Subject: [Cacao] Proposed Charter Text

From: Bret Jordan <[email-masked]>
Date: Sun, 2 Dec 2018 09:50:42 +0900

All,

Here is some proposed charter text for this working group.  Please send me any suggestions or changes you would like to see.  You can see the live version as a Google Doc here: https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit# <https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit#>

I am also attached it in IETF draft document form, not sure which was I should do it. The text is below…

Problem
Threat Actors and Intrusion Sets are advancing at an increasing rate relative to cyber defense. Further, cyber defenders typically have to manually identify and process prevention, mitigation, and remediation steps in order to protect their systems, networks, data, and users. 

Due to this increase and sophistication of cyber attacks the need for a secure mechanism that would enable system and network operators to respond to threats in machine relevant time has raised significantly. While some attacks may be well known to certain security experts and cyber researchers they are often not documented in a way that would enable automated mitigation or remediation. A documented language for describing prevention, mitigation, and remediation actions is critical for cyber defenders to respond more quickly and reduce the exposure from an attack. 

Working Group
To enable and assist cyber defense, the Collaborative Automated Course of Action Operations (CACAO) for Cyber Security working group will focus on creating a solution to securely document and share the actions needed to prevent, mitigate, and remediate threats. This effort will focus on providing an information model, data serialization, and transport for defining, sharing, and processing Collaborative Automated Course of Action Operations (CACAO). 

Each collaborative course of action will consist of a sequence of cyber defense actions that can be coordinated and deployed across a set of heterogeneous cyber security systems such that both the actions requested and the resultant outcomes may be monitored and verified. 

The primary focus of this proposed working group will be the definition and the distribution of the sequence of actions (perhaps in a tree or graph). Where possible we will leverage existing efforts that *may* define the atomic actions to be included in a process or sequence.

Goals
This working group has the following major goals:
* Identify and document the use cases and requirements

* Create an information and data model that can capture and enable collaborative courses of action (sometimes called playbooks) that can be used to automate some parts of cyber defense

* Identify and document the system functions and roles that must exist with associated protocols to exchange information between those system functions

* Identify and document the configuration for a series of protocols that can be used to distribute courses of action in both direct delivery and publish-subscribe methods

* Define and create a series of tests and documents to assist with interoperability

Deliverables 
The working group plans to create informational and standards track draft documents some of which may be published through the IETF RFC stream.

Within the first year, the working group aims to:
1. Identify a solution for capturing and distributing multiple sequenced atomic actions, whether they be manual or automated.
2. Publish a standards track draft solution that can be used by organizations and vendors to create and distribute Courses of Action / Playbooks.

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

---

From: Bret Jordan <[email-masked]>
Date: Thu, 6 Dec 2018 14:14:37 +0900

Any comments or suggestions for changes to this proposed charter?

Bret 

Sent from my Commodore 128D

> On Dec 2, 2018, at 9:50 AM, Bret Jordan <[email-masked]> wrote:
> 
> All,
> 
> Here is some proposed charter text for this working group.  Please send me any suggestions or changes you would like to see.  You can see the live version as a Google Doc here: https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit#
> 
> <draft-jordan-cacao-charter-00.txt>
> 
> Thanks,
> Bret

---

From: "Jyoti Verma (jyoverma)" <[email-masked]>
Date: Mon, 10 Dec 2018 21:15:11 +0000

Hi Bret,

I think this is a good charter to begin with.

Thanks,
Jyoti

From: Cacao <[email-masked]> on behalf of Bret Jordan <[email-masked]>
Date: Saturday, December 1, 2018 at 4:50 PM
To: "[email-masked]" <[email-masked]>
Subject: [Cacao] Proposed Charter Text

All,

Here is some proposed charter text for this working group.  Please send me any suggestions or changes you would like to see.  You can see the live version as a Google Doc here: https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit#<https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit>

Problem

Working Group

Goals

Deliverables

---

From: Allan Thomson <[email-masked]>
Date: Tue, 11 Dec 2018 01:47:44 +0000

I agree with Jyoti.

This effort promises to address a key set of challenges facing security orchestration and response whether it’s the orchestration side; detection or response capabilities.

The sooner we get the charter approach the sooner we can start to do the real work on the drafts that capture this area.

