(65766998875637)(192374486261705)(211171220733660)(148717330147763);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(6041248)(201703131423075)(201702281528075)(201703061421075)(20161123562025)(20161123560025)(20161123555025)(20161123564025)(6072148); SRVR:MWHPR09MB1439; BCL:0; PCL:0; RULEID:; SRVR:MWHPR09MB1439; 
x-forefront-prvs: 02622CEF0A
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39840400002)(39850400002)(39450400003)(39400400002)(39410400002)(24454002)(377454003)(33716001)(2950100002)(81166006)(229853002)(8676002)(8936002)(1411001)(2900100001)(2860100001)(7736002)(102836003)(2920100001)(6116002)(86362001)(3280700002)(5660300001)(3660700001)(7906003)(55846006)(6916009)(6486002)(77096006)(2906002)(6506006)(606005)(6436002)(99286003)(6306002)(9686003)(54896002)(54906002)(6512007)(53936002)(561944003)(76176999)(54356999)(236005)(39060400002)(110136004)(33656002)(38730400002)(4326008)(6246003)(25786009)(122556002)(189998001)(50986999)(82676001); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR09MB1439; H:MWHPR09MB1440.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; 
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_A406F4455056956FC17A5EEB332131B682A83BF7unknown_"
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Mar 2017 21:38:12.1393 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR09MB1439
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/U5qKhsmzF_SX6AqN8hYb8ad0mbs>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Mar 2017 21:38:19 -0000

--_000_A406F4455056956FC17A5EEB332131B682A83BF7unknown_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

We plan to write up a description adddessing the problem and

________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <mjethanandani@gmail.com> wr=
ote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <david.waltermire=
@nist.gov> wrote:
>
>
> The US Government has been working within the IETF SACM work group to sta=
ndardize the collection of endpoint configuration and other posture informa=
tion from enterprise endpoints. Collecting this information is critical to =
support automation of common network security tasks, including asset, softw=
are, vulnerability, and configuration management. Thus far, our efforts hav=
e focused primarily on standards to collect information in support of asset=
, software and vulnerability management use cases, and has worked with othe=
r IETF members to determine what data would need to be to be collected, and=
 how that data would be securely communicated across the network. Through s=
uch exchanges an organization can know what client endpoints are connected =
to their network, and if they are vulnerable to attack.
>
> Given the proliferation of attacks against network infrastructure devices=
, it is clear that the next step in our enterprise security automation effo=
rt must be to enable standardized reporting of similar information from net=
work infrastructure devices. With the growing number of Yang models and inc=
reased adoption of NETCONF, RESTCONF, and related protocol work, the time i=
s right to work out how these standards can be used to measure the health o=
f network devices. This information will, as in our efforts in SACM for cli=
ent devices, support asset, software, vulnerability, and configuration mana=
gement use cases. Standards-based reporting of this information from networ=
k infrastructure devices will help network defenders protect against known =
attacks, and provide the necessary knowledge to detect and mitigate future =
attacks.
>
> We would like to start a discussion about how to leverage the existing IE=
TF network management protocols to best address security automation for net=
work infrastructure devices. We would like your ideas on how to best pursue=
 this work, and your insights into network infrastructure security problems=
 that will impact our networks in the future. We are holding a side meeting=
 at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion ab=
out how to move forward. We will be meeting in Vevey 4 at the IETF meeting =
venue.

Maybe this was discussed in the BoF =85

The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.

>
> Here is a summary of the meeting details:
>
> PANIC (Posture Assessment through Network Information Collection) Bar BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>
> We look forward to working with you, and hope to see you in Chicago at th=
e PANIC Bar BoF.
>
> Regards,
> Dave
>
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com




--_000_A406F4455056956FC17A5EEB332131B682A83BF7unknown_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<meta name=3D"Generator" content=3D"Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; pad=
ding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div id=3D"x_contentToMakeEditableId">
<div id=3D"x_content" dir=3D"ltr" class=3D"x_MaaS360PIMSDKComposeContentCon=
tainerClass" style=3D"margin-top:15px; margin-left:5px; color:black">
We plan to write up a description adddessing&nbsp;the problem and&nbsp;<br>
<br>
<div id=3D"x_signatureToRemoveId" style=3D"text-align:left!important">
<hr>
On: 30 March 2017 16:09, &quot;Mahesh Jethanandani&quot; &lt;mjethanandani@=
gmail.com&gt; wrote:<br>
</div>
</div>
</div>
</div>
<font size=3D"2"><span style=3D"font-size:10pt;">
<div class=3D"PlainText">David,<br>
<br>
&gt; On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) &lt;david.walt=
ermire@nist.gov&gt; wrote:<br>
&gt; <br>
&gt; <br>
&gt; The US Government has been working within the IETF SACM work group to =
standardize the collection of endpoint configuration and other posture info=
rmation from enterprise endpoints. Collecting this information is critical =
to support automation of common network
 security tasks, including asset, software, vulnerability, and configuratio=
n management. Thus far, our efforts have focused primarily on standards to =
collect information in support of asset, software and vulnerability managem=
ent use cases, and has worked with
 other IETF members to determine what data would need to be to be collected=
, and how that data would be securely communicated across the network. Thro=
ugh such exchanges an organization can know what client endpoints are conne=
cted to their network, and if they
 are vulnerable to attack.<br>
&gt; <br>
&gt; Given the proliferation of attacks against network infrastructure devi=
ces, it is clear that the next step in our enterprise security automation e=
ffort must be to enable standardized reporting of similar information from =
network infrastructure devices. With
 the growing number of Yang models and increased adoption of NETCONF, RESTC=
ONF, and related protocol work, the time is right to work out how these sta=
ndards can be used to measure the health of network devices. This informati=
on will, as in our efforts in SACM
 for client devices, support asset, software, vulnerability, and configurat=
ion management use cases. Standards-based reporting of this information fro=
m network infrastructure devices will help network defenders protect agains=
t known attacks, and provide the
 necessary knowledge to detect and mitigate future attacks. <br>
&gt; <br>
&gt; We would like to start a discussion about how to leverage the existing=
 IETF network management protocols to best address security automation for =
network infrastructure devices. We would like your ideas on how to best pur=
sue this work, and your insights into
 network infrastructure security problems that will impact our networks in =
the future. We are holding a side meeting at IETF 98 on Wednesday, March 29=
th at 6:30pm CDT to start a discussion about how to move forward. We will b=
e meeting in Vevey 4 at the IETF
 meeting venue.<br>
<br>
Maybe this was discussed in the BoF =85<br>
<br>
The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.<br>
<br>
&gt; <br>
&gt; Here is a summary of the meeting details:<br>
&gt; <br>
&gt; PANIC (Posture Assessment through Network Information Collection) Bar =
BoF<br>
&gt; Wednesday, March 29th, 2017 @ 6:30pm CDT<br>
&gt; Swissotel Conference Center - Vevey 4<br>
&gt; <br>
&gt; We look forward to working with you, and hope to see you in Chicago at=
 the PANIC Bar BoF.<br>
&gt; <br>
&gt; Regards,<br>
&gt; Dave<br>
&gt; <br>
&gt; David Waltermire<br>
&gt; Information Technology Laboratory | Computer Security Division<br>
&gt; National Institute of Standards and Technology<br>
&gt; <br>
&gt; _______________________________________________<br>
&gt; Netconf mailing list<br>
&gt; Netconf@ietf.org<br>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/netconf">https://www.=
ietf.org/mailman/listinfo/netconf</a><br>
<br>
Mahesh Jethanandani<br>
mjethanandani@gmail.com<br>
<br>
<br>
<br>
</div>
</span></font>
</body>
</html>

--_000_A406F4455056956FC17A5EEB332131B682A83BF7unknown_--


From nobody Thu Mar 30 14:43:57 2017
Return-Path: <david.waltermire@nist.gov>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D922C1294FF; Thu, 30 Mar 2017 14:43:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eqPa49MvjPl0; Thu, 30 Mar 2017 14:43:45 -0700 (PDT)
Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0132.outbound.protection.outlook.com [23.103.200.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4E2012960F; Thu, 30 Mar 2017 14:43:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Bgy2cJz1F/T9adb2KnkuXVvqo86DsAhG2xpN1H3tqTg=; b=xhzIPm+kHjjtlg+Qe7OsmT9AhZw12Iire5D5VWqeRcUHAQUkardpSdr0JGxrDR6vHaA/SWOEA27RohNM0PHXEpfPrP7M9Xc5ZFZkhN05yzlMvfwAOLXVYtocHhYxV6CWkeWuQNvC3CJWlNII1HAU7kqTBicxcqqh4PM8m5Poix0=
Received: from MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) by MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.991.14; Thu, 30 Mar 2017 21:43:38 +0000
Received: from MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) by MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) with mapi id 15.01.0991.022; Thu, 30 Mar 2017 21:43:38 +0000
From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
To: Mahesh Jethanandani <mjethanandani@gmail.com>
CC: "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>, "mile@ietf.org" <mile@ietf.org>
Thread-Topic: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8gDGe7oAAAEA4X8AADCZJw==
Date: Thu, 30 Mar 2017 21:43:38 +0000
Message-ID: <7623EF23448E9148C613E4C1A97C06377ECF6972@unknown>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>, <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com>, <A406F4455056956FC17A5EEB332131B682A83BF7@unknown>
In-Reply-To: <A406F4455056956FC17A5EEB332131B682A83BF7@unknown>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=nist.gov;
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [2600:1008:b026:3c5b:880a:2104:6fcd:5c70]
x-microsoft-exchange-diagnostics: 1; MWHPR09MB1440; 7:gPsskoOr3cXkVmihP4hWs0QtZDGbhd8A2Kp/gNTQmsAbfI9Cfi14UXdKY02b3Uvhv4lNfT2xRpurzw37oB8vbbmTWk+b5pY9bAA+oAptCjRd53sJNLJsbpknTcdhBOefZmtvZZEQd4auihnLBiPeu7KhahevujGV1BrnWa+a5q3h9nLJoXS0kjK3yu3cHsiMS+dOAGBjfXU2j8c7fy5jKMGNNH4tl90GwKU5yayxhUmqajLIG7AZwiWYTfGPl49ofLloK9WapwYrVh5vhfq5/BfLEwwdVlVDHUSiPQv1GG24u+MFCZfbY87JHPgeDZZV4pXs/ls/1IjLrpP7BnZhbg==
x-ms-office365-filtering-correlation-id: 4dced6c9-e1e6-46be-7105-08d477b5d358
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081);  SRVR:MWHPR09MB1440; 
x-microsoft-antispam-prvs: <MWHPR09MB14408AC63FD32FCD5A257F1AF0340@MWHPR09MB1440.namprd09.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(158342451672863)(65766998875637)(192374486261705)(211171220733660)(148717330147763);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(6041248)(201703131423075)(201702281528075)(201703061421075)(20161123562025)(20161123560025)(20161123555025)(20161123564025)(6072148); SRVR:MWHPR09MB1440; BCL:0; PCL:0; RULEID:; SRVR:MWHPR09MB1440; 
x-forefront-prvs: 02622CEF0A
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39450400003)(39410400002)(39840400002)(39400400002)(39850400002)(39860400002)(24454002)(377454003)(6512007)(54356999)(9686003)(236005)(39060400002)(38730400002)(99286003)(81166006)(110136004)(54906002)(6506006)(6306002)(76176999)(54896002)(55846006)(6246003)(8676002)(2906002)(5660300001)(50986999)(7736002)(606005)(2920100001)(7906003)(2900100001)(2860100001)(122556002)(6436002)(25786009)(2950100002)(33716001)(3280700002)(8936002)(3660700001)(561944003)(86362001)(4326008)(1411001)(189998001)(77096006)(6486002)(33656002)(229853002)(102836003)(6116002)(53936002)(6916009)(82676001); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR09MB1440; H:MWHPR09MB1440.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; 
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_7623EF23448E9148C613E4C1A97C06377ECF6972unknown_"
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Mar 2017 21:43:38.1864 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR09MB1440
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/Lb2K2pV_6Te5bN4Np8UR5nHaJu0>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Mar 2017 21:43:48 -0000

--_000_7623EF23448E9148C613E4C1A97C06377ECF6972unknown_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Sorry. Clicked send on my phone accidentally.

We plan to write a draft describing the problem and scope of what we want t=
o address. We will share this on the PANIC list and continue the conversati=
on from there. We may want to present ideas in WGs like NETCONF at some tim=
e in the future. We will know more once further discussion is had.

Thanks,
Dave

________________________________
On: 30 March 2017 16:38, "Waltermire, David A. (Fed)" <david.waltermire@nis=
t.gov> wrote:
We plan to write up a description adddessing the problem and

________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <mjethanandani@gmail.com> wr=
ote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <david.waltermire=
@nist.gov> wrote:
>
>
> The US Government has been working within the IETF SACM work group to sta=
ndardize the collection of endpoint configuration and other posture informa=
tion from enterprise endpoints. Collecting this information is critical to =
support automation of common network security tasks, including asset, softw=
are, vulnerability, and configuration management. Thus far, our efforts hav=
e focused primarily on standards to collect information in support of asset=
, software and vulnerability management use cases, and has worked with othe=
r IETF members to determine what data would need to be to be collected, and=
 how that data would be securely communicated across the network. Through s=
uch exchanges an organization can know what client endpoints are connected =
to their network, and if they are vulnerable to attack.
>
> Given the proliferation of attacks against network infrastructure devices=
, it is clear that the next step in our enterprise security automation effo=
rt must be to enable standardized reporting of similar information from net=
work infrastructure devices. With the growing number of Yang models and inc=
reased adoption of NETCONF, RESTCONF, and related protocol work, the time i=
s right to work out how these standards can be used to measure the health o=
f network devices. This information will, as in our efforts in SACM for cli=
ent devices, support asset, software, vulnerability, and configuration mana=
gement use cases. Standards-based reporting of this information from networ=
k infrastructure devices will help network defenders protect against known =
attacks, and provide the necessary knowledge to detect and mitigate future =
attacks.
>
> We would like to start a discussion about how to leverage the existing IE=
TF network management protocols to best address security automation for net=
work infrastructure devices. We would like your ideas on how to best pursue=
 this work, and your insights into network infrastructure security problems=
 that will impact our networks in the future. We are holding a side meeting=
 at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion ab=
out how to move forward. We will be meeting in Vevey 4 at the IETF meeting =
venue.

