Subject: [mile] Last Call: <draft-ietf-mile-rfc6045-bis-05.txt> (Real-time Inter-network Defense (RID)) to Proposed Standard

From: The IESG <[email-masked]>
Date: Mon, 02 Jan 2012 09:52:18 -0800

The IESG has received a request from the Managed Incident Lightweight
Exchange WG (mile) to consider the following document:
- 'Real-time Inter-network Defense (RID)'
  <draft-ietf-mile-rfc6045-bis-05.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2012-01-16. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract

   Security incidents, such as system compromises, worms, viruses,
   phishing incidents, and denial of service, typically result in the
   loss of service, data, and resources both human and system.  Service
   providers and Computer Security Incident Response Teams need to be
   equipped and ready to assist in communicating and tracing security
   incidents with tools and procedures in place before the occurrence of
   an attack.  Real-time Inter-network Defense (RID) outlines a
   proactive inter-network communication method to facilitate sharing
   incident handling data while integrating existing detection, tracing,
   source identification, and mitigation mechanisms for a complete
   incident handling solution.  Combining these capabilities in a
   communication system provides a way to achieve higher security levels
   on networks.  Policy guidelines for handling incidents are
   recommended and can be agreed upon by a consortium using the security
   recommendations and considerations.

The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-mile-rfc6045-bis/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-mile-rfc6045-bis/

No IPR declarations have been submitted directly on this I-D.

---

From: <[email-masked]>
Date: Fri, 6 Jan 2012 12:49:53 -0500

Hi Kathleen,

Nice work on getting the new version of the rfc6045-bis (RID) draft out, and likewise to Brian for the new version of the rfc6046-bis (RID transport) draft.

I found a couple of IANA-related concerns in the new material on RID enveloping of XML content beyond IODEF:

(1) The IANA considerations text (under "Request for managing a namespace list:") doesn't indicate what IANA needs to do.

(2) The Version attribute of the ReportSchema class that envelopes the XML content is required to be 1.0; that may not be appropriate for content other than IODEF, or even future revisions of IODEF.  RFCs are long-term archival documents, so it's usually better for an RFC to specify something that's not likely to need change in the near future.

Creating an IANA registry for the standard specifications/namespaces and versions that RID can envelope would be a good way to deal with both of these concerns.

It'd suffice for the initial contents of the registry to consist of a single entry for IODEF, even though IODEF's the default, as creation of the registry should set up a lightweight process for registering future specifications (Expert Review + Specification Required), but there's no harm in adding more specifications now.

Does anyone have suggestions for specifications beyond IODEF that ought to be included now (for RID to envelope)?

Thanks,
--David

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of The IESG
> Sent: Monday, January 02, 2012 12:52 PM
> To: IETF-Announce
> Cc: [email-masked]
> Subject: [mile] Last Call: <draft-ietf-mile-rfc6045-bis-05.txt> (Real-time Inter-network Defense
> (RID)) to Proposed Standard
> 
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: <[email-masked]>
Date: Tue, 10 Jan 2012 19:16:47 -0500

Hello David,

Thank you for your review and comments.

I will fix the version attribute, it was just listed the accepted version for IODEF, but flexibility would help even if it were only for future IODEF versions without having to add values to the enumeration list.

I think it would be good to start with a different specification to demonstrate the capability and provide a clear example of how this would be done for another schema.  

Are there suggestions from others on the list as to which schema should be used for this?

Thank you,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, January 06, 2012 12:50 PM
To: [email-masked]
Subject: Re: [mile] Last Call: <draft-ietf-mile-rfc6045-bis-05.txt> (Real-time Inter-network Defense (RID)) to Proposed Standard

Hi Kathleen,

Thanks,
--David

---

From: "Struse, Richard" <[email-masked]>
Date: Tue, 10 Jan 2012 20:13:31 -0500

I'd suggest CVRF. 

----- Original Message -----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, January 10, 2012 07:16 PM
To: [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Subject: Re: [mile] LastCall:	<draft-ietf-mile-rfc6045-bis-05.txt>	(Real-timeInter-network	Defense (RID)) to Proposed Standard

Hello David,

Thank you,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, January 06, 2012 12:50 PM
To: [email-masked]
Subject: Re: [mile] Last Call: <draft-ietf-mile-rfc6045-bis-05.txt> (Real-time Inter-network Defense (RID)) to Proposed Standard

Hi Kathleen,

Thanks,
--David