Frankly, I feel that the process has been fairly slow to this point and hope we can start to accelerate the work early next year.

Regards
Allan

From: Cacao <[email-masked]> on behalf of "Jyoti Verma (jyoverma)" <[email-masked]>
Date: Monday, December 10, 2018 at 1:15 PM
To: Bret Jordan <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [Cacao] Proposed Charter Text

Hi Bret,

Thanks,
Jyoti

All,

Problem

Working Group

Goals

Deliverables

---

From: <[email-masked]>
Date: Tue, 11 Dec 2018 13:11:21 +0000

Hi Bret,

Thank you for drafting and sharing a proposed charter.

I don’t have a gmail account, so I cannot modify the text online.

FWIW, please find our proposed modifications and comments to this proposed charter, both doc and pdf version are included:

doc: https://github.com/boucadair/IETF-Drafts-Reviews/raw/master/cacao-proposed%20charter-rev%2011122018a.docx
pdf: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/cacao-proposed%20charter-rev%2011122018a.pdf

Cheers,
Med

De : Cacao [mailto:[email-masked]] De la part de Bret Jordan
Envoyé : jeudi 6 décembre 2018 06:15
À : [email-masked]
Objet : Re: [Cacao] Proposed Charter Text

Bret

On Dec 2, 2018, at 9:50 AM, Bret Jordan <[email-masked]<mailto:[email-masked]>> wrote:
All,

Problem

Due to this increase and sophistication of cyber attacks the need for a secure mechanism that would enable system and network operators to respond to threats in machine relevant time has raised significantly. While some attacks may be well known to certain security experts and cyber researchers they are often not documented in a way that would enable automated mitigation or remediation.. A documented language for describing prevention, mitigation, and remediation actions is critical for cyber defenders to respond more quickly and reduce the exposure from an attack.

Working Group

Goals

Deliverables

Thanks,
Bret

---

From: Jason Webb <[email-masked]>
Date: Tue, 11 Dec 2018 16:42:00 +0000

Bret,

Thank you for your effort. This is an excellent charter. I feel that this is an important area that is not being addressed to date. This effort will help address problems in the security industry as we try to combat the ever growing and increasingly complicated threats to the cyber world.

I am excited by the possibilities of this effort. The sooner we can move forward with this effort, the better.

Thanks,

Jason Webb

________________________________
From: Cacao <[email-masked]> on behalf of [email-masked] <[email-masked]>
Sent: Tuesday, December 11, 2018 6:11 AM
To: Bret Jordan; [email-masked]
Cc: JACQUENET Christian TGI/OLN
Subject: Re: [Cacao] Proposed Charter Text

Hi Bret,

Cheers,

Med

Bret

All,

Problem

Working Group

Goals

Deliverables

Thanks,

Bret

---

From: "Arnaud.Taddei.IETF" <[email-masked]>
Date: Thu, 13 Dec 2018 03:00:52 +0000

Likewise, this is a good charter that addresses a serious gap, let alone it is a very interesting area

Thank you for taking the time to create this environment here

Sent with [ProtonMail](https://protonmail.com) Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday 11 December 2018 17:42, Jason Webb <[email-masked]> wrote:

> ---------------------------------------------------------------
>
>> Here is some proposed charter text for this working group.  Please send me any suggestions or changes you would like to see.  You can see the live version as a Google Doc here: [https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit#](https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit)
>>

---

From: "Jason Keirstead" <[email-masked]>
Date: Thu, 13 Dec 2018 10:00:00 -0400

Hi - I just wanted to relay that IBM Security supports this charter as 
well, and that we're very interested in doing what we can to progress this 
work. 

We believe if progressed & widely adopted, it will help fill a large gap 
in the cybersecurity collaboration ecosystem.