Maybe this was discussed in the BoF =85

The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.

>
> Here is a summary of the meeting details:
>
> PANIC (Posture Assessment through Network Information Collection) Bar BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>
> We look forward to working with you, and hope to see you in Chicago at th=
e PANIC Bar BoF.
>
> Regards,
> Dave
>
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com




--_000_7623EF23448E9148C613E4C1A97C06377ECF6972unknown_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<meta content=3D"text/html; charset=3DWindows-1252">
<meta name=3D"Generator" content=3D"Microsoft Exchange Server">
<style>
<!--
.EmailQuote
	{margin-left:1pt;
	padding-left:4pt;
	border-left:#800000 2px solid}
-->
</style>
</head>
<body>
<div id=3D"contentToMakeEditableId">
<div id=3D"content" dir=3D"ltr" class=3D"MaaS360PIMSDKComposeContentContain=
erClass" style=3D"margin-top:15px; margin-left:5px; color:black">
Sorry. Clicked send on my phone accidentally.
<div>
<div dir=3D"ltr"><br>
</div>
<div dir=3D"ltr">We plan to write a draft describing the problem and scope =
of what we want to address. We will share this on the PANIC list and contin=
ue the conversation from there. We may want to present ideas in&nbsp;WGs&nb=
sp;like NETCONF&nbsp;at some time in the future.
 We will know more once further discussion is had.</div>
<div dir=3D"ltr"><br>
</div>
<div dir=3D"ltr">Thanks,</div>
<div dir=3D"ltr">Dave</div>
<br>
<div id=3D"signatureToRemoveId" style=3D"text-align:left!important">
<hr>
On: 30 March 2017 16:38, &quot;Waltermire, David A. (Fed)&quot; &lt;david.w=
altermire@nist.gov&gt; wrote:<br>
</div>
</div>
</div>
</div>
<div>
<div>
<div id=3D"x_contentToMakeEditableId">
<div id=3D"x_content" dir=3D"ltr" class=3D"x_MaaS360PIMSDKComposeContentCon=
tainerClass" style=3D"margin-top:15px; margin-left:5px; color:black">
We plan to write up a description adddessing&nbsp;the problem and&nbsp;<br>
<br>
<div id=3D"x_signatureToRemoveId" style=3D"text-align:left!important">
<hr>
On: 30 March 2017 16:09, &quot;Mahesh Jethanandani&quot; &lt;mjethanandani@=
gmail.com&gt; wrote:<br>
</div>
</div>
</div>
</div>
<font size=3D"2"><span style=3D"font-size:10pt">
<div class=3D"PlainText">David,<br>
<br>
&gt; On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) &lt;david.walt=
ermire@nist.gov&gt; wrote:<br>
&gt; <br>
&gt; <br>
&gt; The US Government has been working within the IETF SACM work group to =
standardize the collection of endpoint configuration and other posture info=
rmation from enterprise endpoints. Collecting this information is critical =
to support automation of common network
 security tasks, including asset, software, vulnerability, and configuratio=
n management. Thus far, our efforts have focused primarily on standards to =
collect information in support of asset, software and vulnerability managem=
ent use cases, and has worked with
 other IETF members to determine what data would need to be to be collected=
, and how that data would be securely communicated across the network. Thro=
ugh such exchanges an organization can know what client endpoints are conne=
cted to their network, and if they
 are vulnerable to attack.<br>
&gt; <br>
&gt; Given the proliferation of attacks against network infrastructure devi=
ces, it is clear that the next step in our enterprise security automation e=
ffort must be to enable standardized reporting of similar information from =
network infrastructure devices. With
 the growing number of Yang models and increased adoption of NETCONF, RESTC=
ONF, and related protocol work, the time is right to work out how these sta=
ndards can be used to measure the health of network devices. This informati=
on will, as in our efforts in SACM
 for client devices, support asset, software, vulnerability, and configurat=
ion management use cases. Standards-based reporting of this information fro=
m network infrastructure devices will help network defenders protect agains=
t known attacks, and provide the
 necessary knowledge to detect and mitigate future attacks. <br>
&gt; <br>
&gt; We would like to start a discussion about how to leverage the existing=
 IETF network management protocols to best address security automation for =
network infrastructure devices. We would like your ideas on how to best pur=
sue this work, and your insights into
 network infrastructure security problems that will impact our networks in =
the future. We are holding a side meeting at IETF 98 on Wednesday, March 29=
th at 6:30pm CDT to start a discussion about how to move forward. We will b=
e meeting in Vevey 4 at the IETF
 meeting venue.<br>
<br>
Maybe this was discussed in the BoF =85<br>
<br>
The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.<br>
<br>
&gt; <br>
&gt; Here is a summary of the meeting details:<br>
&gt; <br>
&gt; PANIC (Posture Assessment through Network Information Collection) Bar =
BoF<br>
&gt; Wednesday, March 29th, 2017 @ 6:30pm CDT<br>
&gt; Swissotel Conference Center - Vevey 4<br>
&gt; <br>
&gt; We look forward to working with you, and hope to see you in Chicago at=
 the PANIC Bar BoF.<br>
&gt; <br>
&gt; Regards,<br>
&gt; Dave<br>
&gt; <br>
&gt; David Waltermire<br>
&gt; Information Technology Laboratory | Computer Security Division<br>
&gt; National Institute of Standards and Technology<br>
&gt; <br>
&gt; _______________________________________________<br>
&gt; Netconf mailing list<br>
&gt; Netconf@ietf.org<br>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/netconf">https://www.=
ietf.org/mailman/listinfo/netconf</a><br>
<br>
Mahesh Jethanandani<br>
mjethanandani@gmail.com<br>
<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>

--_000_7623EF23448E9148C613E4C1A97C06377ECF6972unknown_--


From nobody Thu Mar 30 15:26:57 2017
Return-Path: <evoit@cisco.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76387129494; Thu, 30 Mar 2017 15:26:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.522
X-Spam-Level: 
X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SSnFxnE6wQO9; Thu, 30 Mar 2017 15:26:39 -0700 (PDT)
Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBB941293EE; Thu, 30 Mar 2017 15:26:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=13061; q=dns/txt; s=iport; t=1490912798; x=1492122398; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=19mVUMQghqkUXDVMyPEbKC6F3Nr1e6SrPaD79QcZXeE=; b=g/k9I3Rb/jz5+kQWtXEraOpwQ6cUwvvGx7WsDbRvL7yxcxWYFRF4tjTh kekVVgp1uRDnHDzTECp7c4WNMa0rYwJjEt0Nz1bGXWQgKVmC3lI8g9AJu GNy/RVmNYCfT7FCyUip1Vdepw5hp5Zs431KE+rg9LYfuXrA6ejJwbDEgg U=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AXAQCdhd1Y/49dJa1eGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgm4/KWGBCweNbJFViBmIBoUxgg4fAQyCQIJsSgKDOD8YAQIBAQE?= =?us-ascii?q?BAQEBayiFFQEBAQECAQEBKzsGCwULAgEIGAwbByEGCxQRAQEEAQ0FCIg+gS0DD?= =?us-ascii?q?QgOrVuHKg2DIwEBAQEBAQEBAQEBAQEBAQEBAQEBARgFhk6Eb4JRRociBZwvOwG?= =?us-ascii?q?GfIcbhC+RQIpyiHoBHziBBVsVQYZZdYkCgQ0BAQE?=
X-IronPort-AV: E=Sophos;i="5.36,249,1486425600";  d="scan'208,217";a="226906754"
Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 30 Mar 2017 22:26:37 +0000
Received: from XCH-RTP-011.cisco.com (xch-rtp-011.cisco.com [64.101.220.151]) by rcdn-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id v2UMQbBv000371 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 30 Mar 2017 22:26:37 GMT
Received: from xch-rtp-013.cisco.com (64.101.220.153) by XCH-RTP-011.cisco.com (64.101.220.151) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Thu, 30 Mar 2017 18:26:36 -0400
Received: from xch-rtp-013.cisco.com ([64.101.220.153]) by XCH-RTP-013.cisco.com ([64.101.220.153]) with mapi id 15.00.1210.000; Thu, 30 Mar 2017 18:26:36 -0400
From: "Eric Voit (evoit)" <evoit@cisco.com>
To: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>, "Mahesh Jethanandani" <mjethanandani@gmail.com>
CC: "mile@ietf.org" <mile@ietf.org>, "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>
Thread-Topic: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8gDGe7oAAAEA4X8AAQkXsA==
Date: Thu, 30 Mar 2017 22:26:36 +0000
Message-ID: <9ab236e3d421458e81f35534d2e13aaf@XCH-RTP-013.cisco.com>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>, <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com> <A406F4455056956FC17A5EEB332131B682A83BF7@unknown>
In-Reply-To: <A406F4455056956FC17A5EEB332131B682A83BF7@unknown>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.86.244.210]
Content-Type: multipart/alternative; boundary="_000_9ab236e3d421458e81f35534d2e13aafXCHRTP013ciscocom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/1BEPa5-O2xLZFKLnP_1EKBxrxv4>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Mar 2017 22:26:42 -0000

--_000_9ab236e3d421458e81f35534d2e13aafXCHRTP013ciscocom_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi David,

I know it is early, but for the secure communication part, have you conside=
red using the YANG Push<https://datatracker.ietf.org/doc/draft-ietf-netconf=
-yang-push/?include_text=3D1> work being developed in the NETCONF WG?

With this approach, you can subscribe to state changes within a device's YA=
NG models.  These could be PANIC developed YANG models,  existing YANG mode=
ls such as IETF-System, IETF-keychain, or some combination.   Then if a hac=
ker inserts new hardware, changes software versions, adds keys, adds users,=
 etc. that state change can be securely pushed to a subscribing where it ca=
n be determined whether the change was expected/desired.

Eric
________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <mjethanandani@gmail.com<mai=
lto:mjethanandani@gmail.com>> wrote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <david.waltermire=
@nist.gov<mailto:david.waltermire@nist.gov>> wrote:
>
>
> The US Government has been working within the IETF SACM work group to sta=
ndardize the collection of endpoint configuration and other posture informa=
tion from enterprise endpoints. Collecting this information is critical to =
support automation of common network security tasks, including asset, softw=
are, vulnerability, and configuration management. Thus far, our efforts hav=
e focused primarily on standards to collect information in support of asset=
, software and vulnerability management use cases, and has worked with othe=
r IETF members to determine what data would need to be to be collected, and=
 how that data would be securely communicated across the network. Through s=
uch exchanges an organization can know what client endpoints are connected =
to their network, and if they are vulnerable to attack.
>
> Given the proliferation of attacks against network infrastructure devices=
, it is clear that the next step in our enterprise security automation effo=
rt must be to enable standardized reporting of similar information from net=
work infrastructure devices. With the growing number of Yang models and inc=
reased adoption of NETCONF, RESTCONF, and related protocol work, the time i=
s right to work out how these standards can be used to measure the health o=
f network devices. This information will, as in our efforts in SACM for cli=
ent devices, support asset, software, vulnerability, and configuration mana=
gement use cases. Standards-based reporting of this information from networ=
k infrastructure devices will help network defenders protect against known =
attacks, and provide the necessary knowledge to detect and mitigate future =
attacks.
>
> We would like to start a discussion about how to leverage the existing IE=
TF network management protocols to best address security automation for net=
work infrastructure devices. We would like your ideas on how to best pursue=
 this work, and your insights into network infrastructure security problems=
 that will impact our networks in the future. We are holding a side meeting=
 at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion ab=
out how to move forward. We will be meeting in Vevey 4 at the IETF meeting =
venue.

Maybe this was discussed in the BoF ...

The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.

