Subject: Re: [mile] Forensics Extension

From: Tony Rutkowski <[email-masked]>
Date: Wed, 14 Mar 2012 17:50:45 -0400

Chris et al,

This "forensics" work could be a perfect
candidate for CybOX deployment.

For some odd reason, the word forensics
has been used in multiple venues over the
past several years with the connotation of
a data structure for static information -
generally from a storage device of some
kind - that has value as evidence.

There are a large number of potential similar
use cases with slight variants.  CybOX seems
made to order, although that would require some
additional work to deal with enumerations

--tony

n 2/28/2012 4:00 PM, Chris Inacio wrote:
>
> I submitted the beginnings of a draft.  It's in pretty rough shape at this point - so there is still A LONG way to go on it.
>
> It borrows (heavily) from work submitted to ITU&  DFXML.
>

---

From: "Barnum, Sean D." <[email-masked]>
Date: Thu, 15 Mar 2012 21:15:39 +0000

You are correct Tony and the CybOX effort has already targeted and is
working on supporting the digital forensics use case potentially with a thin
layer wrapped around the actual observables to convey uniquely forensics
context such as process.
We are interacting with the folks involved with DFXML and have talked with
several other players as well.

It certainly makes sense to us to extend CybOX to cover forensics (as there
is an obvious and huge overlap) and then have any sort of forensics
extension to IODEF involve a lightweight forensics wrapper around CybOX
content similar to what is in development around cyber indicator exchange.

Thank you for pointing this out.

Sean

-----Original Message-----
From: Tony Rutkowski [mailto:[email-masked]] 
Sent: Wednesday, March 14, 2012 5:51 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [mile] Forensics Extension

Chris et al,

--tony

n 2/28/2012 4:00 PM, Chris Inacio wrote:
>
> I submitted the beginnings of a draft.  It's in pretty rough shape at this
point - so there is still A LONG way to go on it.

---

From: <[email-masked]>
Date: Thu, 15 Mar 2012 18:13:18 -0400

A little background: MILE has a charter item to cover a forensics extension.  The work submitted by Chris was derived from multiple forensics efforts, in particular one from Korea where they worked closely with enCase for their ITU submission.  The work in the ITU had significant overlap with IODEF, hence the move to include this as an extension to IODEF with the researchers from Korea supporting this move.  The DFXML work is in early stages, but was also included in Chris' initial draft that was posted.

Chris will be presenting the work and plans to further develop the extension at the Paris IETF.  Thank you for putting together the initial draft, Chris.  The purpose is to give the WG the opportunity to decide if this initial work will be adopted by the WG and further developed to meet the charter item.

We have a tight agenda and the -00 draft submission deadline has passed.  If a proposal using CybOX should be considered for this charter item/objective, is there a proposal for review?  This typically requires a draft and is sometimes a presentation with a draft to follow.  Comparisons of the drafts may be required for the WG to vote/hum on the preferred approach.

Thank you,
Kathleen (as WG chair)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Barnum, Sean D.
Sent: Thursday, March 15, 2012 5:16 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [mile] Forensics Extension

Sean

-----Original Message-----
From: Tony Rutkowski [mailto:[email-masked]] 
Sent: Wednesday, March 14, 2012 5:51 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [mile] Forensics Extension

Chris et al,

--tony