-
Jason Keirstead
Lead Architect - IBM Security Connect
www.ibm.com/security

"Things may come to those who wait, but only the things left by those who 
hustle." - Unknown 

From:   "Arnaud.Taddei.IETF" 
<Arnaud.Taddei.IETF=[email-masked]>
To:     Jason Webb <[email-masked]>
Cc:     "[email-masked]" <[email-masked]>, "[email-masked]" 
<[email-masked]>, JACQUENET Christian TGI/OLN 
<[email-masked]>, Bret Jordan <[email-masked]>
Date:   12/12/2018 11:01 PM
Subject:        Re: [Cacao] Proposed Charter Text
Sent by:        "Cacao" <[email-masked]>

Likewise, this is a good charter that addresses a serious gap, let alone 
it is a very interesting area

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday 11 December 2018 17:42, Jason Webb 
<[email-masked]> wrote:

Bret,

Thank you for your effort. This is an excellent charter. I feel that this 
is an important area that is not being addressed to date. This effort will 
help address problems in the security industry as we try to combat the 
ever growing and increasingly complicated threats to the cyber world. 

I am excited by the possibilities of this effort. The sooner we can move 
forward with this effort, the better.

Thanks,

Jason Webb

From: Cacao <[email-masked]> on behalf of 
[email-masked] <[email-masked]>
Sent: Tuesday, December 11, 2018 6:11 AM
To: Bret Jordan; [email-masked]
Cc: JACQUENET Christian TGI/OLN
Subject: Re: [Cacao] Proposed Charter Text 
 
Hi Bret,

 
FWIW, please find our proposed modifications and comments to this proposed 
charter, both doc and pdf version are included:
 
doc: 
https://github.com/boucadair/IETF-Drafts-Reviews/raw/master/cacao-proposed%20charter-rev%2011122018a.docx
pdf: 
https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/cacao-proposed%20charter-rev%2011122018a.pdf 

Cheers,
Med

 
Bret 

 
Here is some proposed charter text for this working group.  Please send me 
any suggestions or changes you would like to see.  You can see the live 
version as a Google Doc here: 
https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit#
 
I am also attached it in IETF draft document form, not sure which was I 
should do it. The text is below…

 
Problem
Threat Actors and Intrusion Sets are advancing at an increasing rate 
relative to cyber defense. Further, cyber defenders typically have to 
manually identify and process prevention, mitigation, and remediation 
steps in order to protect their systems, networks, data, and users. 

Due to this increase and sophistication of cyber attacks the need for a 
secure mechanism that would enable system and network operators to respond 
to threats in machine relevant time has raised significantly. While some 
attacks may be well known to certain security experts and cyber 
researchers they are often not documented in a way that would enable 
automated mitigation or remediation.. A documented language for describing 
prevention, mitigation, and remediation actions is critical for cyber 
defenders to respond more quickly and reduce the exposure from an attack. 

Working Group
To enable and assist cyber defense, the Collaborative Automated Course of 
Action Operations (CACAO) for Cyber Security working group will focus on 
creating a solution to securely document and share the actions needed to 
prevent, mitigate, and remediate threats. This effort will focus on 
providing an information model, data serialization, and transport for 
defining, sharing, and processing Collaborative Automated Course of Action 
Operations (CACAO). 

Each collaborative course of action will consist of a sequence of cyber 
defense actions that can be coordinated and deployed across a set of 
heterogeneous cyber security systems such that both the actions requested 
and the resultant outcomes may be monitored and verified. 

The primary focus of this proposed working group will be the definition 
and the distribution of the sequence of actions (perhaps in a tree or 
graph). Where possible we will leverage existing efforts that *may* define 
the atomic actions to be included in a process or sequence.

Goals
 
* Create an information and data model that can capture and enable 
collaborative courses of action (sometimes called playbooks) that can be 
used to automate some parts of cyber defense
 
* Identify and document the system functions and roles that must exist 
with associated protocols to exchange information between those system 
functions
 
* Identify and document the configuration for a series of protocols that 
can be used to distribute courses of action in both direct delivery and 
publish-subscribe methods
 
* Define and create a series of tests and documents to assist with 
interoperability
 
Deliverables 
The working group plans to create informational and standards track draft 
documents some of which may be published through the IETF RFC stream.

Within the first year, the working group aims to:
1. Identify a solution for capturing and distributing multiple sequenced 
atomic actions, whether they be manual or automated.
2. Publish a standards track draft solution that can be used by 
organizations and vendors to create and distribute Courses of Action / 
Playbooks.

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that 
can not be unscrambled is an egg."
 
-- 
Cacao mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cacao