>
> Here is a summary of the meeting details:
>
> PANIC (Posture Assessment through Network Information Collection) Bar BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>
> We look forward to working with you, and hope to see you in Chicago at th=
e PANIC Bar BoF.
>
> Regards,
> Dave
>
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org<mailto:Netconf@ietf.org>
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>



--_000_9ab236e3d421458e81f35534d2e13aafXCHRTP013ciscocom_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:0in;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
p.emailquote, li.emailquote, div.emailquote
	{mso-style-name:emailquote;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:1.0pt;
	border:none;
	padding:0in;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Hi David,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">I know it is early, but for the secur=
e communication part, have you considered using the
<a href=3D"https://datatracker.ietf.org/doc/draft-ietf-netconf-yang-push/?i=
nclude_text=3D1">
YANG Push</a> work being developed in the NETCONF WG?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">With this approach, you can subscribe=
 to state changes within a device&#8216;s YANG models.&nbsp; These could be=
 PANIC developed YANG models, &nbsp;existing YANG models such
 as IETF-System, IETF-keychain, or some combination.&nbsp;&nbsp; Then if a =
hacker inserts new hardware, changes software versions, adds keys, adds use=
rs, etc. that state change can be securely pushed to a subscribing where it=
 can be determined whether the change was
 expected/desired.&nbsp; <o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Eric<o:p></o:p></span></p>
<div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt">
<div>
<div id=3D"x_contentToMakeEditableId">
<div style=3D"margin-left:3.75pt;margin-top:11.25pt" id=3D"x_content">
<div id=3D"x_signatureToRemoveId">
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
 style=3D"color:black">
<hr size=3D"5" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"color:black">On: 30 March 2017 16:09,=
 &quot;Mahesh Jethanandani&quot; &lt;<a href=3D"mailto:mjethanandani@gmail.=
com">mjethanandani@gmail.com</a>&gt; wrote:<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize:10.0pt">David,<br>
<br>
&gt; On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) &lt;<a href=3D=
"mailto:david.waltermire@nist.gov">david.waltermire@nist.gov</a>&gt; wrote:=
<br>
&gt; <br>
&gt; <br>
&gt; The US Government has been working within the IETF SACM work group to =
standardize the collection of endpoint configuration and other posture info=
rmation from enterprise endpoints. Collecting this information is critical =
to support automation of common network
 security tasks, including asset, software, vulnerability, and configuratio=
n management. Thus far, our efforts have focused primarily on standards to =
collect information in support of asset, software and vulnerability managem=
ent use cases, and has worked with
 other IETF members to determine what data would need to be to be collected=
, and how that data would be securely communicated across the network. Thro=
ugh such exchanges an organization can know what client endpoints are conne=
cted to their network, and if they
 are vulnerable to attack.<br>
&gt; <br>
&gt; Given the proliferation of attacks against network infrastructure devi=
ces, it is clear that the next step in our enterprise security automation e=
ffort must be to enable standardized reporting of similar information from =
network infrastructure devices. With
 the growing number of Yang models and increased adoption of NETCONF, RESTC=
ONF, and related protocol work, the time is right to work out how these sta=
ndards can be used to measure the health of network devices. This informati=
on will, as in our efforts in SACM
 for client devices, support asset, software, vulnerability, and configurat=
ion management use cases. Standards-based reporting of this information fro=
m network infrastructure devices will help network defenders protect agains=
t known attacks, and provide the
 necessary knowledge to detect and mitigate future attacks. <br>
&gt; <br>
&gt; We would like to start a discussion about how to leverage the existing=
 IETF network management protocols to best address security automation for =
network infrastructure devices. We would like your ideas on how to best pur=
sue this work, and your insights into
 network infrastructure security problems that will impact our networks in =
the future. We are holding a side meeting at IETF 98 on Wednesday, March 29=
th at 6:30pm CDT to start a discussion about how to move forward. We will b=
e meeting in Vevey 4 at the IETF
 meeting venue.<br>
<br>
Maybe this was discussed in the BoF &#8230;<br>
<br>
The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.<br>
<br>
&gt; <br>
&gt; Here is a summary of the meeting details:<br>
&gt; <br>
&gt; PANIC (Posture Assessment through Network Information Collection) Bar =
BoF<br>
&gt; Wednesday, March 29th, 2017 @ 6:30pm CDT<br>
&gt; Swissotel Conference Center - Vevey 4<br>
&gt; <br>
&gt; We look forward to working with you, and hope to see you in Chicago at=
 the PANIC Bar BoF.<br>
&gt; <br>
&gt; Regards,<br>
&gt; Dave<br>
&gt; <br>
&gt; David Waltermire<br>
&gt; Information Technology Laboratory | Computer Security Division<br>
&gt; National Institute of Standards and Technology<br>
&gt; <br>
&gt; _______________________________________________<br>
&gt; Netconf mailing list<br>
&gt; <a href=3D"mailto:Netconf@ietf.org">Netconf@ietf.org</a><br>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/netconf">https://www.=
ietf.org/mailman/listinfo/netconf</a><br>
<br>
Mahesh Jethanandani<br>
<a href=3D"mailto:mjethanandani@gmail.com">mjethanandani@gmail.com</a><br>
<br>
<br>
<o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>

--_000_9ab236e3d421458e81f35534d2e13aafXCHRTP013ciscocom_--


From nobody Thu Mar 30 20:50:15 2017
Return-Path: <takeshi_takahashi@nict.go.jp>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A5D4129717 for <mile@ietfa.amsl.com>; Thu, 30 Mar 2017 20:50:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.801
X-Spam-Level: 
X-Spam-Status: No, score=-2.801 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TG0kdjqWSSZ0 for <mile@ietfa.amsl.com>; Thu, 30 Mar 2017 20:50:12 -0700 (PDT)
Received: from ns1.nict.go.jp (ns1.nict.go.jp [IPv6:2001:df0:232:300::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3185F1200F1 for <mile@ietf.org>; Thu, 30 Mar 2017 20:50:12 -0700 (PDT)
Received: from gw1.nict.go.jp (gw1.nict.go.jp [133.243.18.250]) by ns1.nict.go.jp  with ESMTP id v2V3oBt5006311 for <mile@ietf.org>; Fri, 31 Mar 2017 12:50:11 +0900 (JST)
Received: from mail1.nict.go.jp (mail1.nict.go.jp [133.243.18.14]) by gw1.nict.go.jp  with ESMTP id v2V3oBth006305 for <mile@ietf.org>; Fri, 31 Mar 2017 12:50:11 +0900 (JST)
Received: from VAIO (unknown [133.243.30.60]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail1.nict.go.jp (NICT Mail Spool Server1) with ESMTPS id 34F9CAF09 for <mile@ietf.org>; Fri, 31 Mar 2017 12:50:11 +0900 (JST)
From: "Takeshi Takahashi" <takeshi_takahashi@nict.go.jp>
To: <mile@ietf.org>
Date: Fri, 31 Mar 2017 12:50:20 +0900
Message-ID: <000901d2a9d1$eaff3ae0$c0fdb0a0$@nict.go.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AdKp0cx73PIO71MiRLmhQ3n63vW2uA==
Content-Language: ja
X-Virus-Scanned: clamav-milter 0.98.7 at zenith1
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/B0wxc8hktVqbDUEo339Coal5d1o>
Subject: [mile] Working group last call for XMPP-grid
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 03:50:14 -0000

Hello all,

This is a WGLC for draft-ietf-mile-xmpp-grid.
The version to be reviewed is
https://tools.ietf.org/id/draft-ietf-mile-xmpp-grid-02.txt

We will have 1 month for this call.
Please provide comments before May 1st and provide your support and/ or
raise any issue you feel are yet to be addressed.

Thank you.
Take



From nobody Fri Mar 31 10:55:36 2017
Return-Path: <pkampana@cisco.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 200C9126D74; Fri, 31 Mar 2017 10:55:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.521
X-Spam-Level: 
X-Spam-Status: No, score=-14.521 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UoVXRZggRVzT; Fri, 31 Mar 2017 10:55:05 -0700 (PDT)
Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 607AD128DF6; Fri, 31 Mar 2017 10:55:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=14467; q=dns/txt; s=iport; t=1490982905; x=1492192505; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=4vKofzxxu709iQwFQtlzKVJn2p8fQiwY0PGnr6QpS00=; b=l2aDiqbcpj7xjdQEZ05KQ1KvLLhimLfCcp1TQbbeQMdTvcHZ+IGKogLb LvXkjFC8E1vGvtMsnOdAsf2i9+NTz7Rto1rb0eyWSLneTd33C3yOQmWxs wcjXhlZN+5GexoYCUCaAGoNU/8rcs63Amiz5sDjNq5ZWUa9lpZmg0bCMe E=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AXAQBUl95Y/51dJa1cGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgm49KWGBCweNbZFUiBmIBoUxgg4fAQqCQoJsSgKDRz8YAQIBAQE?= =?us-ascii?q?BAQEBayiFFQEBAQECAQEBKzsGCwULAgEIEQQBAQEnByEGCxQJCAEBBA4FCIhAg?= =?us-ascii?q?S0DDQgOsAaHKw2DJAEBAQEBAQEBAQEBAQEBAQEBAQEBARgFhk6Eb4JRgjmFLwW?= =?us-ascii?q?cLzsBjheEL5FDinaIegEfOIEFWxVBhll1iE6BDQEBAQ?=
X-IronPort-AV: E=Sophos;i="5.36,252,1486425600";  d="scan'208,217";a="405643111"
Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 31 Mar 2017 17:55:04 +0000
Received: from XCH-ALN-006.cisco.com (xch-aln-006.cisco.com [173.36.7.16]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id v2VHt3Eq008873 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 31 Mar 2017 17:55:04 GMT
Received: from xch-aln-010.cisco.com (173.36.7.20) by XCH-ALN-006.cisco.com (173.36.7.16) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 31 Mar 2017 12:55:03 -0500
Received: from xch-aln-010.cisco.com ([173.36.7.20]) by XCH-ALN-010.cisco.com ([173.36.7.20]) with mapi id 15.00.1210.000; Fri, 31 Mar 2017 12:55:03 -0500
From: "Panos Kampanakis (pkampana)" <pkampana@cisco.com>
To: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
CC: "mile@ietf.org" <mile@ietf.org>, "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>
Thread-Topic: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8gDGe7oAAAEA4X8AADCZJwAqSdrQ
Date: Fri, 31 Mar 2017 17:55:03 +0000
Message-ID: <ccdeecc4ccda40598cd347b10fa0a026@XCH-ALN-010.cisco.com>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>, <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com>, <A406F4455056956FC17A5EEB332131B682A83BF7@unknown> <7623EF23448E9148C613E4C1A97C06377ECF6972@unknown>
In-Reply-To: <7623EF23448E9148C613E4C1A97C06377ECF6972@unknown>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.116.108.5]
Content-Type: multipart/alternative; boundary="_000_ccdeecc4ccda40598cd347b10fa0a026XCHALN010ciscocom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/wPneOOdLAQD67paIh8QO6rJMNSU>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 17:55:09 -0000

--_000_ccdeecc4ccda40598cd347b10fa0a026XCHALN010ciscocom_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Is there a  list for PANIC already?
I couldn't find it.


From: mile [mailto:mile-bounces@ietf.org] On Behalf Of Waltermire, David A.=
 (Fed)
Sent: Thursday, March 30, 2017 5:44 PM
To: Mahesh Jethanandani <mjethanandani@gmail.com>
Cc: mile@ietf.org; netconf@ietf.org; netmod@ietf.org; sacm@ietf.org
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Sorry. Clicked send on my phone accidentally.

We plan to write a draft describing the problem and scope of what we want t=
o address. We will share this on the PANIC list and continue the conversati=
on from there. We may want to present ideas in WGs like NETCONF at some tim=
e in the future. We will know more once further discussion is had.

Thanks,
Dave

________________________________
On: 30 March 2017 16:38, "Waltermire, David A. (Fed)" <david.waltermire@nis=
t.gov<mailto:david.waltermire@nist.gov>> wrote:
We plan to write up a description adddessing the problem and
________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <mjethanandani@gmail.com<mai=
lto:mjethanandani@gmail.com>> wrote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <david.waltermire=
@nist.gov<mailto:david.waltermire@nist.gov>> wrote:
>
>
> The US Government has been working within the IETF SACM work group to sta=
ndardize the collection of endpoint configuration and other posture informa=
tion from enterprise endpoints. Collecting this information is critical to =
support automation of common network security tasks, including asset, softw=
are, vulnerability, and configuration management. Thus far, our efforts hav=
e focused primarily on standards to collect information in support of asset=
, software and vulnerability management use cases, and has worked with othe=
r IETF members to determine what data would need to be to be collected, and=
 how that data would be securely communicated across the network. Through s=
uch exchanges an organization can know what client endpoints are connected =
to their network, and if they are vulnerable to attack.
>
> Given the proliferation of attacks against network infrastructure devices=
, it is clear that the next step in our enterprise security automation effo=
rt must be to enable standardized reporting of similar information from net=
work infrastructure devices. With the growing number of Yang models and inc=
reased adoption of NETCONF, RESTCONF, and related protocol work, the time i=
s right to work out how these standards can be used to measure the health o=
f network devices. This information will, as in our efforts in SACM for cli=
ent devices, support asset, software, vulnerability, and configuration mana=
gement use cases. Standards-based reporting of this information from networ=
k infrastructure devices will help network defenders protect against known =
attacks, and provide the necessary knowledge to detect and mitigate future =
attacks.
>
> We would like to start a discussion about how to leverage the existing IE=
TF network management protocols to best address security automation for net=
work infrastructure devices. We would like your ideas on how to best pursue=
 this work, and your insights into network infrastructure security problems=
 that will impact our networks in the future. We are holding a side meeting=
 at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion ab=
out how to move forward. We will be meeting in Vevey 4 at the IETF meeting =
venue.

Maybe this was discussed in the BoF ...

The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.

>
> Here is a summary of the meeting details:
>
> PANIC (Posture Assessment through Network Information Collection) Bar BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>
> We look forward to working with you, and hope to see you in Chicago at th=
e PANIC Bar BoF.
>
> Regards,
> Dave
>
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org<mailto:Netconf@ietf.org>
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>



