Subject: [mile] MILE Kick-off message

From: <[email-masked]>
Date: Thu, 19 May 2011 16:45:38 -0400

Hello!

Thank you for joining the MILE mailing list!  We are looking forward to increased collaboration and progress in this space.  The message below begins with a summary from the mailing list welcome message and then leads into several topics for discussion to assist with charter and scope of work development.  We look forward to your feedback!

Welcome Message/Initial Goals:

The MILE pre-working group will initially be focused on the development of a charter and scope of work effort for standards and extensions to meet the needs of a global community interested in sharing, exchanging, and handling incidents.  Collaboration and sharing experiences with the data model or use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC5901), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045, RFC6046) standards will improve any solutions created to enable collaboration for incident response and sharing.  This list is for charter and pre-WG technical discussion about MILE,  which intends to describe a subset of IODEF aimed at exchanging easily readable incident information focused on those things which people actually exchange.   Extensions needed by the IODEF and RID community to ensure current relevant use cases for the exchange of incident information may also be discussed.

Questions for the List:

The above welcome statement calls out specifically the goal of the list: "This list is for charter and pre-WG technical discussion about MILE,  which intends to describe a subset of IODEF aimed at exchanging easily readable incident information focused on those things which people actually exchange."

*       Are there opinions or thoughts on what is needed by the WG to achieve this goal?

We have had several volunteers come forward offering to initiate work on extensions to IODEF.  Having a template with guidance on what is required in an extension document would be a very useful start.  We are looking for volunteers to help create this template and guidance.

*       What are your thoughts on a template (maybe based off of RFC5901) before we move into the creation/modification of any IODEF extensions?

Here is the list of proposed extensions with some volunteer editors listed (more are welcome).  Is this the right list of extensions?

*       Mail abuse (from MARF WG)
*       Forensic data (Youn-Hee Gil and Dowon Hong)
*       Virtualized environments (NIST Cloud WG participants: Matt Smith and Phil Cox)
*       Malicious infrastructure - REN-ISAC?
*       Actor profiles - REN-ISAC?
*       Malicious code characteristics - REN-ISAC?
*       Integrating SCAP Content (may be through one of the above)
*       Financial transaction/fraud - review/change RFC5901

Best regards,
Kathleen, Brian, & Tom

---

From: <[email-masked]>
Date: Tue, 31 May 2011 11:17:08 -0400

To follow up from the data sharing restrictions/markings discussion, a new IODEF extension should be added to the list for the purpose of charter discussions and additional guidance for RID will be needed.  

Here is what we have right now for the list of extensions:
*       Mail abuse (from MARF WG) - would like the name of a volunteer
*       Forensic data (Youn-Hee Gil and Dowon Hong)
*       Virtualized environments (NIST Cloud WG participants: Matt Smith and Phil Cox)
*       Malicious infrastructure - REN-ISAC?
*       Actor profiles - REN-ISAC?
*       Malicious code characteristics - REN-ISAC?
*       Integrating SCAP Content (may be through one of the above)
*       Financial transaction/fraud - review/change RFC5901
*	  Data sharing restrictions/markings (we can change and evolve the name)

We do need more editors, so please volunteer if the areas are of interest.  Having multiple editors on a document is welcome.

Can anyone volunteer to assist with an extension template and guidance document?

We have also had requests for guidance on other use cases, so we may need to factor that in as well.  Yuri from the ITU-T has expressed interest in guidance for misuse.

Thank you!
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Thursday, May 19, 2011 4:46 PM
To: [email-masked]
Subject: [mile] MILE Kick-off message

Hello!

Questions for the List:

Best regards,
Kathleen, Brian, & Tom

_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile