Subject: [mile] Structured cyber security information extension

From: <[email-masked]>
Date: Wed, 21 Dec 2011 23:33:44 -0500

Hello Take,

Thank you for posting the updated draft.

I was looking through the SCI draft and noticed that EM_XML is defined in the UML definition section, but is not used in the defined schema extension (xsd).  It looks like the dtype=xml from IODEF sufficiently defines the datatype within the schema, so the EM_XML may not be necessary.  Is there a reason why we need to define EM_XML?  Or can the UML representation leverage the iodef dtype="xml" definition for including an XML schema?

Also, I see the use of Record in the SCI extension, is this intended to be the same Record as is defined in IODEF as it appears to be a separate definition?  If it is the same, that is fine.  If it is a separate definition, could we use another term as not to confuse the two?  It looks like the XML schema included is directly in the iodef-sci:Record which is embedded in the Record class from IODEF through RecordItem.

Thank you,
Kathleen

Kathleen M. Moriarty, CISSP | GRC Strategy | Office of the CTO | 617-851-5807 | [email-masked]  | EMC Corporation

---

From: "Takeshi Takahashi" <[email-masked]>
Date: Thu, 22 Dec 2011 13:52:14 +0900

Hello Kathleen,

Thank you for the kind email.

Regarding the EM_XML issue, thank you for the information.
I first thought I cannot use the "xml" value (prepared for dtype) to define
the type of "Record" element.
It seems to be that we can use the "xml" value as the datatype of the
"Record" element.
Thank you for letting me know about that.
I will get rid of the EM_XML declaration from the draft.

Regarding the Record class, I agree.
Thank you for pointing it out here.
Let me change the name into "RawData" to distinguish the Record class of the
IODEF.

I appreciate these kind comments.

Thank you.
Take

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> [email-masked]
> Sent: Thursday, December 22, 2011 1:34 PM
> To: [email-masked]
> Subject: [mile] Structured cyber security information extension
> 
> Hello Take,
> 
> I was looking through the SCI draft and noticed that EM_XML is defined
> in the UML definition section, but is not used in the defined schema
> extension (xsd).  It looks like the dtype=xml from IODEF sufficiently
> defines the datatype within the schema, so the EM_XML may not be
necessary.
> Is there a reason why we need to define EM_XML?  Or can the UML
> representation leverage the iodef dtype="xml" definition for including
> an XML schema?
> 
> Also, I see the use of Record in the SCI extension, is this intended to
> be the same Record as is defined in IODEF as it appears to be a separate
> definition?  If it is the same, that is fine.  If it is a separate
> definition, could we use another term as not to confuse the two?  It looks
> like the XML schema included is directly in the iodef-sci:Record which
> is embedded in the Record class from IODEF through RecordItem.
> 
> Thank you,
> Kathleen
> 
> Kathleen M. Moriarty, CISSP | GRC Strategy | Office of the CTO |
> 617-851-5807 | [email-masked]  | EMC Corporation
> 
> 
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: <[email-masked]>
Date: Wed, 21 Dec 2011 23:54:15 -0500

Thank you, Take!

-----Original Message-----
From: Takeshi Takahashi [mailto:[email-masked]] 
Sent: Wednesday, December 21, 2011 11:52 PM
To: Moriarty, Kathleen; [email-masked]
Subject: RE: [mile] Structured cyber security information extension

Hello Kathleen,

Thank you.
Take

necessary.

---

From: <[email-masked]>
Date: Thu, 22 Dec 2011 09:39:03 -0500

Hi Take and Kathleen,

This is a good discussion, but there's a subtle distinction between the two
approaches for embedding XML content defined by another specification (e.g., CPE):

1) The IODEF dtype=xml allows embedding of XML content from a second XML document
(e.g., a CPE document) into an IODEF XML document using the namespace from the schema
for the second document (e.g. embed CPE content using the XML namespace for CPE), but
the only XML document is the IODEF document.

2) The EM_XML type in the -00 SCI draft embeds the entire second XML document,
including the XML header.

If all the systems involved are based on IODEF and expect IODEF documents, the
dtype=xml approach is simpler, but there could be systems that want to generate or
consume an XML document defined by another specification (e.g., an XML document
for CPE).

I think the question here is for implementers - which of these options makes more sense:
- Strip the XML header from the second XML document and embed just its content
	(preserving the namespace) so that the IODEF document parses as a single IODEF
	document.
- Preserve the entire second XML document so that it can be extracted and treated
	as an XML document without change, but at the cost of complicating the parse
	of the IODEF document because there's a complete second XML document embedded.
??

Something to consider is whether it's ok for the encoding to be different between
the IODEF document and the embedded XML (e.g., CPE).  If not, dtype=XML is probably
better because it forces use of the IODEF document's XML encoding for all of the
embedded content (if any of the XML content to be embedded was generated with a
different encoding, it has to be converted to the encoding used for the IODEF
document before being embedded).

Thanks,
--David

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Takeshi Takahashi
> Subject: Re: [mile] Structured cyber security information extension
> 
> Hello Kathleen,
>

---

From: <[email-masked]>
Date: Thu, 22 Dec 2011 11:02:55 -0500

David & MILE participants,

Could others on the list chime in to provide opinions on how to handle the discrepancy between the UML and schema definition?  Take was aware of this and had been thinking about it already, opinions would be helpful from the list.  

The UML definition includes the use of EM_XML and a definition for this purpose, which is fine, but it is not used in the actual defined schema.  The defined schema uses the dtype="xml" from RecordItem and AdditionalData appropriately, but then  1) the schema for the iodef-sci:Record is set to xs:anyType, not XML right now or using the UML defined EM_XML.  Xsd:anyType is not defined in iodef-sci or iodef (not mentioned in the UML descriptions) and a mapping would be needed if this were to be used as the solution to ensure compatibility in implementations.

2)  It would be good to hear from others on the list as to how they would like to see this handled, which will help guide how to consistently represent the inclusion of other XML documents.

The co-editors are discussing how they want to approach the issue and will post again once they have thought about how they would like to handle this.  Input from others may help.

Thank you,
Kathleen

-----Original Message-----
From: Black, David 
Sent: Thursday, December 22, 2011 9:39 AM
To: Takeshi Takahashi; Moriarty, Kathleen; [email-masked]
Subject: RE: [mile] Structured cyber security information extension

Hi Take and Kathleen,

Thanks,
--David