--_000_ccdeecc4ccda40598cd347b10fa0a026XCHALN010ciscocom_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.emailquote, li.emailquote, div.emailquote
	{mso-style-name:emailquote;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:1.0pt;
	border:none;
	padding:0in;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
span.EmailStyle18
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Is there a&nbsp; list for PANIC alrea=
dy?
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">I couldn&#8217;t find it.<o:p></o:p><=
/span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif">From:</span></b><span style=3D"font-size:11.0pt;=
font-family:&quot;Calibri&quot;,sans-serif"> mile [mailto:mile-bounces@ietf=
.org]
<b>On Behalf Of </b>Waltermire, David A. (Fed)<br>
<b>Sent:</b> Thursday, March 30, 2017 5:44 PM<br>
<b>To:</b> Mahesh Jethanandani &lt;mjethanandani@gmail.com&gt;<br>
<b>Cc:</b> mile@ietf.org; netconf@ietf.org; netmod@ietf.org; sacm@ietf.org<=
br>
<b>Subject:</b> Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT<o=
:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<div id=3D"contentToMakeEditableId">
<div style=3D"margin-left:3.75pt;margin-top:11.25pt" id=3D"content">
<p class=3D"MsoNormal"><span style=3D"color:black">Sorry. Clicked send on m=
y phone accidentally.
<o:p></o:p></span></p>
<div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black"><o:p>&nbsp;</o:p></span>=
</p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black">We plan to write a draft=
 describing the problem and scope of what we want to address. We will share=
 this on the PANIC list and continue the conversation from there. We may wa=
nt to present ideas in&nbsp;WGs&nbsp;like NETCONF&nbsp;at
 some time in the future. We will know more once further discussion is had.=
<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black"><o:p>&nbsp;</o:p></span>=
</p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black">Thanks,<o:p></o:p></span=
></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black">Dave<o:p></o:p></span></=
p>
</div>
<p class=3D"MsoNormal"><span style=3D"color:black"><o:p>&nbsp;</o:p></span>=
</p>
<div id=3D"signatureToRemoveId">
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
 style=3D"color:black">
<hr size=3D"3" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"color:black">On: 30 March 2017 16:38,=
 &quot;Waltermire, David A. (Fed)&quot; &lt;<a href=3D"mailto:david.walterm=
ire@nist.gov">david.waltermire@nist.gov</a>&gt; wrote:<o:p></o:p></span></p=
>
</div>
</div>
</div>
</div>
<div>
<div>
<div id=3D"x_contentToMakeEditableId">
<div style=3D"margin-left:3.75pt;margin-top:11.25pt" id=3D"x_content">
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"color:=
black">We plan to write up a description adddessing&nbsp;the problem and&nb=
sp;<o:p></o:p></span></p>
<div id=3D"x_signatureToRemoveId">
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
 style=3D"color:black">
<hr size=3D"3" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"color:black">On: 30 March 2017 16:09,=
 &quot;Mahesh Jethanandani&quot; &lt;<a href=3D"mailto:mjethanandani@gmail.=
com">mjethanandani@gmail.com</a>&gt; wrote:<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize:10.0pt">David,<br>
<br>
&gt; On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) &lt;<a href=3D=
"mailto:david.waltermire@nist.gov">david.waltermire@nist.gov</a>&gt; wrote:=
<br>
&gt; <br>
&gt; <br>
&gt; The US Government has been working within the IETF SACM work group to =
standardize the collection of endpoint configuration and other posture info=
rmation from enterprise endpoints. Collecting this information is critical =
to support automation of common network
 security tasks, including asset, software, vulnerability, and configuratio=
n management. Thus far, our efforts have focused primarily on standards to =
collect information in support of asset, software and vulnerability managem=
ent use cases, and has worked with
 other IETF members to determine what data would need to be to be collected=
, and how that data would be securely communicated across the network. Thro=
ugh such exchanges an organization can know what client endpoints are conne=
cted to their network, and if they
 are vulnerable to attack.<br>
&gt; <br>
&gt; Given the proliferation of attacks against network infrastructure devi=
ces, it is clear that the next step in our enterprise security automation e=
ffort must be to enable standardized reporting of similar information from =
network infrastructure devices. With
 the growing number of Yang models and increased adoption of NETCONF, RESTC=
ONF, and related protocol work, the time is right to work out how these sta=
ndards can be used to measure the health of network devices. This informati=
on will, as in our efforts in SACM
 for client devices, support asset, software, vulnerability, and configurat=
ion management use cases. Standards-based reporting of this information fro=
m network infrastructure devices will help network defenders protect agains=
t known attacks, and provide the
 necessary knowledge to detect and mitigate future attacks. <br>
&gt; <br>
&gt; We would like to start a discussion about how to leverage the existing=
 IETF network management protocols to best address security automation for =
network infrastructure devices. We would like your ideas on how to best pur=
sue this work, and your insights into
 network infrastructure security problems that will impact our networks in =
the future. We are holding a side meeting at IETF 98 on Wednesday, March 29=
th at 6:30pm CDT to start a discussion about how to move forward. We will b=
e meeting in Vevey 4 at the IETF
 meeting venue.<br>
<br>
Maybe this was discussed in the BoF &#8230;<br>
<br>
The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.<br>
<br>
&gt; <br>
&gt; Here is a summary of the meeting details:<br>
&gt; <br>
&gt; PANIC (Posture Assessment through Network Information Collection) Bar =
BoF<br>
&gt; Wednesday, March 29th, 2017 @ 6:30pm CDT<br>
&gt; Swissotel Conference Center - Vevey 4<br>
&gt; <br>
&gt; We look forward to working with you, and hope to see you in Chicago at=
 the PANIC Bar BoF.<br>
&gt; <br>
&gt; Regards,<br>
&gt; Dave<br>
&gt; <br>
&gt; David Waltermire<br>
&gt; Information Technology Laboratory | Computer Security Division<br>
&gt; National Institute of Standards and Technology<br>
&gt; <br>
&gt; _______________________________________________<br>
&gt; Netconf mailing list<br>
&gt; <a href=3D"mailto:Netconf@ietf.org">Netconf@ietf.org</a><br>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/netconf">https://www.=
ietf.org/mailman/listinfo/netconf</a><br>
<br>
Mahesh Jethanandani<br>
<a href=3D"mailto:mjethanandani@gmail.com">mjethanandani@gmail.com</a><br>
<br>
<br>
<o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>

--_000_ccdeecc4ccda40598cd347b10fa0a026XCHALN010ciscocom_--


From nobody Fri Mar 31 14:16:56 2017
Return-Path: <david.waltermire@nist.gov>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86F081299F4; Fri, 31 Mar 2017 14:16:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aPXpEDRMWTKx; Fri, 31 Mar 2017 14:16:36 -0700 (PDT)
Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0094.outbound.protection.outlook.com [23.103.201.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2147D129A0F; Fri, 31 Mar 2017 14:16:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0ZLQGdQ0+YrrwHNcFbPDvkhpBquqDGzffvfbKuTDLMI=; b=I63z9I5kdjpu6vxhwC0g8LbQbkT9CGyFDovI5tJRufXvOPbUkHGa3kQ+otkmwwUW9VXrbzlTf4E7nClT975dXwkBhLkzK9b17acqD2z1nICVIvLAg7BCKZUTkkr2TliOGFGXuM7M6lqNcq3ZFnCaucuVzh1De9PjvEv/uj52idc=
Received: from MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) by MWHPR09MB1437.namprd09.prod.outlook.com (10.173.50.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1005.10; Fri, 31 Mar 2017 21:16:33 +0000
Received: from MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) by MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) with mapi id 15.01.0991.023; Fri, 31 Mar 2017 21:16:33 +0000
From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
To: "Eric Voit (evoit)" <evoit@cisco.com>, Mahesh Jethanandani <mjethanandani@gmail.com>
CC: "mile@ietf.org" <mile@ietf.org>, "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>
Thread-Topic: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8gDGe7oAAAEA4X8AAQkXsAApvTOA
Date: Fri, 31 Mar 2017 21:16:32 +0000
Message-ID: <MWHPR09MB1440A5DDCAC838605469B044F0370@MWHPR09MB1440.namprd09.prod.outlook.com>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>, <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com> <A406F4455056956FC17A5EEB332131B682A83BF7@unknown> <9ab236e3d421458e81f35534d2e13aaf@XCH-RTP-013.cisco.com>
In-Reply-To: <9ab236e3d421458e81f35534d2e13aaf@XCH-RTP-013.cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
authentication-results: cisco.com; dkim=none (message not signed) header.d=none;cisco.com; dmarc=none action=none header.from=nist.gov;
x-originating-ip: [129.6.223.96]
x-microsoft-exchange-diagnostics: 1; MWHPR09MB1437; 7:jFJhSBUZCZMUkfv7NwbnR9aA/cu2RcBMqpz3z+qBd+koPuk6tcMfSkbe3sZshJHn9cF9chTip3V1DAERgdgmonjWEpsjMfdaTZV/RYG52w4x3rZEndtf8qpBbn+UAYrZNGPxfQI6JlomlbzRQAGD17btDWfDhjPDZWebeWC5kqJ8R51f03AW+wiCNbgbSmjVALZpKg551Db7CoH+vPSRXA39zhEXv9He9T+C/6F9xapgqaMaCwoNsN86TCQqIuq5IO2cFIeXGJwxMO+yn/rGS1jQF/5m81ahBm7RDtwfEWg437IUS9Xd/AMqrRsCe5NjRcIRsYsE6Ng6/+J6q/CatA==
x-ms-office365-filtering-correlation-id: 870e64b7-77b2-49f8-67af-08d4787b34f4
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081)(201702281549075); SRVR:MWHPR09MB1437; 
x-microsoft-antispam-prvs: <MWHPR09MB14376B67D82C48AF7BC05FC2F0370@MWHPR09MB1437.namprd09.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(65766998875637)(120809045254105)(192374486261705)(95692535739014)(21748063052155)(211171220733660)(148717330147763);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(10201501046)(6055026)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(6072148); SRVR:MWHPR09MB1437; BCL:0; PCL:0; RULEID:; SRVR:MWHPR09MB1437; 
x-forefront-prvs: 02638D901B
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39840400002)(39400400002)(39450400003)(39410400002)(39850400002)(24454002)(377454003)(3846002)(6116002)(8676002)(790700001)(102836003)(93886004)(7736002)(81156014)(81166006)(6246003)(74316002)(3660700001)(2950100002)(3280700002)(53546009)(25786009)(39060400002)(53936002)(77096006)(38730400002)(7906003)(4326008)(6506006)(7696004)(99286003)(8936002)(66066001)(229853002)(6306002)(2906002)(606005)(9686003)(54896002)(5660300001)(236005)(19609705001)(6436002)(2900100001)(54906002)(122556002)(561944003)(50986999)(76176999)(54356999)(55016002)(189998001)(33656002)(86362001); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR09MB1437; H:MWHPR09MB1440.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; 
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_MWHPR09MB1440A5DDCAC838605469B044F0370MWHPR09MB1440namp_"
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2017 21:16:32.8633 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR09MB1437
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/Msf3KBU-hUXDsmhrYd8B7Jr488U>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 21:16:40 -0000

--_000_MWHPR09MB1440A5DDCAC838605469B044F0370MWHPR09MB1440namp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Eric,

We have considered YANG Push as part of PANIC. I have read the draft and I =
attended your presentation during NETCONF. I think Yang Push is something w=
e should consider as part of the PANIC solution. Do you have an implementat=
ion of YANG Push that can be experimented with?

Regards,
Dave

From: Eric Voit (evoit) [mailto:evoit@cisco.com]
Sent: Thursday, March 30, 2017 6:27 PM
To: Waltermire, David A. (Fed) <david.waltermire@nist.gov>; Mahesh Jethanan=
dani <mjethanandani@gmail.com>
Cc: mile@ietf.org; netconf@ietf.org; netmod@ietf.org; sacm@ietf.org
Subject: RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Hi David,

I know it is early, but for the secure communication part, have you conside=
red using the YANG Push<https://datatracker.ietf.org/doc/draft-ietf-netconf=
-yang-push/?include_text=3D1> work being developed in the NETCONF WG?

With this approach, you can subscribe to state changes within a device's YA=
NG models.  These could be PANIC developed YANG models,  existing YANG mode=
ls such as IETF-System, IETF-keychain, or some combination.   Then if a hac=
ker inserts new hardware, changes software versions, adds keys, adds users,=
 etc. that state change can be securely pushed to a subscribing where it ca=
n be determined whether the change was expected/desired.

Eric
________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <mjethanandani@gmail.com<mai=
lto:mjethanandani@gmail.com>> wrote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <david.waltermire=
@nist.gov<mailto:david.waltermire@nist.gov>> wrote:
>
>
> The US Government has been working within the IETF SACM work group to sta=
ndardize the collection of endpoint configuration and other posture informa=
tion from enterprise endpoints. Collecting this information is critical to =
support automation of common network security tasks, including asset, softw=
are, vulnerability, and configuration management. Thus far, our efforts hav=
e focused primarily on standards to collect information in support of asset=
, software and vulnerability management use cases, and has worked with othe=
r IETF members to determine what data would need to be to be collected, and=
 how that data would be securely communicated across the network. Through s=
uch exchanges an organization can know what client endpoints are connected =
to their network, and if they are vulnerable to attack.
>
> Given the proliferation of attacks against network infrastructure devices=
, it is clear that the next step in our enterprise security automation effo=
rt must be to enable standardized reporting of similar information from net=
work infrastructure devices. With the growing number of Yang models and inc=
reased adoption of NETCONF, RESTCONF, and related protocol work, the time i=
s right to work out how these standards can be used to measure the health o=
f network devices. This information will, as in our efforts in SACM for cli=
ent devices, support asset, software, vulnerability, and configuration mana=
gement use cases. Standards-based reporting of this information from networ=
k infrastructure devices will help network defenders protect against known =
attacks, and provide the necessary knowledge to detect and mitigate future =
attacks.
>
> We would like to start a discussion about how to leverage the existing IE=
TF network management protocols to best address security automation for net=
work infrastructure devices. We would like your ideas on how to best pursue=
 this work, and your insights into network infrastructure security problems=
 that will impact our networks in the future. We are holding a side meeting=
 at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion ab=
out how to move forward. We will be meeting in Vevey 4 at the IETF meeting =
venue.

Maybe this was discussed in the BoF ...

The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.

