Subject: Re: [mile] MILE Kick-off message

From: Yuri Ryazantsev <[email-masked]>
Date: Sat, 4 Jun 2011 11:44:03 +0400

Hello, Kathleen!

I apologize for the delay in replying - been on vacation.

I would like to add to the list of proposed extensions:

"Misuse enumeration and classification. Extensions to the
IODEF-document class for reporting misuse".

Short description:
"he Extensions to the IODEF-Document Class for Reporting Misuse
Recommendation extends the Incident Object Description Exchange Format
(IODEF) defined in RFC 5070 to support the reporting of misuse
incidents.  These extensions are flexible enough to support
information gleaned from activities throughout the entire intrusion
detection cycle where authorized users of the systems attempt to gain
additional privileges for which they are not authorized, and
authorized users who misuse the privileges given them."

Thank you!
Yuri.

On Tue, May 31, 2011 at 19:17,  <[email-masked]> wrote:
> To follow up from the data sharing restrictions/markings discussion, a new IODEF extension should be added to the list for the purpose of charter discussions and additional guidance for RID will be needed.
>
> Here is what we have right now for the list of extensions:
> *       Mail abuse (from MARF WG) - would like the name of a volunteer
> *       Forensic data (Youn-Hee Gil and Dowon Hong)
> *       Virtualized environments (NIST Cloud WG participants: Matt Smith and Phil Cox)
> *       Malicious infrastructure - REN-ISAC?
> *       Actor profiles - REN-ISAC?
> *       Malicious code characteristics - REN-ISAC?
> *       Integrating SCAP Content (may be through one of the above)
> *       Financial transaction/fraud - review/change RFC5901
> *         Data sharing restrictions/markings (we can change and evolve the name)
>
> We do need more editors, so please volunteer if the areas are of interest.  Having multiple editors on a document is welcome.
>
> Can anyone volunteer to assist with an extension template and guidance document?
>
>
> We have also had requests for guidance on other use cases, so we may need to factor that in as well.  Yuri from the ITU-T has expressed interest in guidance for misuse.
>
> Thank you!
> Kathleen
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
> Sent: Thursday, May 19, 2011 4:46 PM
> To: [email-masked]
> Subject: [mile] MILE Kick-off message
>
> Hello!
>
> Thank you for joining the MILE mailing list!  We are looking forward to increased collaboration and progress in this space.  The message below begins with a summary from the mailing list welcome message and then leads into several topics for discussion to assist with charter and scope of work development.  We look forward to your feedback!
>
> Welcome Message/Initial Goals:
>
> The MILE pre-working group will initially be focused on the development of a charter and scope of work effort for standards and extensions to meet the needs of a global community interested in sharing, exchanging, and handling incidents.  Collaboration and sharing experiences with the data model or use of the IODEF (RFC5070), existing extensions for Anti-phishing (RFC5901), existing extension for Transaction Fraud (RFC5941), and RID (RFC6045, RFC6046) standards will improve any solutions created to enable collaboration for incident response and sharing.  This list is for charter and pre-WG technical discussion about MILE,  which intends to describe a subset of IODEF aimed at exchanging easily readable incident information focused on those things which people actually exchange.   Extensions needed by the IODEF and RID community to ensure current relevant use cases for the exchange of incident information may also be discussed.
>
> Questions for the List:
>
> The above welcome statement calls out specifically the goal of the list: "This list is for charter and pre-WG technical discussion about MILE,  which intends to describe a subset of IODEF aimed at exchanging easily readable incident information focused on those things which people actually exchange."
>
> *       Are there opinions or thoughts on what is needed by the WG to achieve this goal?
>
> We have had several volunteers come forward offering to initiate work on extensions to IODEF.  Having a template with guidance on what is required in an extension document would be a very useful start.  We are looking for volunteers to help create this template and guidance.
>
> *       What are your thoughts on a template (maybe based off of RFC5901) before we move into the creation/modification of any IODEF extensions?
>
> Here is the list of proposed extensions with some volunteer editors listed (more are welcome).  Is this the right list of extensions?
>
> *       Mail abuse (from MARF WG)
> *       Forensic data (Youn-Hee Gil and Dowon Hong)
> *       Virtualized environments (NIST Cloud WG participants: Matt Smith and Phil Cox)
> *       Malicious infrastructure - REN-ISAC?
> *       Actor profiles - REN-ISAC?
> *       Malicious code characteristics - REN-ISAC?
> *       Integrating SCAP Content (may be through one of the above)
> *       Financial transaction/fraud - review/change RFC5901
>
>
> Best regards,
> Kathleen, Brian, & Tom
>
>
>
>
>
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile
>
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile
>
>

-- 
Yuri Ryazantsev <[email-masked]>

---

From: <[email-masked]>
Date: Mon, 6 Jun 2011 08:57:38 -0400

Thank you, Gaus!

We can have multiple editors on drafts if others want to assist as an editor.  This document will require a lot of collaboration to determine an agreeable approach.  

We can look into holding a BoF at the July IETF.  If we do that, it may be good to get a review of a few different approaches to help solve this issue before drafts are written.  From the discussions to date, it seems it will be a mix of a guidance for IODEF and RID as well as an extension to IODEF.

Brian Trammell suggested also using Webex or some other method to enhance the remote experience as many of you have not attended an IETF yet and we would like to ensure you can participate if you can't attend.  Typically, there are jabber sessions running as well to help remote participants.

