Subject: Re: [Secdispatch] Fw: New Version Notification for draft-paine-smart-indicators-of-compromise-00.txt

From: Kirsty P <[email-masked]>
Date: Fri, 13 Mar 2020 13:28:48 +0000

Thanks for your interest in the draft.

You’re right that we’re not setting out to specify a protocol, or necessarily an example of Best Current Practice, but the ability to detect and use Indicators of Compromise to protect against attack can be impacted heavily by protocol design decisions, so there is a clear benefit in providing a reference to help designers to consider this impact.

Given that, I hope that this will become an Informational RFC, but I’m keen to hear more thoughts on the most appropriate way to publish what we believe to be an important aid to those considering protocol security.

________________________________
From: Michael Richardson
Sent: Tuesday, March 10, 2020 17:38
To: Kirsty P
Cc: [email-masked]
Subject: Re: [Secdispatch] Fw: New Version Notification for draft-paine-smart-indicators-of-compromise-00.txt

Hi, thank you for this interesting document.
It uses terminology which I did not know existed before.

The document does not specify a protocol of any kind, although MISP-project
is referenced.   It does not seem to be about any kind of directly
implementable Best Current Practice, but seems like background for something
bigger.

I'm not sure how publishing this as an RFC would be helpful.
Are you considering ways to represent the Indicators such that they can be
more easily exchanged?  I believe that the IETF has done a bunch of work in
that area (INCH, MILE, IODEF come to mind), but perhaps not exactly in this
direction.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]. All material is UK Crown Copyright ©