Subject: [mile] MILE Charter and Milestones

From: <[email-masked]>
Date: Thu, 8 Sep 2011 12:49:27 -0400

Hello,

Thank you for your participation in this pre-working group effort.  The working proposed charter is attached below for comment and review.  Initial milestones have been proposed for our first set of work items and agreed to by editors.  A few of the draft documents have not been posted yet, but are expected to have at least an initial draft prior to the submission deadline for the November meeting (10/24/11).  We can expand the charter to include more documents as we progress other work in the future.  If there are additional documents in which the editors have plans to publish a draft prior to November, please let us know as soon as possible so we can amend the list as appropriate.

Many thanks, and best regards,

Brian and Kathleen

Managed Incident Lightweight Exchange (mile)
--------------------------------------------

Proposed Working Group Charter

Chairs:
    Kathleen Moriarty <[email-masked]<mailto:[email-masked]>>
    Brian Trammell <[email-masked]<mailto:[email-masked]>>

Security Area Directors:
    Stephen Farrell <[email-masked]<mailto:[email-masked]<mailto:[email-masked]<mailto:[email-masked]>>>
    Sean Turner <[email-masked]<mailto:[email-masked]<mailto:[email-masked]<mailto:[email-masked]>>>

Security Area Advisor:
    Sean Turner <[email-masked]<mailto:[email-masked]>>

Mailing Lists:
    General Discussion: [email-masked]<mailto:[email-masked]>
    To Subscribe:       http://www.ietf.org/mailman/listinfo/mile
    Archive:            http://www.ietf.org/mail-archive/web/mile

Description:

The Managed Incident Lightweight Exchange (MILE) pre-working group will develop standards and extensions for the purpose of improving incident information sharing and handling capabilities based on the work developed in the IETF Extended INCident Handling (INCH) working group.  The Incident Object Description Exchange Format (IODEF) in RFC5070 and Real-time Inter-network Defense (RID) in RFC6045 were developed in the INCH working group by international Computer Security Incident Response Teams (CSIRTs) and industry to meet the needs of a global community interested in sharing, handling, and exchanging incident information.  The extensions and guidance created by the MILE working group assists with the daily operations of CSIRTs at an organization, service provider, law enforcement, and at the country level.  The application of IODEF and RID to interdomain incident information cooperative exchange and sharing has recently expanded and the need for extensions has become more important. Efforts continue to deploy IODEF and RID, as well as to extend them to support specific use cases covering reporting and mitigation of current threats such as anti-phishing extensions.

An incident could be a benign configuration issue, IT incident, an infraction to a service level agreement (SLA), a system compromise, socially engineered phishing attack, or a denial-of-service (DoS) attack, etc..  When an incident is detected, the response may include simply filing a report, notification to the source of the incident, a request to a third party for resolution/mitigation, or a request to locate the source.  IODEF defines a data representation that provides a standard format for sharing information commonly exchanged about computer security incidents.  RID enables the secure exchange of incident related information in an IODEF format providing options for security, privacy, and policy setting.

MILE leverages collaboration and sharing experiences with the work developed in the INCH working group which includes the data model detailed in the IODEF, existing extensions to the IODEF for Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure exchange of information.  MILE will also leverage the experience gained in using IODEF and RID in operational contexts. Related work, drafted outside of INCH will also be reviewed and includes RFC5941, Sharing Transaction Fraud Data.

The MILE working group provides coordination for these various extension efforts to improve the capabilities for exchanging incident information.  MILE has several objectives with the first being a description a subset of IODEF focused on ease of deployment and applicability to current information security data sharing use cases.  MILE also describes a generalization of RID for secure exchange of other security-relevant XML formats.  MILE produces additional guidance needed for the successful exchange of incident information for new use cases according to policy, security, and privacy requirements.  Finally, MILE produces a document template with guidance for defining IODEF extensions to be followed when producing extensions to IODEF as appropriate, for:

 * labeling incident reports with data protection, data retention, and other policies, regulations, and
   laws restricting the handling of those reports
 * referencing SCAP enumerations from within incident reports