>
> Here is a summary of the meeting details:
>
> PANIC (Posture Assessment through Network Information Collection) Bar BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>
> We look forward to working with you, and hope to see you in Chicago at th=
e PANIC Bar BoF.
>
> Regards,
> Dave
>
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org<mailto:Netconf@ietf.org>
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>

--_000_MWHPR09MB1440A5DDCAC838605469B044F0370MWHPR09MB1440namp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:0in;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
p.emailquote, li.emailquote, div.emailquote
	{mso-style-name:emailquote;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:1.0pt;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
span.EmailStyle19
	{mso-style-type:personal;
	font-family:"Calibri",sans-serif;
	color:#1F497D;}
span.EmailStyle20
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Eric,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">We have considered YANG Push as part of PANIC. I ha=
ve read the draft and I attended your presentation during NETCONF. I think =
Yang Push is something we should consider as part
 of the PANIC solution. Do you have an implementation of YANG Push that can=
 be experimented with?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Regards,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Dave<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt">
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif">From:</span></b><span style=3D"font-size:11.0pt;=
font-family:&quot;Calibri&quot;,sans-serif"> Eric Voit (evoit) [mailto:evoi=
t@cisco.com]
<br>
<b>Sent:</b> Thursday, March 30, 2017 6:27 PM<br>
<b>To:</b> Waltermire, David A. (Fed) &lt;david.waltermire@nist.gov&gt;; Ma=
hesh Jethanandani &lt;mjethanandani@gmail.com&gt;<br>
<b>Cc:</b> mile@ietf.org; netconf@ietf.org; netmod@ietf.org; sacm@ietf.org<=
br>
<b>Subject:</b> RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT<o:p></o:=
p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Hi David,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">I know it is early, but for the secur=
e communication part, have you considered using the
<a href=3D"https://datatracker.ietf.org/doc/draft-ietf-netconf-yang-push/?i=
nclude_text=3D1">
YANG Push</a> work being developed in the NETCONF WG?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">With this approach, you can subscribe=
 to state changes within a device&#8216;s YANG models.&nbsp; These could be=
 PANIC developed YANG models, &nbsp;existing YANG models such
 as IETF-System, IETF-keychain, or some combination.&nbsp;&nbsp; Then if a =
hacker inserts new hardware, changes software versions, adds keys, adds use=
rs, etc. that state change can be securely pushed to a subscribing where it=
 can be determined whether the change was
 expected/desired.&nbsp; <o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Eric<o:p></o:p></span></p>
<div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt">
<div>
<div id=3D"x_contentToMakeEditableId">
<div style=3D"margin-left:3.75pt;margin-top:11.25pt" id=3D"x_content">
<div id=3D"x_signatureToRemoveId">
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
 style=3D"color:black">
<hr size=3D"5" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"color:black">On: 30 March 2017 16:09,=
 &quot;Mahesh Jethanandani&quot; &lt;<a href=3D"mailto:mjethanandani@gmail.=
com">mjethanandani@gmail.com</a>&gt; wrote:<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize:10.0pt">David,<br>
<br>
&gt; On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) &lt;<a href=3D=
"mailto:david.waltermire@nist.gov">david.waltermire@nist.gov</a>&gt; wrote:=
<br>
&gt; <br>
&gt; <br>
&gt; The US Government has been working within the IETF SACM work group to =
standardize the collection of endpoint configuration and other posture info=
rmation from enterprise endpoints. Collecting this information is critical =
to support automation of common network
 security tasks, including asset, software, vulnerability, and configuratio=
n management. Thus far, our efforts have focused primarily on standards to =
collect information in support of asset, software and vulnerability managem=
ent use cases, and has worked with
 other IETF members to determine what data would need to be to be collected=
, and how that data would be securely communicated across the network. Thro=
ugh such exchanges an organization can know what client endpoints are conne=
cted to their network, and if they
 are vulnerable to attack.<br>
&gt; <br>
&gt; Given the proliferation of attacks against network infrastructure devi=
ces, it is clear that the next step in our enterprise security automation e=
ffort must be to enable standardized reporting of similar information from =
network infrastructure devices. With
 the growing number of Yang models and increased adoption of NETCONF, RESTC=
ONF, and related protocol work, the time is right to work out how these sta=
ndards can be used to measure the health of network devices. This informati=
on will, as in our efforts in SACM
 for client devices, support asset, software, vulnerability, and configurat=
ion management use cases. Standards-based reporting of this information fro=
m network infrastructure devices will help network defenders protect agains=
t known attacks, and provide the
 necessary knowledge to detect and mitigate future attacks. <br>
&gt; <br>
&gt; We would like to start a discussion about how to leverage the existing=
 IETF network management protocols to best address security automation for =
network infrastructure devices. We would like your ideas on how to best pur=
sue this work, and your insights into
 network infrastructure security problems that will impact our networks in =
the future. We are holding a side meeting at IETF 98 on Wednesday, March 29=
th at 6:30pm CDT to start a discussion about how to move forward. We will b=
e meeting in Vevey 4 at the IETF
 meeting venue.<br>
<br>
Maybe this was discussed in the BoF &#8230;<br>
<br>
The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.<br>
<br>
&gt; <br>
&gt; Here is a summary of the meeting details:<br>
&gt; <br>
&gt; PANIC (Posture Assessment through Network Information Collection) Bar =
BoF<br>
&gt; Wednesday, March 29th, 2017 @ 6:30pm CDT<br>
&gt; Swissotel Conference Center - Vevey 4<br>
&gt; <br>
&gt; We look forward to working with you, and hope to see you in Chicago at=
 the PANIC Bar BoF.<br>
&gt; <br>
&gt; Regards,<br>
&gt; Dave<br>
&gt; <br>
&gt; David Waltermire<br>
&gt; Information Technology Laboratory | Computer Security Division<br>
&gt; National Institute of Standards and Technology<br>
&gt; <br>
&gt; _______________________________________________<br>
&gt; Netconf mailing list<br>
&gt; <a href=3D"mailto:Netconf@ietf.org">Netconf@ietf.org</a><br>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/netconf">https://www.=
ietf.org/mailman/listinfo/netconf</a><br>
<br>
Mahesh Jethanandani<br>
<a href=3D"mailto:mjethanandani@gmail.com">mjethanandani@gmail.com</a><o:p>=
</o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>

--_000_MWHPR09MB1440A5DDCAC838605469B044F0370MWHPR09MB1440namp_--


From nobody Fri Mar 31 14:18:16 2017
Return-Path: <david.waltermire@nist.gov>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA9FF129A0F; Fri, 31 Mar 2017 14:18:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5njpH8njgP25; Fri, 31 Mar 2017 14:17:59 -0700 (PDT)
Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0131.outbound.protection.outlook.com [23.103.201.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00F9A1299F4; Fri, 31 Mar 2017 14:17:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=aW14rQ64WfLW9mzTRTK9aaVmNJBIx1f3V5oEqcMxPNA=; b=hpUOIJ1uVPoMNfr/Jq9M035Ve71IubtMcYr7jzjb4+nMgcZHsilT7VD+X8NBaBEAcTy7LY07i37SWCRVLM9ISqlZCQv9FPjFhYqhhuhmfmBfa6+V1FMETCHj+KVsM6FpsKO6XTGCixV9cYNOF8H9dm3c/Pk/i7zodsD3N6xigNk=
Received: from MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) by MWHPR09MB1437.namprd09.prod.outlook.com (10.173.50.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1005.10; Fri, 31 Mar 2017 21:17:56 +0000
Received: from MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) by MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) with mapi id 15.01.0991.023; Fri, 31 Mar 2017 21:17:56 +0000
From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
To: "Panos Kampanakis (pkampana)" <pkampana@cisco.com>
CC: "mile@ietf.org" <mile@ietf.org>, "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>
Thread-Topic: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8gDGe7oAAAEA4X8AADCZJwAqSdrQAAcUj4A=
Date: Fri, 31 Mar 2017 21:17:55 +0000
Message-ID: <MWHPR09MB1440EA71FBA40D793535A0CAF0370@MWHPR09MB1440.namprd09.prod.outlook.com>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>, <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com>, <A406F4455056956FC17A5EEB332131B682A83BF7@unknown> <7623EF23448E9148C613E4C1A97C06377ECF6972@unknown> <ccdeecc4ccda40598cd347b10fa0a026@XCH-ALN-010.cisco.com>
In-Reply-To: <ccdeecc4ccda40598cd347b10fa0a026@XCH-ALN-010.cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
authentication-results: cisco.com; dkim=none (message not signed) header.d=none;cisco.com; dmarc=none action=none header.from=nist.gov;
x-originating-ip: [129.6.223.96]
x-microsoft-exchange-diagnostics: 1; MWHPR09MB1437; 7:ilvMp1wVulrAzgWCMh//83kCjV9uIhC1BSXRA3CuWOUQ9H9+IvUGOPMLTaCZz+R5zvZrgYEAH4iNuYyncP1zQ5ROnV9It77nk3s6GbE2p5G/iK7GHnAOOCkiFrR0oU/ZO82pAEYdo5OaUvg/CL1q/MqQMm05nWfwDPRe/E8GfLbNuf4cUYJDK9a+HSAx5cUeeUMdeFEJtX3jAtMDEWdxypRss2O1UNhlkQuXt/qq+kPH59uERwfzFRiOqsSM0F0KQfvttfN38VWsJY2ULXumJ0WBw3ocfqbJkhb+ONJsrumZ2+ZeB51D4hiwvfnfbxjWv9/duSZLarVoyr2H+9zC6A==
x-ms-office365-filtering-correlation-id: fd71323e-2060-4daa-2f11-08d4787b6670
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081)(201702281549075); SRVR:MWHPR09MB1437; 
x-microsoft-antispam-prvs: <MWHPR09MB1437D7D82D6E3662839AB033F0370@MWHPR09MB1437.namprd09.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(65766998875637)(192374486261705)(95692535739014)(21748063052155)(211171220733660)(148717330147763);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(10201501046)(6055026)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(6072148); SRVR:MWHPR09MB1437; BCL:0; PCL:0; RULEID:; SRVR:MWHPR09MB1437; 
x-forefront-prvs: 02638D901B
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39840400002)(39400400002)(39450400003)(39410400002)(39850400002)(24454002)(377454003)(3846002)(6116002)(8676002)(790700001)(102836003)(93886004)(7736002)(81166006)(6246003)(74316002)(6916009)(3660700001)(2950100002)(3280700002)(53546009)(25786009)(53936002)(77096006)(110136004)(38730400002)(7906003)(4326008)(6506006)(7696004)(99286003)(8936002)(66066001)(229853002)(6306002)(2906002)(606005)(9686003)(54896002)(5660300001)(236005)(19609705001)(6436002)(2900100001)(54906002)(122556002)(561944003)(50986999)(76176999)(54356999)(55016002)(189998001)(33656002)(86362001); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR09MB1437; H:MWHPR09MB1440.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; 
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_MWHPR09MB1440EA71FBA40D793535A0CAF0370MWHPR09MB1440namp_"
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2017 21:17:55.9119 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR09MB1437
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/vUZbflFQQpI0xLZhCshxHGCCslE>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 21:18:02 -0000

--_000_MWHPR09MB1440EA71FBA40D793535A0CAF0370MWHPR09MB1440namp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Panos,

We have requested a list to be setup. We will post again with signup info o=
nce the list is created.

Thanks,
Dave

From: Panos Kampanakis (pkampana) [mailto:pkampana@cisco.com]
Sent: Friday, March 31, 2017 1:55 PM
To: Waltermire, David A. (Fed) <david.waltermire@nist.gov>
Cc: mile@ietf.org; netconf@ietf.org; netmod@ietf.org; sacm@ietf.org
Subject: RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Is there a  list for PANIC already?
I couldn't find it.


From: mile [mailto:mile-bounces@ietf.org] On Behalf Of Waltermire, David A.=
 (Fed)
Sent: Thursday, March 30, 2017 5:44 PM
To: Mahesh Jethanandani <mjethanandani@gmail.com<mailto:mjethanandani@gmail=
.com>>
Cc: mile@ietf.org<mailto:mile@ietf.org>; netconf@ietf.org<mailto:netconf@ie=
tf.org>; netmod@ietf.org<mailto:netmod@ietf.org>; sacm@ietf.org<mailto:sacm=
@ietf.org>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Sorry. Clicked send on my phone accidentally.

We plan to write a draft describing the problem and scope of what we want t=
o address. We will share this on the PANIC list and continue the conversati=
on from there. We may want to present ideas in WGs like NETCONF at some tim=
e in the future. We will know more once further discussion is had.

Thanks,
Dave

________________________________
On: 30 March 2017 16:38, "Waltermire, David A. (Fed)" <david.waltermire@nis=
t.gov<mailto:david.waltermire@nist.gov>> wrote:
We plan to write up a description adddessing the problem and
________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <mjethanandani@gmail.com<mai=
lto:mjethanandani@gmail.com>> wrote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <david.waltermire=
@nist.gov<mailto:david.waltermire@nist.gov>> wrote:
>
>
> The US Government has been working within the IETF SACM work group to sta=
ndardize the collection of endpoint configuration and other posture informa=
tion from enterprise endpoints. Collecting this information is critical to =
support automation of common network security tasks, including asset, softw=
are, vulnerability, and configuration management. Thus far, our efforts hav=
e focused primarily on standards to collect information in support of asset=
, software and vulnerability management use cases, and has worked with othe=
r IETF members to determine what data would need to be to be collected, and=
 how that data would be securely communicated across the network. Through s=
uch exchanges an organization can know what client endpoints are connected =
to their network, and if they are vulnerable to attack.
>
> Given the proliferation of attacks against network infrastructure devices=
, it is clear that the next step in our enterprise security automation effo=
rt must be to enable standardized reporting of similar information from net=
work infrastructure devices. With the growing number of Yang models and inc=
reased adoption of NETCONF, RESTCONF, and related protocol work, the time i=
s right to work out how these standards can be used to measure the health o=
f network devices. This information will, as in our efforts in SACM for cli=
ent devices, support asset, software, vulnerability, and configuration mana=
gement use cases. Standards-based reporting of this information from networ=
k infrastructure devices will help network defenders protect against known =
attacks, and provide the necessary knowledge to detect and mitigate future =
attacks.
>
> We would like to start a discussion about how to leverage the existing IE=
TF network management protocols to best address security automation for net=
work infrastructure devices. We would like your ideas on how to best pursue=
 this work, and your insights into network infrastructure security problems=
 that will impact our networks in the future. We are holding a side meeting=
 at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion ab=
out how to move forward. We will be meeting in Vevey 4 at the IETF meeting =
venue.

Maybe this was discussed in the BoF ...

The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.

