Subject: Re: [mile] [Issue #7] Additional values for NodeRole@category

From: "Roman D. Danyliw" <[email-masked]>
Date: Thu, 1 Aug 2013 19:06:39 +0000

Hi Jerome!

Thanks for the listing.  Ignoring the actual content for a second, we need to proceed carefully.  The WG likely doesn't have the ability to use this reference outright since it isn't a usable normative reference.

Treating this text as inspiration, the following are the items that VERIS includes (and STIX uses this list outright too in AssetTypeEnum-1.0) that aren't mapped into either the current or proposed NodeRole@category:

S - DCS

S - Mainframe

S - Payment switch

S - Web application

S - VM host

S - Other server

S - Other

N - Access reader

N - HSM

N - IDS

N - Broadband

N - PBX

N - Private WAN

N - PLC

N - Public WAN

N - RTU

N - SAN

N - Telephone

N - VoIP adapter

N - LAN

N - WLAN

N - Other

U - Auth token

U - ATM

U - Desktop

U - PED pad

U - Gas terminal

U - Laptop

U - Media

U - Mobile phone

U - Peripheral

U - POS terminal

U - Kiosk

U - Tablet

U - Telephone

U - VoIP phone

U - Other

M - Tapes

M - Disk media

M - Documents

M - Flash drive

M - Disk drive

M - Smart card

M - Payment card

M - Other

P - System admin

P - Auditor

P - Call center

P - Cashier

P - Customer

P - Developer

P - End-user

P - Executive

P - Finance

P - Former employee

P - Guard

P - Helpdesk

P - Human resources

P - Maintenance

P - Manager

P - Partner

P - Other

The following is a quick analysis commenting on each of these items, per category:

** "S items" --

  ** S - DCS, a little help here.  Is that Microsoft Distributed Connectivity Services?

  ** S - Mainframe -- currently missing

  ** S - Payment switch -- currently missing

  ** S - Web application -- IODEF has "web".  Is the distinction important?

  ** S - VM host -- Is this preferred to the proposal to add an attribute in System, http://www.ietf.org/mail-archive/web/mile/current/msg01110.html?

  ** S - Other server -- There is no "other" in the current text.  "Other" would suggest one doesn't know.  Is that the equivalent of simply not including the NodeRole class?

** "N" items -- This list reminded me that System can describe both a system or a network.  The current list of enumeration only covers uses of System that are individual systems not networks.  I think we should further explore this gap.  How do others feel?

** "U" items -- This list speaks to form factor rather than role.  If we'd pursue this course, I'd recommend a separate attribute.  Is there interest?

** "M" items -- There is currently no support for describing media since this is an additional level of detail for System/Node which is intended to describe a host.  Is there interest?

** "P" items -- There is currently no support for classifying the users of the system.  To the WG, is there a desire to include this new information in @category or in some other place in the data model?  The closest thing to this idea is the proposal to add System/Node/Contact, which adds Contact@role to the system.

Roman

From: Jerome Athias [mailto:[email-masked]]
Sent: Thursday, August 01, 2013 1:46 AM
To: Roman D. Danyliw
Cc: [email-masked]
Subject: Re: [mile] [Issue #7] Additional values for NodeRole@category

Hi,

my mistake since it was not included in the excel file, this is the Assets Variety coming from VERIS:
AssetVarietyName

S - Authentication

S - Backup

S - Database

S - DHCP

S - Directory

S - DCS

S - DNS

S - File

S - Log

S - Mail

S - Mainframe

S - Payment switch

S - POS controller

S - Print

S - Proxy

S - Remote access

S - SCADA

S - Web application

S - VM host

S - Other server

S - Other

N - Access reader

N - Camera

N - Firewall

N - HSM

N - IDS

N - Broadband

N - PBX

N - Private WAN

N - PLC

N - Public WAN

N - RTU

N - Router or switch

N - SAN

N - Telephone

N - VoIP adapter

N - LAN

N - WLAN

N - Other

U - Auth token

U - ATM

U - Desktop

U - PED pad

U - Gas terminal

U - Laptop

U - Media

U - Mobile phone

U - Peripheral

U - POS terminal

U - Kiosk

U - Tablet

U - Telephone

U - VoIP phone

U - Other

M - Tapes

M - Disk media

M - Documents

M - Flash drive

M - Disk drive

M - Smart card

M - Payment card

M - Other

P - System admin

P - Auditor

P - Call center

P - Cashier

P - Customer

P - Developer

P - End-user

P - Executive

P - Finance

P - Former employee

P - Guard

P - Helpdesk

P - Human resources

P - Maintenance

P - Manager

P - Partner

P - Other

I hope it helps
Regards

Jerome Athias

2013/8/1 Roman D. Danyliw <[email-masked]<mailto:[email-masked]>>
Hi Jerome!

Thanks for the pointer.  Could you help us navigate to which subset of the vocabulary should be reviewed?  I was looking at the spreadsheet http://www.frhack.org/research/Information_Security_Vocabularies.xlsx for details.  Which tab best applies to NodeRole@category?