The initial milestones for MILE include the following documents:
 * Template for extensions to IODEF: draft-trammell-mile-template-01.txt
   Working group last call: December 2011
 * Expert Review for IODEF Extensions in IANA XML Registry: draft-trammell-mile-iodef-xmlreg-00.txt
   Working group last call: December 2011
 * IODEF-extension to support structured cybersecurity information: draft-takahashi-mile-sci-00.txt
   Achieve consensus on approach: March 2012
 * Labeling for data protection, retention, policies, and regulations: draft-goodier-mile-data-markers-00.txt
   Achieve consensus on approach: March 2012
 * GRC Report Exchange (Generalized RID for XML reports/documents): draft-moriarty-mile-grc-exchange-00.txt
   Achieve consensus on approach for LI-XML and GRC-XML reports: May 2012
 * IODEF Guidance: draft-millar-mile-iodef-guidance-00.txt
   Achieve consensus on approach: March 2012
 * Forensics extension: draft expected to be submitted prior to submission deadline for November meeting
   Achieve consensus on approach: July 2012

__________________________________________________________________________________
Associated documents that may move forward before wG (comments needed by October):

Real-time Inter-network Defense (RID)
http://tools.ietf.org/html/draft-moriarty-mile-rfc6045-bis-01

Transport of Real-time Inter-network Defense (RID) Messages
http://tools.ietf.org/id/draft-trammell-mile-rfc6046-bis-00.txt

Documents to be added later:
 * reporting on mail service abuse incidents
 * reporting forensic data generated during incident investigation
 * reporting indicators of compromise in incident reports
 * reporting on financial fraud incidents
 * reporting incidents involving virtualized environments
 * profiling and reporting on characteristics of actors (persons or groups) suspected or confirmed to be
   involved in an incident
 * reporting on misuse incidents

May be covered in SCAP extension already:
 * profiling and reporting on characteristics of malware suspected or confirmed to be involved in an incident

---

From: "Martin, Robert A." <[email-masked]>
Date: Thu, 8 Sep 2011 13:39:00 -0400

Kathleen,

I think it be more understandable to change the two references to SCAP 
in the charter and milestones noted below to:

"referencing structured security information from within incident
reports"   and

"May be covered in structured security information
extension already:"

Plus, if we are constraining ourselves to SCAP then we can only include
CVE, CPE, CCE, OVAL, XCCDF, CVSS, and OCIL.

CWE, CAPEC, MAEC, CWSS, CEE, and CybOX would be off the table.

Bob

On 9/8/11 12:49 PM, [email-masked] wrote:

 > referencing SCAP enumerations from within incident reports

---

From: <[email-masked]>
Date: Thu, 8 Sep 2011 14:31:39 -0400

Hello,

Thank you for your comments Bob.  The updated charter is included below.  The items that were below the line are not in the charter (may be added later), so they are not listed in this revision to avoid confusion.

Please post any other comments or feedback to the list on the charter.

Thank you,
Kathleen & Brian

Chairs:

Security Area Directors:

Security Area Advisor:

Mailing Lists:

Description:

 * labeling incident reports with data protection, data retention, and other policies, regulations, and
   laws restricting the handling of those reports
 * referencing structured security information from within incident reports
 * reporting forensic data generated during an incident investigation (computer or accounting)

The initial milestones for MILE include the following documents:
 * Template for extensions to IODEF: draft-trammell-mile-template-01.txt
   Working group last call: December 2011
 * Expert Review for IODEF Extensions in IANA XML Registry: draft-trammell-mile-iodef-xmlreg-00.txt
   Working group last call: December 2011
 * IODEF-extension to support structured cybersecurity information: draft-takahashi-mile-sci-00.txt
   Working group last call: March 2012
 * Labeling for data protection, retention, policies, and regulations: draft-goodier-mile-data-markers-00.txt
   Working group last call: March 2012
 * GRC Report Exchange (Generalized RID for XML reports/documents): draft-moriarty-mile-grc-exchange-00.txt
   Working group last call for LI-XML and GRC-XML reports: May 2012
 * IODEF Guidance: draft-millar-mile-iodef-guidance-00.txt
   Working Group last call: March 2012
 * Forensics extension: draft expected to be submitted prior to submission deadline for November meeting
   Working group last call: July 2012

-----Original Message-----
From: Martin, Robert A. [mailto:[email-masked]] 
Sent: Thursday, September 08, 2011 1:39 PM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [mile] MILE Charter and Milestones

Kathleen,

Bob