>
> Here is a summary of the meeting details:
>
> PANIC (Posture Assessment through Network Information Collection) Bar BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>
> We look forward to working with you, and hope to see you in Chicago at th=
e PANIC Bar BoF.
>
> Regards,
> Dave
>
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org<mailto:Netconf@ietf.org>
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>


--_000_MWHPR09MB1440EA71FBA40D793535A0CAF0370MWHPR09MB1440namp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:0in;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
p.emailquote, li.emailquote, div.emailquote
	{mso-style-name:emailquote;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:1.0pt;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
span.EmailStyle19
	{mso-style-type:personal;
	font-family:"Calibri",sans-serif;
	color:#1F497D;}
span.EmailStyle20
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Panos,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">We have requested a list to be setup. We will post =
again with signup info once the list is created.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Thanks,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Dave<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt">
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif">From:</span></b><span style=3D"font-size:11.0pt;=
font-family:&quot;Calibri&quot;,sans-serif"> Panos Kampanakis (pkampana) [m=
ailto:pkampana@cisco.com]
<br>
<b>Sent:</b> Friday, March 31, 2017 1:55 PM<br>
<b>To:</b> Waltermire, David A. (Fed) &lt;david.waltermire@nist.gov&gt;<br>
<b>Cc:</b> mile@ietf.org; netconf@ietf.org; netmod@ietf.org; sacm@ietf.org<=
br>
<b>Subject:</b> RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT<o:p></o:=
p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Is there a&nbsp; list for PANIC alrea=
dy?
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">I couldn&#8217;t find it.<o:p></o:p><=
/span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif">From:</span></b><span style=3D"font-size:11.0pt;=
font-family:&quot;Calibri&quot;,sans-serif"> mile [<a href=3D"mailto:mile-b=
ounces@ietf.org">mailto:mile-bounces@ietf.org</a>]
<b>On Behalf Of </b>Waltermire, David A. (Fed)<br>
<b>Sent:</b> Thursday, March 30, 2017 5:44 PM<br>
<b>To:</b> Mahesh Jethanandani &lt;<a href=3D"mailto:mjethanandani@gmail.co=
m">mjethanandani@gmail.com</a>&gt;<br>
<b>Cc:</b> <a href=3D"mailto:mile@ietf.org">mile@ietf.org</a>; <a href=3D"m=
ailto:netconf@ietf.org">
netconf@ietf.org</a>; <a href=3D"mailto:netmod@ietf.org">netmod@ietf.org</a=
>; <a href=3D"mailto:sacm@ietf.org">
sacm@ietf.org</a><br>
<b>Subject:</b> Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT<o=
:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<div id=3D"contentToMakeEditableId">
<div style=3D"margin-left:3.75pt;margin-top:11.25pt" id=3D"content">
<p class=3D"MsoNormal"><span style=3D"color:black">Sorry. Clicked send on m=
y phone accidentally.
<o:p></o:p></span></p>
<div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black"><o:p>&nbsp;</o:p></span>=
</p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black">We plan to write a draft=
 describing the problem and scope of what we want to address. We will share=
 this on the PANIC list and continue the conversation from there. We may wa=
nt to present ideas in&nbsp;WGs&nbsp;like NETCONF&nbsp;at
 some time in the future. We will know more once further discussion is had.=
<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black"><o:p>&nbsp;</o:p></span>=
</p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black">Thanks,<o:p></o:p></span=
></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"color:black">Dave<o:p></o:p></span></=
p>
</div>
<p class=3D"MsoNormal"><span style=3D"color:black"><o:p>&nbsp;</o:p></span>=
</p>
<div id=3D"signatureToRemoveId">
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
 style=3D"color:black">
<hr size=3D"3" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"color:black">On: 30 March 2017 16:38,=
 &quot;Waltermire, David A. (Fed)&quot; &lt;<a href=3D"mailto:david.walterm=
ire@nist.gov">david.waltermire@nist.gov</a>&gt; wrote:<o:p></o:p></span></p=
>
</div>
</div>
</div>
</div>
<div>
<div>
<div id=3D"x_contentToMakeEditableId">
<div style=3D"margin-left:3.75pt;margin-top:11.25pt" id=3D"x_content">
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"color:=
black">We plan to write up a description adddessing&nbsp;the problem and&nb=
sp;<o:p></o:p></span></p>
<div id=3D"x_signatureToRemoveId">
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
 style=3D"color:black">
<hr size=3D"3" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"color:black">On: 30 March 2017 16:09,=
 &quot;Mahesh Jethanandani&quot; &lt;<a href=3D"mailto:mjethanandani@gmail.=
com">mjethanandani@gmail.com</a>&gt; wrote:<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize:10.0pt">David,<br>
<br>
&gt; On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) &lt;<a href=3D=
"mailto:david.waltermire@nist.gov">david.waltermire@nist.gov</a>&gt; wrote:=
<br>
&gt; <br>
&gt; <br>
&gt; The US Government has been working within the IETF SACM work group to =
standardize the collection of endpoint configuration and other posture info=
rmation from enterprise endpoints. Collecting this information is critical =
to support automation of common network
 security tasks, including asset, software, vulnerability, and configuratio=
n management. Thus far, our efforts have focused primarily on standards to =
collect information in support of asset, software and vulnerability managem=
ent use cases, and has worked with
 other IETF members to determine what data would need to be to be collected=
, and how that data would be securely communicated across the network. Thro=
ugh such exchanges an organization can know what client endpoints are conne=
cted to their network, and if they
 are vulnerable to attack.<br>
&gt; <br>
&gt; Given the proliferation of attacks against network infrastructure devi=
ces, it is clear that the next step in our enterprise security automation e=
ffort must be to enable standardized reporting of similar information from =
network infrastructure devices. With
 the growing number of Yang models and increased adoption of NETCONF, RESTC=
ONF, and related protocol work, the time is right to work out how these sta=
ndards can be used to measure the health of network devices. This informati=
on will, as in our efforts in SACM
 for client devices, support asset, software, vulnerability, and configurat=
ion management use cases. Standards-based reporting of this information fro=
m network infrastructure devices will help network defenders protect agains=
t known attacks, and provide the
 necessary knowledge to detect and mitigate future attacks. <br>
&gt; <br>
&gt; We would like to start a discussion about how to leverage the existing=
 IETF network management protocols to best address security automation for =
network infrastructure devices. We would like your ideas on how to best pur=
sue this work, and your insights into
 network infrastructure security problems that will impact our networks in =
the future. We are holding a side meeting at IETF 98 on Wednesday, March 29=
th at 6:30pm CDT to start a discussion about how to move forward. We will b=
e meeting in Vevey 4 at the IETF
 meeting venue.<br>
<br>
Maybe this was discussed in the BoF &#8230;<br>
<br>
The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.<br>
<br>
&gt; <br>
&gt; Here is a summary of the meeting details:<br>
&gt; <br>
&gt; PANIC (Posture Assessment through Network Information Collection) Bar =
BoF<br>
&gt; Wednesday, March 29th, 2017 @ 6:30pm CDT<br>
&gt; Swissotel Conference Center - Vevey 4<br>
&gt; <br>
&gt; We look forward to working with you, and hope to see you in Chicago at=
 the PANIC Bar BoF.<br>
&gt; <br>
&gt; Regards,<br>
&gt; Dave<br>
&gt; <br>
&gt; David Waltermire<br>
&gt; Information Technology Laboratory | Computer Security Division<br>
&gt; National Institute of Standards and Technology<br>
&gt; <br>
&gt; _______________________________________________<br>
&gt; Netconf mailing list<br>
&gt; <a href=3D"mailto:Netconf@ietf.org">Netconf@ietf.org</a><br>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/netconf">https://www.=
ietf.org/mailman/listinfo/netconf</a><br>
<br>
Mahesh Jethanandani<br>
<a href=3D"mailto:mjethanandani@gmail.com">mjethanandani@gmail.com</a><br>
<br>
<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>

--_000_MWHPR09MB1440EA71FBA40D793535A0CAF0370MWHPR09MB1440namp_--


From nobody Fri Mar 31 14:23:09 2017
Return-Path: <david.waltermire@nist.gov>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A50D1270FC; Fri, 31 Mar 2017 14:23:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nv8DxTKnBpHT; Fri, 31 Mar 2017 14:23:00 -0700 (PDT)
Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0116.outbound.protection.outlook.com [23.103.201.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D364129A0C; Fri, 31 Mar 2017 14:22:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=/p4KiTAn78IHZvOywMqia9OhuKCnXolpaYvdIUAvSj4=; b=QdQEWSkeW+h+kzinF+k4Kc6LuwJryYK5ik4t1FqtqV4+dboDpoK44TfLCDWPOuVrLRr+1pe3yYHRSjbEjsVcy83htaV3EIoTpKrFaD0i3xNkewqegs4CRmYCeuKzkdJP6yMuSda0tlXTd2Wr0p+fHCTIG55BboBvJI+ZZHuTeqs=
Received: from MWHPR09MB1440.namprd09.prod.outlook.com (10.173.50.14) by MWHPR09MB1437.namprd09.prod.outlook.com (10.173.50.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1005.10; Fri, 31 Mar 2017 21:22:57 +0000
Received: from MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) by MWHPR09MB1440.namprd09.prod.outlook.com ([10.173.50.14]) with mapi id 15.01.0991.023; Fri, 31 Mar 2017 21:22:57 +0000
From: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>
To: Mahesh Jethanandani <mjethanandani@gmail.com>
CC: "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>, "mile@ietf.org" <mile@ietf.org>
Thread-Topic: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8gDGe7oAADKZ5cA=
Date: Fri, 31 Mar 2017 21:22:57 +0000
Message-ID: <MWHPR09MB144020665679E0B16D4B6F1EF0370@MWHPR09MB1440.namprd09.prod.outlook.com>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com> <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com>
In-Reply-To: <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=nist.gov;
x-originating-ip: [129.6.223.96]
x-microsoft-exchange-diagnostics: 1; MWHPR09MB1437; 7:hTA2/3Zbv17b+e/hSFMR128IXfsMO523GkmSjE08Uts5tF5P6v0liUGswG3aPDw1DtE+r0JVx2mP4kafn88o9QC6Rq8YW+cSDCenvtWHMZ64jLsqelEn+8w1ZqNN3CuCCPbHpFRNyghhNSJqbA0WekH0WYfICoA64CrrBjzd0sRfFOq0HQgjNf4f82GkQS+AM1Won8a7zisNlmfPSPH0VBja08WMzkXGDIM9yS6/7U81IS8/4wp1gIKf6FaAFfTSaf3ubAn8hG7ArKFuVtnzyaZVRhyw0iH/Bgjd2sFCPFwBles6eO38QpZPBRiWTsbfEqGag8n0XnUZxQs2qcxV5w==
x-ms-office365-filtering-correlation-id: c503eee0-ada9-4568-96d4-08d4787c1a31
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081)(201702281549075); SRVR:MWHPR09MB1437; 
x-microsoft-antispam-prvs: <MWHPR09MB14372C73E3DD49C564421172F0370@MWHPR09MB1437.namprd09.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(65766998875637)(192374486261705)(211171220733660)(148717330147763); 
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(10201501046)(6055026)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(6072148); SRVR:MWHPR09MB1437; BCL:0; PCL:0; RULEID:; SRVR:MWHPR09MB1437; 
x-forefront-prvs: 02638D901B
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39860400002)(39850400002)(39410400002)(39840400002)(39450400003)(39400400002)(377454003)(13464003)(24454002)(5660300001)(66066001)(8936002)(9686003)(2906002)(229853002)(6306002)(76176999)(54356999)(50986999)(561944003)(33656002)(189998001)(86362001)(55016002)(6436002)(2900100001)(122556002)(54906002)(99286003)(6916009)(2950100002)(3660700001)(3280700002)(102836003)(8676002)(7736002)(3846002)(6116002)(74316002)(81156014)(81166006)(6246003)(110136004)(38730400002)(7696004)(6506006)(4326008)(53546009)(53936002)(77096006)(1411001)(305945005)(25786009)(39060400002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR09MB1437; H:MWHPR09MB1440.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; 
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2017 21:22:57.4265 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR09MB1437
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/tNoOEjJTkhAabU7Xg9s5eoPMhj4>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 21:23:02 -0000