Roman

From: Jerome Athias [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Sunday, July 28, 2013 10:59 AM
To: Roman D. Danyliw
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [mile] [Issue #7] Additional values for NodeRole@category

Hi

I would suggest to review/use the Common Vocabularies file available at
http://www.frhack.org/research/xorcism.php

Le dimanche 28 juillet 2013, Roman D. Danyliw a écrit :
Per: http://trac.tools.ietf.org/wg/mile/trac/ticket/7

I would propose adding the following additional enumerated values to NodeRole@category to expand on the legitimate uses of a given system:

                  <xs:enumeration value="client-enterprise" />
                  <xs:enumeration value="client-partner" />
                  <xs:enumeration value="client-remote" />
                  <xs:enumeration value="client-public-kiosk" />
                  <xs:enumeration value="client-mobile" />
                  <xs:enumeration value="backup" />
                  <xs:enumeration value="dhcp" />
                  <xs:enumeration value="dns" />
                  <xs:enumeration value="remote-access" />
                  <xs:enumeration value="camera" />
                  <xs:enumeration value="proxy" />
                  <xs:enumeration value="infra-firewall" />
                  <xs:enumeration value="infra-router" />
                  <xs:enumeration value="infra-switch" />
                  <xs:enumeration value="virtualization" />
                  <xs:enumeration value="pos-device" />
                  <xs:enumeration value="scada" />
                  <xs:enumeration value="scada-supervisory" />

Any others that are missing?  Dissent on these?

Roman
_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile

---

From: Jerome Athias <[email-masked]>
Date: Sun, 4 Aug 2013 18:44:55 +0200

Hi,

comments inline

2013/8/1 Roman D. Danyliw <[email-masked]>

>  Hi Jerome!****
>
> ** **
>
> Thanks for the listing.  Ignoring the actual content for a second, we need
> to proceed carefully.  The WG likely doesn't have the ability to use this
> reference outright since it isn't a usable normative reference.****
>
> ** **
>
> Treating this text as inspiration, the following are the items that VERIS
> includes (and STIX uses this list outright too in AssetTypeEnum-1.0) that
> aren't mapped into either the current or proposed NodeRole@category:****
>
> ** **
>
> S - DCS****
>
> S - Mainframe****
>
> S - Payment switch****
>
> S - Web application****
>
> S - VM host****
>
> S - Other server****
>
> S - Other****
>
> N - Access reader****
>
> N - HSM****
>
> N - IDS****
>
> N - Broadband****
>
> N - PBX****
>
> N - Private WAN****
>
> N - PLC****
>
> N - Public WAN****
>
> N - RTU****
>
> N - SAN****
>
> N - Telephone****
>
> N - VoIP adapter****
>
> N - LAN****
>
> N - WLAN****
>
> N - Other****
>
> U - Auth token****
>
> U - ATM****
>
> U - Desktop****
>
> U - PED pad****
>
> U - Gas terminal****
>
> U - Laptop****
>
> U - Media****
>
> U - Mobile phone****
>
> U - Peripheral****
>
> U - POS terminal****
>
> U - Kiosk****
>
> U - Tablet****
>
> U - Telephone****
>
> U - VoIP phone****
>
> U - Other****
>
> M - Tapes****
>
> M - Disk media****
>
> M - Documents****
>
> M - Flash drive****
>
> M - Disk drive****
>
> M - Smart card****
>
> M - Payment card****
>
> M - Other****
>
> P - System admin****
>
> P - Auditor****
>
> P - Call center****
>
> P - Cashier****
>
> P - Customer****
>
> P - Developer****
>
> P - End-user****
>
> P - Executive****
>
> P - Finance****
>
> P - Former employee****
>
> P - Guard****
>
> P - Helpdesk****
>
> P - Human resources****
>
> P - Maintenance****
>
> P - Manager****
>
> P - Partner****
>
> P - Other****
>
> ** **
>
> The following is a quick analysis commenting on each of these items, per
> category:****
>
> ** **
>
> ** "S items" --****
>
*Server - Distributed control system (DCS)*

> ****
>
>   ** S - Mainframe -- currently missing****
>
>   ** S - Payment switch -- currently missing****
>
For me not important

> ****
>
>   ** S - VM host -- Is this preferred to the proposal to add an attribute
> in System, http://www.ietf.org/mail-archive/web/mile/current/msg01110.html
> ?
>
Virtual attribute in System is ok for me (but btw I prefer to speak of
Asset than System...)

