Subject: [secdir] EU Cyber Security Strategy.

From: Olaf Kolkman <[email-masked]>
Date: Mon, 28 Jan 2013 13:42:11 +0100

Folk,

This mail is FYI, it may be of business/personal interest to some of you. 
I have a specific question.

Context: MSP for ICT St.

You may or may not be aware that the EU has a Multi Stakeholder Platform for ICT standardization. One of the stakeholders at the table is the IETF/IAB and your truly is, with Hannes Tschofenig as backup, the representative for the IETF/IAB.

The platform is chartered to give the Commission advise on all matters standard and to identify standards, developed by fora and consortia, that can be used in public procurement (formally RFCs can not be reference in EU procurement: when these folk talk about standards they think ISO, ITU, ETSI etc etc.)

Specific: EU Cyber Sec Strat.

What is attached is part on the advise on all matters standard aspect. The document gives a short executive level overview of what the EU intends with its cyber security strategy. The document is FYI mainly.

However I have one particular bit of information that I need. See the section on "Where do standards come in". I do not think there is any relevant IETF work in this area (info exchange and such) and would like to get guidance if that is a misunderstanding.

The platform is having its 3rd meeting 7 Feb.

NLnet
Labs
Olaf M. Kolkman

www.NLnetLabs.nl
[email-masked]

Science Park 400, 1098 XH Amsterdam, The Netherlands

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 28 Jan 2013 15:13:25 +0200

The challenge with CyberSecurity (or Internet Security as I call it) is the unclear scope. Depending on your scope pretty much every security specification in the IETF is relevant. 
Of course there are other factors that matter for security that are outside the scope of the IETF. For example, the best security protocol will not help when the software implementation is buggy. 

As an example, you could call RFC 3552 a document that provides "security-by-design guidelines". You could also call the documents from the Messaging Abuse Reporting Format (marf) working group "standards related to information exchange". 

Ciao
Hannes

On Jan 28, 2013, at 2:42 PM, Olaf Kolkman wrote:

> <04420Brief20on20Cybersecurity20Strategy20and.pdf>
> 
> 
> NLnet
> Labs
> Olaf M. Kolkman
> 
> www.NLnetLabs.nl
> [email-masked]
> 
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview

---

From: Olaf Kolkman <[email-masked]>
Date: Mon, 28 Jan 2013 14:42:19 +0100

> As an example, you could call RFC 3552 a document that provides "security-by-design guidelines". You could also call the documents from the Messaging Abuse Reporting Format (marf) working group "st…

Thanks... exactly the type of info I was looking for.

--Olaf

NLnet
Labs
Olaf M. Kolkman

www.NLnetLabs.nl
[email-masked]

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 28 Jan 2013 21:02:27 +0000

Hi Olaf,

I think Hannes' answer was right, and there are more security
related BCPs (e.g. BCP107). Would it help to make a list or
can you just say there's a bunch of those and here're some
examples? If the former we can get you a longer list I guess;-)

And I've a question back to you: might it be useful to have
some kind of engagement between the IETF security area and
ENISA and would that be something to bring up in this context?

If a very light form of that was useful we'd be happy to
invite some ENISA person(s) to come to a secdir lunch or give
a talk at a saag session whenever. (Note: I don't mean from
some known IETFer who's done stuff with ENISA but rather
someone from ENISA who's not been to an IETF but might
usefully inhale our fumes;-)

S.

On 01/28/2013 12:42 PM, Olaf Kolkman wrote:
> You may or may not be aware that the EU has a Multi Stakeholder Platform for ICT 
> standardization. One of the stakeholders at the table is the IETF/IAB and your 
> truly is, with Hannes Tschofenig as backup, the representative for the IETF/IAB.
> 
> The platform is chartered to give the Commission advise on all matters standard 
> and to identify standards, developed by fora and consortia, that can be used in 
> public procurement (formally RFCs can not be reference in EU procurement: when 
> these folk talk about standards they think ISO, ITU, ETSI etc etc.)
> 
> 
> What is attached is part on the advise on all matters standard aspect. The 
> document gives a short executive level overview of what the EU intends with its 
> cyber security strategy. The document is FYI mainly.
> 
> However I have one particular bit of information that I need. See the section on 
> "Where do standards come in". I do not think there is any relevant IETF work in 
> this area (info exchange and such) and would like to get guidance if that is a 
> misunderstanding.
> 
> 
> *NLnet
> *Labs
> www.NLnetLabs.nl <http://www.NLnetLabs.nl>
> [email-masked] <mailto:[email-masked]>
> 	
>

---

From: Olaf Kolkman <[email-masked]>
Date: Tue, 29 Jan 2013 10:35:36 +0100

> examples? If the former we can get you a longer list I guess;-)

I am not quite sure what the dynamics in the MSP will be on topics like this and given that the agenda for the Feb 7 meeting is challengingly long I am afraid not much detail will be discussed. Anyhow, the answer from you and Hannes are useful bagage to have in the back pocket.

> usefully inhale our fumes;-)

Yes, I think so.

But the MSP is not affiliated with ENISA, Enisa is clearly a different channel. 

That said, with the IETF being in Berlin in summer we have just sufficient time to try and organize something. I think that it is useful to try and engage in conversation if you have a clear goal in mind of what you want to achieve.

For me: Establishing informal contacts and informing about the going ons in the IETF is a reasonable idea.

As for making that go: We have at least one channel into ENISA, but that is at a rather high level that I wouldn't like to use unless there is a solid a plan and some draft agenda (My co-worker knows one of the guys in the management boards).

A brain-fart along the same lines; maybe we could do something 'regional' by inviting members of the MultiStakeHolder platform for a one day tour. With as sole goal to expose them to the IETF and possibly introduce them to some key leadership figures. The impact of such could be a lot of goodwill, although they might also walk away in suprise :-). It would be a way to get a lot of key Standardization people, especially from all countries, exposed to the IETF. Maybe organizing for Berlin is a bit of a challenge (If we were to do it there I think we should gauge interest during the 7 Feb meeting, and I don't think we have a solid idea by then). But London next year? Perhaps linked to an IAB plenary (deadly boring, but probably of relevance).

The last paragraph was me thinking out loud, not thinking things through.

--Olaf

NLnet
Labs
Olaf M. Kolkman

www.NLnetLabs.nl
[email-masked]

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 30 Jan 2013 17:03:10 -0500

Thank you for sending out the information.  The IETF working group called Managed incident Lightweight Exchange (MILE) has standards that can be used and referenced in this space.  We are just about to begin work on revising RFC5070 to update the data model to meet current use cases.  It would be great to have their input to ensure their use cases are met as a number of vendors are interested in using international standards to enable information sharing.

If they need to reference ISO or ITU-T standards, there are actually ITU-T Recommendations that point to several of the key RFCs:
x.1540  is reference to RFC5070
x.1580 is a reference to RFC6545
x.1581 is a reference to  RFC6546

I am involved in several efforts using the standards and am happy to help with more information or connection points that are possible now or in the future.

Best regards,
Kathleen

From: [email-masked] [mailto:[email-masked]] On Behalf Of Olaf Kolkman
Sent: Monday, January 28, 2013 7:42 AM
To: [email-masked]
Cc: IAB IAB; Hannes Tschofenig
Subject: [secdir] EU Cyber Security Strategy.

Folk,

Context: MSP for ICT St.