Subject: [secdir] Secdir review of draft-ietf-mile-sci

From: Paul Hoffman <[email-masked]>
Date: Sun, 13 Oct 2013 16:59:20 -0700

draft-ietf-mile-sci, "IODEF-extension for structured cybersecurity information", describes extensions to the IODEF format to describe "cybersecurity information" such as types of attacks, vulnerabilities, and so on. This extension allows systems exchanging IODEF information to use a more standardized way to describe these specific types of information in XML.

The security considerations section basically says "when you transport sensitive cybersecurity information, do so carefully" which is probably sufficient because there are already standardized ways of securely transporting IODEF items, particularly RID. Nothing in this document warrants more security than what is already being transported in IODEF messages today.

--Paul Hoffman