TWFoZXNoLA0KDQpTdWJtaXR0aW5nIGEgZHJhZnQgdG8gdGhlIE5FVENPTkYgV0cgbWlnaHQgYmUg
YSBwYXRoIGZvcndhcmQuIEJhc2VkIG9uIHRoZSBmZWVkYmFjayB3ZSByZWNlaXZlZCwgd2UgYXJl
IHdvcmtpbmcgb24gYSBzY29wZSBkcmFmdCB0byBmb2N1cyB0aGUgZGlzY3Vzc2lvbiBhcm91bmQg
aG93IHdlIGNhbiBsZXZlcmFnZSBleGlzdGluZyB3b3JrLiBJIGhhdmUgYSBwZXJzb25hbCBpbmRp
dmlkdWFsIHN0cmVhbSBkcmFmdCByZWFkeSBhbmQgd2lsbCBwb3N0IGl0IGFzIHNvb24gYXMgSSBj
YW4gd29yayBvdXQgYW4gaXNzdWUgd2l0aCB0aGUgc3VibWlzc2lvbiB0b29sLg0KDQpSZWdhcmRz
LA0KRGF2ZSANCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBNYWhlc2gg
SmV0aGFuYW5kYW5pIFttYWlsdG86bWpldGhhbmFuZGFuaUBnbWFpbC5jb21dDQo+IFNlbnQ6IFRo
dXJzZGF5LCBNYXJjaCAzMCwgMjAxNyA1OjA5IFBNDQo+IFRvOiBXYWx0ZXJtaXJlLCBEYXZpZCBB
LiAoRmVkKSA8ZGF2aWQud2FsdGVybWlyZUBuaXN0Lmdvdj4NCj4gQ2M6IG5ldGNvbmZAaWV0Zi5v
cmc7IG5ldG1vZEBpZXRmLm9yZzsgc2FjbUBpZXRmLm9yZzsgbWlsZUBpZXRmLm9yZw0KPiBTdWJq
ZWN0OiBSZTogW05ldGNvbmZdIFBBTklDIEJhciBCb0YgV2VkbmVzZGF5IEAgNjozMHBtIENEVA0K
PiANCj4gRGF2aWQsDQo+IA0KPiA+IE9uIE1hciAyNiwgMjAxNywgYXQgNTozNCBQTSwgV2FsdGVy
bWlyZSwgRGF2aWQgQS4gKEZlZCkNCj4gPGRhdmlkLndhbHRlcm1pcmVAbmlzdC5nb3Y+IHdyb3Rl
Og0KPiA+DQo+ID4NCj4gPiBUaGUgVVMgR292ZXJubWVudCBoYXMgYmVlbiB3b3JraW5nIHdpdGhp
biB0aGUgSUVURiBTQUNNIHdvcmsgZ3JvdXAgdG8NCj4gc3RhbmRhcmRpemUgdGhlIGNvbGxlY3Rp
b24gb2YgZW5kcG9pbnQgY29uZmlndXJhdGlvbiBhbmQgb3RoZXIgcG9zdHVyZQ0KPiBpbmZvcm1h
dGlvbiBmcm9tIGVudGVycHJpc2UgZW5kcG9pbnRzLiBDb2xsZWN0aW5nIHRoaXMgaW5mb3JtYXRp
b24gaXMgY3JpdGljYWwNCj4gdG8gc3VwcG9ydCBhdXRvbWF0aW9uIG9mIGNvbW1vbiBuZXR3b3Jr
IHNlY3VyaXR5IHRhc2tzLCBpbmNsdWRpbmcgYXNzZXQsDQo+IHNvZnR3YXJlLCB2dWxuZXJhYmls
aXR5LCBhbmQgY29uZmlndXJhdGlvbiBtYW5hZ2VtZW50LiBUaHVzIGZhciwgb3VyIGVmZm9ydHMN
Cj4gaGF2ZSBmb2N1c2VkIHByaW1hcmlseSBvbiBzdGFuZGFyZHMgdG8gY29sbGVjdCBpbmZvcm1h
dGlvbiBpbiBzdXBwb3J0IG9mDQo+IGFzc2V0LCBzb2Z0d2FyZSBhbmQgdnVsbmVyYWJpbGl0eSBt
YW5hZ2VtZW50IHVzZSBjYXNlcywgYW5kIGhhcyB3b3JrZWQNCj4gd2l0aCBvdGhlciBJRVRGIG1l
bWJlcnMgdG8gZGV0ZXJtaW5lIHdoYXQgZGF0YSB3b3VsZCBuZWVkIHRvIGJlIHRvIGJlDQo+IGNv
bGxlY3RlZCwgYW5kIGhvdyB0aGF0IGRhdGEgd291bGQgYmUgc2VjdXJlbHkgY29tbXVuaWNhdGVk
IGFjcm9zcyB0aGUNCj4gbmV0d29yay4gVGhyb3VnaCBzdWNoIGV4Y2hhbmdlcyBhbiBvcmdhbml6
YXRpb24gY2FuIGtub3cgd2hhdCBjbGllbnQNCj4gZW5kcG9pbnRzIGFyZSBjb25uZWN0ZWQgdG8g
dGhlaXIgbmV0d29yaywgYW5kIGlmIHRoZXkgYXJlIHZ1bG5lcmFibGUgdG8NCj4gYXR0YWNrLg0K
PiA+DQo+ID4gR2l2ZW4gdGhlIHByb2xpZmVyYXRpb24gb2YgYXR0YWNrcyBhZ2FpbnN0IG5ldHdv
cmsgaW5mcmFzdHJ1Y3R1cmUgZGV2aWNlcywgaXQNCj4gaXMgY2xlYXIgdGhhdCB0aGUgbmV4dCBz
dGVwIGluIG91ciBlbnRlcnByaXNlIHNlY3VyaXR5IGF1dG9tYXRpb24gZWZmb3J0IG11c3QNCj4g
YmUgdG8gZW5hYmxlIHN0YW5kYXJkaXplZCByZXBvcnRpbmcgb2Ygc2ltaWxhciBpbmZvcm1hdGlv
biBmcm9tIG5ldHdvcmsNCj4gaW5mcmFzdHJ1Y3R1cmUgZGV2aWNlcy4gV2l0aCB0aGUgZ3Jvd2lu
ZyBudW1iZXIgb2YgWWFuZyBtb2RlbHMgYW5kDQo+IGluY3JlYXNlZCBhZG9wdGlvbiBvZiBORVRD
T05GLCBSRVNUQ09ORiwgYW5kIHJlbGF0ZWQgcHJvdG9jb2wgd29yaywgdGhlDQo+IHRpbWUgaXMg
cmlnaHQgdG8gd29yayBvdXQgaG93IHRoZXNlIHN0YW5kYXJkcyBjYW4gYmUgdXNlZCB0byBtZWFz
dXJlIHRoZQ0KPiBoZWFsdGggb2YgbmV0d29yayBkZXZpY2VzLiBUaGlzIGluZm9ybWF0aW9uIHdp
bGwsIGFzIGluIG91ciBlZmZvcnRzIGluIFNBQ00gZm9yDQo+IGNsaWVudCBkZXZpY2VzLCBzdXBw
b3J0IGFzc2V0LCBzb2Z0d2FyZSwgdnVsbmVyYWJpbGl0eSwgYW5kIGNvbmZpZ3VyYXRpb24NCj4g
bWFuYWdlbWVudCB1c2UgY2FzZXMuIFN0YW5kYXJkcy1iYXNlZCByZXBvcnRpbmcgb2YgdGhpcyBp
bmZvcm1hdGlvbiBmcm9tDQo+IG5ldHdvcmsgaW5mcmFzdHJ1Y3R1cmUgZGV2aWNlcyB3aWxsIGhl
bHAgbmV0d29yayBkZWZlbmRlcnMgcHJvdGVjdCBhZ2FpbnN0DQo+IGtub3duIGF0dGFja3MsIGFu
ZCBwcm92aWRlIHRoZSBuZWNlc3Nhcnkga25vd2xlZGdlIHRvIGRldGVjdCBhbmQgbWl0aWdhdGUN
Cj4gZnV0dXJlIGF0dGFja3MuDQo+ID4NCj4gPiBXZSB3b3VsZCBsaWtlIHRvIHN0YXJ0IGEgZGlz
Y3Vzc2lvbiBhYm91dCBob3cgdG8gbGV2ZXJhZ2UgdGhlIGV4aXN0aW5nIElFVEYNCj4gbmV0d29y
ayBtYW5hZ2VtZW50IHByb3RvY29scyB0byBiZXN0IGFkZHJlc3Mgc2VjdXJpdHkgYXV0b21hdGlv
biBmb3INCj4gbmV0d29yayBpbmZyYXN0cnVjdHVyZSBkZXZpY2VzLiBXZSB3b3VsZCBsaWtlIHlv
dXIgaWRlYXMgb24gaG93IHRvIGJlc3QNCj4gcHVyc3VlIHRoaXMgd29yaywgYW5kIHlvdXIgaW5z
aWdodHMgaW50byBuZXR3b3JrIGluZnJhc3RydWN0dXJlIHNlY3VyaXR5DQo+IHByb2JsZW1zIHRo
YXQgd2lsbCBpbXBhY3Qgb3VyIG5ldHdvcmtzIGluIHRoZSBmdXR1cmUuIFdlIGFyZSBob2xkaW5n
IGEgc2lkZQ0KPiBtZWV0aW5nIGF0IElFVEYgOTggb24gV2VkbmVzZGF5LCBNYXJjaCAyOXRoIGF0
IDY6MzBwbSBDRFQgdG8gc3RhcnQgYQ0KPiBkaXNjdXNzaW9uIGFib3V0IGhvdyB0byBtb3ZlIGZv
cndhcmQuIFdlIHdpbGwgYmUgbWVldGluZyBpbiBWZXZleSA0IGF0IHRoZQ0KPiBJRVRGIG1lZXRp
bmcgdmVudWUuDQo+IA0KPiBNYXliZSB0aGlzIHdhcyBkaXNjdXNzZWQgaW4gdGhlIEJvRiDigKYN
Cj4gDQo+IFRoZSBiZXN0IHdheSB0byBoYXZlIGEgZGlzY3Vzc2lvbiB3b3VsZCBiZSB0byBwcmVz
ZW50IHRoZSBwcm9wb3NhbCBpbiB0aGUNCj4gZm9ybSBvZiBhIGRyYWZ0IGluIHRoZSBORVRDT05G
IFdHLg0KPiANCj4gPg0KPiA+IEhlcmUgaXMgYSBzdW1tYXJ5IG9mIHRoZSBtZWV0aW5nIGRldGFp
bHM6DQo+ID4NCj4gPiBQQU5JQyAoUG9zdHVyZSBBc3Nlc3NtZW50IHRocm91Z2ggTmV0d29yayBJ
bmZvcm1hdGlvbiBDb2xsZWN0aW9uKSBCYXINCj4gPiBCb0YgV2VkbmVzZGF5LCBNYXJjaCAyOXRo
LCAyMDE3IEAgNjozMHBtIENEVCBTd2lzc290ZWwgQ29uZmVyZW5jZQ0KPiA+IENlbnRlciAtIFZl
dmV5IDQNCj4gPg0KPiA+IFdlIGxvb2sgZm9yd2FyZCB0byB3b3JraW5nIHdpdGggeW91LCBhbmQg
aG9wZSB0byBzZWUgeW91IGluIENoaWNhZ28gYXQNCj4gdGhlIFBBTklDIEJhciBCb0YuDQo+ID4N
Cj4gPiBSZWdhcmRzLA0KPiA+IERhdmUNCj4gPg0KPiA+IERhdmlkIFdhbHRlcm1pcmUNCj4gPiBJ
bmZvcm1hdGlvbiBUZWNobm9sb2d5IExhYm9yYXRvcnkgfCBDb21wdXRlciBTZWN1cml0eSBEaXZp
c2lvbg0KPiA+IE5hdGlvbmFsIEluc3RpdHV0ZSBvZiBTdGFuZGFyZHMgYW5kIFRlY2hub2xvZ3kN
Cj4gPg0KPiA+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
DQo+ID4gTmV0Y29uZiBtYWlsaW5nIGxpc3QNCj4gPiBOZXRjb25mQGlldGYub3JnDQo+ID4gaHR0
cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9uZXRjb25mDQo+IA0KPiBNYWhlc2gg
SmV0aGFuYW5kYW5pDQo+IG1qZXRoYW5hbmRhbmlAZ21haWwuY29tDQo+IA0KPiANCg0K


From nobody Fri Mar 31 15:30:30 2017
Return-Path: <evoit@cisco.com>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF40F126DCA; Fri, 31 Mar 2017 15:30:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.521
X-Spam-Level: 
X-Spam-Status: No, score=-14.521 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 940bh4kTDmyQ; Fri, 31 Mar 2017 15:30:20 -0700 (PDT)
Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 034BA124217; Fri, 31 Mar 2017 15:30:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19613; q=dns/txt; s=iport; t=1490999419; x=1492209019; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=7wxMQWivaC05J4CoJSQp3a/2s4VZdrYsseKXlN32Seo=; b=KZCNZ6aHuLUc3/SIJYtM6MDH7b+GStxp6tBVCiEnFd/1sGd95I3yWlc8 Js8QBsTJGBIJjzdCNNRhSmLE+EvV8pnSIeKV+/Yg7a3SGjXe07TzoqrJi 61YA2hnImMkrHPFukkKn3MvV4Os1RNGvxH1OpSR4DXNX58RHuKCzY5NLu c=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AWAQBB2N5Y/5FdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBgm49KWGBCweNbZFViBqNN4IOHwEMgkCCbEoCg0k/GAECAQEBAQE?= =?us-ascii?q?BAWsohRUBAQEBAgEBASs7BgsFCwIBCBEEAQEBDBsHIQYLFAkIAQEEAQ0FCBOIL?= =?us-ascii?q?YEtAw0IDq9BhywNgyQBAQEBAQEBAQEBAQEBAQEBAQEBAQEYBYZOhG+CUUaBc4U?= =?us-ascii?q?vBZwvOwGGfIcbhC+CBokFhjiKdoh6AR84gQVbFUGGWXWIToENAQEB?=
X-IronPort-AV: E=Sophos;i="5.36,254,1486425600";  d="scan'208,217";a="216950536"
Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 31 Mar 2017 22:30:18 +0000
Received: from XCH-RTP-012.cisco.com (xch-rtp-012.cisco.com [64.101.220.152]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id v2VMUIhm028690 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 31 Mar 2017 22:30:18 GMT
Received: from xch-rtp-013.cisco.com (64.101.220.153) by XCH-RTP-012.cisco.com (64.101.220.152) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 31 Mar 2017 18:30:17 -0400
Received: from xch-rtp-013.cisco.com ([64.101.220.153]) by XCH-RTP-013.cisco.com ([64.101.220.153]) with mapi id 15.00.1210.000; Fri, 31 Mar 2017 18:30:17 -0400
From: "Eric Voit (evoit)" <evoit@cisco.com>
To: "Waltermire, David A. (Fed)" <david.waltermire@nist.gov>, "Mahesh Jethanandani" <mjethanandani@gmail.com>
CC: "mile@ietf.org" <mile@ietf.org>, "netconf@ietf.org" <netconf@ietf.org>, "netmod@ietf.org" <netmod@ietf.org>, "sacm@ietf.org" <sacm@ietf.org>
Thread-Topic: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
Thread-Index: AdKmf/vNEHSnQfeERo2ni5F63VlU8gDGe7oAAAEA4X8AAQkXsAApvTOAAAkfouA=
Date: Fri, 31 Mar 2017 22:30:17 +0000
Message-ID: <20f788b0479b41fd8db957f78dc983aa@XCH-RTP-013.cisco.com>
References: <MWHPR09MB1440B3D5C3C983216D0BCB74F0300@MWHPR09MB1440.namprd09.prod.outlook.com>, <19D82D4B-0810-47EF-93CE-92539D64358D@gmail.com> <A406F4455056956FC17A5EEB332131B682A83BF7@unknown> <9ab236e3d421458e81f35534d2e13aaf@XCH-RTP-013.cisco.com> <MWHPR09MB1440A5DDCAC838605469B044F0370@MWHPR09MB1440.namprd09.prod.outlook.com>
In-Reply-To: <MWHPR09MB1440A5DDCAC838605469B044F0370@MWHPR09MB1440.namprd09.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.118.56.226]
Content-Type: multipart/alternative; boundary="_000_20f788b0479b41fd8db957f78dc983aaXCHRTP013ciscocom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/mile/nD7fFNohcX3I4WHPEeiBXISHeHs>
Subject: Re: [mile] [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mile/>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 22:30:23 -0000

--_000_20f788b0479b41fd8db957f78dc983aaXCHRTP013ciscocom_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

For experimentation, OpenDaylight has YANG Push code for the both subscribe=
r and publisher.  I can work with you offline to help define a viable testb=
ed.