Best regards,
Kathleen

-----Original Message-----
From: Damir Rajnovic [mailto:[email-masked]] 
Sent: Monday, June 06, 2011 8:34 AM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [mile] MILE Kick-off message

Hi,

I can take on Data sharing restrictions/markings

Gaus

> *       Financial transaction/fraud - review/change RFC5901

==============
Damir Rajnovic <[email-masked]>, PSIRT Incident Manager, Cisco Systems
<http://www.cisco.com/go/psirt>      Telephone: +44 7715 546 033
200 Longwater Avenue, Green Park, Reading, Berkshire RG2 6GB, GB
==============
There are no insolvable problems. 
The question is can you accept the solution? 

http://www.ciscopress.com/bookstore/product.asp?isbn=1587052644

- - - -
Cisco.com - http://www.cisco.com/global/UK

This e-mail may contain confidential and privileged material for the sole 
use of the intended recipient. Any review, use, distribution or disclosure by 
others is strictly prohibited. If you are not the intended recipient (or 
authorized to receive for the recipient), please contact the sender by reply 
e-mail and delete all copies of this message.

Cisco Systems Limited (Company Number: 02558939), is registered in England 
and Wales with its registered office at 1 Callaghan Square, Cardiff, 
South Glamorgan CF10 5BT

For corporate legal information go to:
http://www.cisco.com/web/about/doing_business/legal/cri/index.html

---

From: Katherine S Goodier <[email-masked]>
Date: Mon, 6 Jun 2011 13:04:48 +0000 (GMT+00:00)

I will assist Gaus.

Dr. Katherine Goodier 

Senior Computer Programmer/System Engineer 
Stratis/L-3 Communications 
Center of Excellence Lab, 5th floor 
supporting Unified Cross Domain Management Office (UCDMO) 
Army Research Lab, Bldg 601, Room 110 
  
lab - 301-575-3759 
unclass - 240-373-1714 
class - 763-2477 
cell - 240-515-4791 

----- Original Message -----
From: "kathleen moriarty" <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Sent: Monday, June 6, 2011 8:57:38 AM
Subject: Re: [mile] MILE Kick-off message

Thank you, Gaus!

Best regards,
Kathleen

-----Original Message-----
From: Damir Rajnovic [mailto:[email-masked]] 
Sent: Monday, June 06, 2011 8:34 AM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [mile] MILE Kick-off message

Hi,

Gaus

==============

- - - -

---

From: <[email-masked]>
Date: Mon, 6 Jun 2011 09:11:01 -0400

Hello, Yuri!

I hope you had a nice vacation.  We are glad to have you participate and assist the effort with a document.  Some of this one may be guidance on the base specification and some may be extra values not represented in IODEF as you state below.  We have heard that guidance is needed to increase compatibility in the exchange of reports, your assistance here is appreciated.

Thank you,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Yuri Ryazantsev
Sent: Saturday, June 04, 2011 3:44 AM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [mile] MILE Kick-off message

Hello, Kathleen!

Short description:

Thank you!
Yuri.

---

From: Damir Rajnovic <[email-masked]>
Date: Mon, 6 Jun 2011 14:12:35 +0100

Hi Kathleen,

On Mon, Jun 06, 2011 at 08:57:38AM -0400, [email-masked] wrote:
> We can have multiple editors on drafts if others want to assist as an editor.  
> This document will require a lot of collaboration to determine an agreeable approach.  

And I will need all the help I can get :)  For the start I can not travel to
IETF meetings at all  and will depend very much on others to work with the people 
at the meeting. I can certainly arrange and lead virtual meetings.

So, if anyone else is willing to jump in I would certainly welcome that :)

Thanks,

Gaus

==============

- - - -

---

From: Damir Rajnovic <[email-masked]>
Date: Mon, 6 Jun 2011 13:33:30 +0100

Hi,

Gaus

==============

- - - -

---

From: <[email-masked]>
Date: Mon, 6 Jun 2011 10:00:01 -0400

Thank you!

Do we have any volunteers to work on/be an editor for a template/extension guideline document?  This would list out all of the sections that should be included in an extension document and provide guidance as to the content expected in each of the sections.  It would be nice to produce consistent extensions that will make it easier for editors of extensions as well as developers using the extension documents.

We will need this one sooner rather than later and the existing extensions can be used as a reference (RFC5901).

Best regards,
Kathleen

-----Original Message-----
From: Damir Rajnovic [mailto:[email-masked]] 
Sent: Monday, June 06, 2011 9:13 AM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [mile] MILE Kick-off message

Hi Kathleen,

Thanks,

Gaus

==============

- - - -

---

From: <[email-masked]>
Date: Mon, 6 Jun 2011 11:31:00 -0400

Thank you, Katherine!

-Kathleen

-----Original Message-----
From: Katherine S Goodier [mailto:[email-masked]] 
Sent: Monday, June 06, 2011 9:05 AM
To: Moriarty, Kathleen
Cc: [email-masked]; [email-masked]
Subject: Re: [mile] MILE Kick-off message

I will assist Gaus.

Dr. Katherine Goodier 

lab - 301-575-3759 
unclass - 240-373-1714 
class - 763-2477 
cell - 240-515-4791 

----- Original Message -----
From: "kathleen moriarty" <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Sent: Monday, June 6, 2011 8:57:38 AM
Subject: Re: [mile] MILE Kick-off message

Thank you, Gaus!

Best regards,
Kathleen

-----Original Message-----
From: Damir Rajnovic [mailto:[email-masked]] 
Sent: Monday, June 06, 2011 8:34 AM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [mile] MILE Kick-off message

Hi,

Gaus

==============

- - - -