> ****
>
>   ** S - Other server -- There is no "other" in the current text.  "Other"
> would suggest one doesn't know.  Is that the equivalent of simply not
> including the NodeRole class?
>
Yes

> ****
>
> ** **
>
> ** "N" items -- This list reminded me that System can describe both a
> system or a network.  The current list of enumeration only covers uses of
> System that are individual systems not networks.  I think we should further
> explore this gap.  How do others feel?
>
Again, I prefer to use the term Asset than System (a network device or
circuit is an asset)

> ****
>
> ** **
>
> ** "U" items -- This list speaks to form factor rather than role.  If we'd
> pursue this course, I'd recommend a separate attribute.  Is there interest?
>
U is for *User Device*

> ****
>
> ** **
>
> ** "M" items -- There is currently no support for describing media since
> this is an additional level of detail for System/Node which is intended to
> describe a host.  Is there interest?
>
No. Media for me is a component of an asset

> ****
>
> ** **
>
> ** "P" items -- There is currently no support for classifying the users of
> the system.  To the WG, is there a desire to include this new information
> in @category or in some other place in the data model?  The closest thing
> to this idea is the proposal to add System/Node/Contact, which adds
> Contact@role to the system.****
>
> **
>
No. Actually System/Node define an IT-Asset, not a Person. having at least
Contact@role is good enough at this point

>  **
>
> Roman****
>
> ** **
>
> ** **
>
> *From:* Jerome Athias [mailto:[email-masked]]
> *Sent:* Thursday, August 01, 2013 1:46 AM
>
> *To:* Roman D. Danyliw
> *Cc:* [email-masked]
> *Subject:* Re: [mile] [Issue #7] Additional values for NodeRole@category**
> **
>
>  ** **
>
> Hi,****
>
> ** **
>
> my mistake since it was not included in the excel file, this is the Assets
> Variety coming from VERIS:****
>
> AssetVarietyName****
>
> S - Authentication****
>
> S - Backup****
>
> S - Database****
>
> S - DHCP****
>
> S - Directory****
>
> S - DCS****
>
> S - DNS****
>
> S - File****
>
> S - Log****
>
> S - Mail****
>
> S - Mainframe****
>
> S - Payment switch****
>
> S - POS controller****
>
> S - Print****
>
> S - Proxy****
>
> S - Remote access****
>
> S - SCADA****
>
> S - Web application****
>
> S - VM host****
>
> S - Other server****
>
> S - Other****
>
> N - Access reader****
>
> N - Camera****
>
> N - Firewall****
>
> N - HSM****
>
> N - IDS****
>
> N - Broadband****
>
> N - PBX****
>
> N - Private WAN****
>
> N - PLC****
>
> N - Public WAN****
>
> N - RTU****
>
> N - Router or switch****
>
> N - SAN****
>
> N - Telephone****
>
> N - VoIP adapter****
>
> N - LAN****
>
> N - WLAN****
>
> N - Other****
>
> U - Auth token****
>
> U - ATM****
>
> U - Desktop****
>
> U - PED pad****
>
> U - Gas terminal****
>
> U - Laptop****
>
> U - Media****
>
> U - Mobile phone****
>
> U - Peripheral****
>
> U - POS terminal****
>
> U - Kiosk****
>
> U - Tablet****
>
> U - Telephone****
>
> U - VoIP phone****
>
> U - Other****
>
> M - Tapes****
>
> M - Disk media****
>
> M - Documents****
>
> M - Flash drive****
>
> M - Disk drive****
>
> M - Smart card****
>
> M - Payment card****
>
> M - Other****
>
> P - System admin****
>
> P - Auditor****
>
> P - Call center****
>
> P - Cashier****
>
> P - Customer****
>
> P - Developer****
>
> P - End-user****
>
> P - Executive****
>
> P - Finance****
>
> P - Former employee****
>
> P - Guard****
>
> P - Helpdesk****
>
> P - Human resources****
>
> P - Maintenance****
>
> P - Manager****
>
> P - Partner****
>
> P - Other****
>
> ** **
>
> I hope it helps****
>
> Regards****
>
> ** **
>
> Jerome Athias****
>
> ** **
>
> 2013/8/1 Roman D. Danyliw <[email-masked]>****
>
> Hi Jerome!****
>
>  ****
>
> Thanks for the pointer.  Could you help us navigate to which subset of the
> vocabulary should be reviewed?  I was looking at the spreadsheet
> http://www.frhack.org/research/Information_Security_Vocabularies.xlsx for
> details.  Which tab best applies to NodeRole@category?****
>
>  ****
>
> Roman****
>
>  ****
>
> *From:* Jerome Athias [mailto:[email-masked]]
> *Sent:* Sunday, July 28, 2013 10:59 AM
> *To:* Roman D. Danyliw
> *Cc:* [email-masked]
> *Subject:* Re: [mile] [Issue #7] Additional values for NodeRole@category**
> **
>
>  ****
>
> Hi****
>
>  ****
>
> I would suggest to review/use the Common Vocabularies file available at***
> *
>
> http://www.frhack.org/research/xorcism.php****
>
>
>
> Le dimanche 28 juillet 2013, Roman D. Danyliw a écrit :****
>
> I would propose adding the following additional enumerated values to
> NodeRole@category to expand on the legitimate uses of a given system:
>
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile****
>
> ** **
>