Eric

From: Waltermire, David A,  March 31, 2017 5:17 PM

Eric,

We have considered YANG Push as part of PANIC. I have read the draft and I =
attended your presentation during NETCONF. I think Yang Push is something w=
e should consider as part of the PANIC solution. Do you have an implementat=
ion of YANG Push that can be experimented with?

Regards,
Dave

From: Eric Voit (evoit) [mailto:evoit@cisco.com]
Sent: Thursday, March 30, 2017 6:27 PM
To: Waltermire, David A. (Fed) <david.waltermire@nist.gov<mailto:david.walt=
ermire@nist.gov>>; Mahesh Jethanandani <mjethanandani@gmail.com<mailto:mjet=
hanandani@gmail.com>>
Cc: mile@ietf.org<mailto:mile@ietf.org>; netconf@ietf.org<mailto:netconf@ie=
tf.org>; netmod@ietf.org<mailto:netmod@ietf.org>; sacm@ietf.org<mailto:sacm=
@ietf.org>
Subject: RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT

Hi David,

I know it is early, but for the secure communication part, have you conside=
red using the YANG Push<https://datatracker.ietf.org/doc/draft-ietf-netconf=
-yang-push/?include_text=3D1> work being developed in the NETCONF WG?

With this approach, you can subscribe to state changes within a device's YA=
NG models.  These could be PANIC developed YANG models,  existing YANG mode=
ls such as IETF-System, IETF-keychain, or some combination.   Then if a hac=
ker inserts new hardware, changes software versions, adds keys, adds users,=
 etc. that state change can be securely pushed to a subscribing where it ca=
n be determined whether the change was expected/desired.

Eric
________________________________
On: 30 March 2017 16:09, "Mahesh Jethanandani" <mjethanandani@gmail.com<mai=
lto:mjethanandani@gmail.com>> wrote:
David,

> On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) <david.waltermire=
@nist.gov<mailto:david.waltermire@nist.gov>> wrote:
>
>
> The US Government has been working within the IETF SACM work group to sta=
ndardize the collection of endpoint configuration and other posture informa=
tion from enterprise endpoints. Collecting this information is critical to =
support automation of common network security tasks, including asset, softw=
are, vulnerability, and configuration management. Thus far, our efforts hav=
e focused primarily on standards to collect information in support of asset=
, software and vulnerability management use cases, and has worked with othe=
r IETF members to determine what data would need to be to be collected, and=
 how that data would be securely communicated across the network. Through s=
uch exchanges an organization can know what client endpoints are connected =
to their network, and if they are vulnerable to attack.
>
> Given the proliferation of attacks against network infrastructure devices=
, it is clear that the next step in our enterprise security automation effo=
rt must be to enable standardized reporting of similar information from net=
work infrastructure devices. With the growing number of Yang models and inc=
reased adoption of NETCONF, RESTCONF, and related protocol work, the time i=
s right to work out how these standards can be used to measure the health o=
f network devices. This information will, as in our efforts in SACM for cli=
ent devices, support asset, software, vulnerability, and configuration mana=
gement use cases. Standards-based reporting of this information from networ=
k infrastructure devices will help network defenders protect against known =
attacks, and provide the necessary knowledge to detect and mitigate future =
attacks.
>
> We would like to start a discussion about how to leverage the existing IE=
TF network management protocols to best address security automation for net=
work infrastructure devices. We would like your ideas on how to best pursue=
 this work, and your insights into network infrastructure security problems=
 that will impact our networks in the future. We are holding a side meeting=
 at IETF 98 on Wednesday, March 29th at 6:30pm CDT to start a discussion ab=
out how to move forward. We will be meeting in Vevey 4 at the IETF meeting =
venue.

Maybe this was discussed in the BoF ...

The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.

>
> Here is a summary of the meeting details:
>
> PANIC (Posture Assessment through Network Information Collection) Bar BoF
> Wednesday, March 29th, 2017 @ 6:30pm CDT
> Swissotel Conference Center - Vevey 4
>
> We look forward to working with you, and hope to see you in Chicago at th=
e PANIC Bar BoF.
>
> Regards,
> Dave
>
> David Waltermire
> Information Technology Laboratory | Computer Security Division
> National Institute of Standards and Technology
>
> _______________________________________________
> Netconf mailing list
> Netconf@ietf.org<mailto:Netconf@ietf.org>
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>

--_000_20f788b0479b41fd8db957f78dc983aaXCHRTP013ciscocom_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:0in;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
p.emailquote, li.emailquote, div.emailquote
	{mso-style-name:emailquote;
	mso-margin-top-alt:auto;
	margin-right:0in;
	mso-margin-bottom-alt:auto;
	margin-left:1.0pt;
	font-size:12.0pt;
	font-family:"Times New Roman",serif;}
span.EmailStyle19
	{mso-style-type:personal;
	font-family:"Calibri",sans-serif;
	color:#1F497D;}
span.EmailStyle20
	{mso-style-type:personal;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
span.EmailStyle21
	{mso-style-type:personal-reply;
	font-family:"Calibri",sans-serif;
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">For experimentation, OpenDaylight has=
 YANG Push code for the both subscriber and publisher.&nbsp; I can work wit=
h you offline to help define a viable testbed.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Eric<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt">
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif">From:</span></b><span style=3D"font-size:11.0pt;=
font-family:&quot;Calibri&quot;,sans-serif"> Waltermire, David A,&nbsp; Mar=
ch 31, 2017 5:17 PM<br>
<br>
<o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Eric,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">We have considered YANG Push as part of PANIC. I ha=
ve read the draft and I attended your presentation during NETCONF. I think =
Yang Push is something we should consider as part
 of the PANIC solution. Do you have an implementation of YANG Push that can=
 be experimented with?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Regards,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif">Dave<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif"><o:p>&nbsp;</o:p></span></p>
<div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt">
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,sans-serif">From:</span></b><span style=3D"font-size:11.0pt;=
font-family:&quot;Calibri&quot;,sans-serif"> Eric Voit (evoit) [</span><a h=
ref=3D"mailto:evoit@cisco.com"><span style=3D"font-size:11.0pt;font-family:=
&quot;Calibri&quot;,sans-serif">mailto:evoit@cisco.com</span></a><span styl=
e=3D"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">]
<br>
<b>Sent:</b> Thursday, March 30, 2017 6:27 PM<br>
<b>To:</b> Waltermire, David A. (Fed) &lt;</span><a href=3D"mailto:david.wa=
ltermire@nist.gov"><span style=3D"font-size:11.0pt;font-family:&quot;Calibr=
i&quot;,sans-serif">david.waltermire@nist.gov</span></a><span style=3D"font=
-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">&gt;; Mahesh
 Jethanandani &lt;</span><a href=3D"mailto:mjethanandani@gmail.com"><span s=
tyle=3D"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">mjetha=
nandani@gmail.com</span></a><span style=3D"font-size:11.0pt;font-family:&qu=
ot;Calibri&quot;,sans-serif">&gt;<br>
<b>Cc:</b> </span><a href=3D"mailto:mile@ietf.org"><span style=3D"font-size=
:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">mile@ietf.org</span></a=
><span style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif=
">;
</span><a href=3D"mailto:netconf@ietf.org"><span style=3D"font-size:11.0pt;=
font-family:&quot;Calibri&quot;,sans-serif">netconf@ietf.org</span></a><spa=
n style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">;
</span><a href=3D"mailto:netmod@ietf.org"><span style=3D"font-size:11.0pt;f=
ont-family:&quot;Calibri&quot;,sans-serif">netmod@ietf.org</span></a><span =
style=3D"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">;
</span><a href=3D"mailto:sacm@ietf.org"><span style=3D"font-size:11.0pt;fon=
t-family:&quot;Calibri&quot;,sans-serif">sacm@ietf.org</span></a><span styl=
e=3D"font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"><br>
<b>Subject:</b> RE: [Netconf] PANIC Bar BoF Wednesday @ 6:30pm CDT<o:p></o:=
p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Hi David,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">I know it is early, but for the secur=
e communication part, have you considered using the
</span><a href=3D"https://datatracker.ietf.org/doc/draft-ietf-netconf-yang-=
push/?include_text=3D1"><span style=3D"font-size:11.0pt;font-family:&quot;C=
alibri&quot;,sans-serif">YANG Push</span></a><span style=3D"font-size:11.0p=
t;font-family:&quot;Calibri&quot;,sans-serif;color:#1F497D">
 work being developed in the NETCONF WG?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">With this approach, you can subscribe=
 to state changes within a device&#8216;s YANG models.&nbsp; These could be=
 PANIC developed YANG models, &nbsp;existing YANG models such
 as IETF-System, IETF-keychain, or some combination.&nbsp;&nbsp; Then if a =
hacker inserts new hardware, changes software versions, adds keys, adds use=
rs, etc. that state change can be securely pushed to a subscribing where it=
 can be determined whether the change was
 expected/desired.&nbsp; <o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,sans-serif;color:#1F497D">Eric<o:p></o:p></span></p>
<div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt">
<div>
<div id=3D"x_contentToMakeEditableId">
<div style=3D"margin-left:3.75pt;margin-top:11.25pt" id=3D"x_content">
<div id=3D"x_signatureToRemoveId">
<div class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><span=
 style=3D"color:black">
<hr size=3D"5" width=3D"100%" align=3D"center">
</span></div>
<p class=3D"MsoNormal"><span style=3D"color:black">On: 30 March 2017 16:09,=
 &quot;Mahesh Jethanandani&quot; &lt;</span><a href=3D"mailto:mjethanandani=
@gmail.com">mjethanandani@gmail.com</a><span style=3D"color:black">&gt; wro=
te:<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize:10.0pt">David,<br>
<br>
&gt; On Mar 26, 2017, at 5:34 PM, Waltermire, David A. (Fed) &lt;</span><a =
href=3D"mailto:david.waltermire@nist.gov"><span style=3D"font-size:10.0pt">=
david.waltermire@nist.gov</span></a><span style=3D"font-size:10.0pt">&gt; w=
rote:<br>
&gt; <br>
&gt; <br>
&gt; The US Government has been working within the IETF SACM work group to =
standardize the collection of endpoint configuration and other posture info=
rmation from enterprise endpoints. Collecting this information is critical =
to support automation of common network
 security tasks, including asset, software, vulnerability, and configuratio=
n management. Thus far, our efforts have focused primarily on standards to =
collect information in support of asset, software and vulnerability managem=
ent use cases, and has worked with
 other IETF members to determine what data would need to be to be collected=
, and how that data would be securely communicated across the network. Thro=
ugh such exchanges an organization can know what client endpoints are conne=
cted to their network, and if they
 are vulnerable to attack.<br>
&gt; <br>
&gt; Given the proliferation of attacks against network infrastructure devi=
ces, it is clear that the next step in our enterprise security automation e=
ffort must be to enable standardized reporting of similar information from =
network infrastructure devices. With
 the growing number of Yang models and increased adoption of NETCONF, RESTC=
ONF, and related protocol work, the time is right to work out how these sta=
ndards can be used to measure the health of network devices. This informati=
on will, as in our efforts in SACM
 for client devices, support asset, software, vulnerability, and configurat=
ion management use cases. Standards-based reporting of this information fro=
m network infrastructure devices will help network defenders protect agains=
t known attacks, and provide the
 necessary knowledge to detect and mitigate future attacks. <br>
&gt; <br>
&gt; We would like to start a discussion about how to leverage the existing=
 IETF network management protocols to best address security automation for =
network infrastructure devices. We would like your ideas on how to best pur=
sue this work, and your insights into
 network infrastructure security problems that will impact our networks in =
the future. We are holding a side meeting at IETF 98 on Wednesday, March 29=
th at 6:30pm CDT to start a discussion about how to move forward. We will b=
e meeting in Vevey 4 at the IETF
 meeting venue.<br>
<br>
Maybe this was discussed in the BoF &#8230;<br>
<br>
The best way to have a discussion would be to present the proposal in the f=
orm of a draft in the NETCONF WG.<br>
<br>
&gt; <br>
&gt; Here is a summary of the meeting details:<br>
&gt; <br>
&gt; PANIC (Posture Assessment through Network Information Collection) Bar =
BoF<br>
&gt; Wednesday, March 29th, 2017 @ 6:30pm CDT<br>
&gt; Swissotel Conference Center - Vevey 4<br>
&gt; <br>
&gt; We look forward to working with you, and hope to see you in Chicago at=
 the PANIC Bar BoF.<br>
&gt; <br>
&gt; Regards,<br>
&gt; Dave<br>
&gt; <br>
&gt; David Waltermire<br>
&gt; Information Technology Laboratory | Computer Security Division<br>
&gt; National Institute of Standards and Technology<br>
&gt; <br>
&gt; _______________________________________________<br>
&gt; Netconf mailing list<br>
&gt; </span><a href=3D"mailto:Netconf@ietf.org"><span style=3D"font-size:10=
.0pt">Netconf@ietf.org</span></a><span style=3D"font-size:10.0pt"><br>
&gt; </span><a href=3D"https://www.ietf.org/mailman/listinfo/netconf"><span=
 style=3D"font-size:10.0pt">https://www.ietf.org/mailman/listinfo/netconf</=
span></a><span style=3D"font-size:10.0pt"><br>
<br>
Mahesh Jethanandani<br>
</span><a href=3D"mailto:mjethanandani@gmail.com"><span style=3D"font-size:=
10.0pt">mjethanandani@gmail.com</span></a><span style=3D"font-size:10.0pt">=
<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>

--_000_20f788b0479b41fd8db957f78dc983aaXCHRTP013ciscocom_--