Subject: [mile] I-D Action: draft-ietf-mile-rfc6045-bis-06.txt

From: [email-masked]
Date: Mon, 16 Jan 2012 19:46:04 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Managed Incident Lightweight Exchange Working Group of the IETF.

	Title           : Real-time Inter-network Defense (RID)
	Author(s)       : Kathleen M. Moriarty
	Filename        : draft-ietf-mile-rfc6045-bis-06.txt
	Pages           : 80
	Date            : 2012-01-16

   Security incidents, such as system compromises, worms, viruses,
   phishing incidents, and denial of service, typically result in the
   loss of service, data, and resources both human and system.  Service
   providers and Computer Security Incident Response Teams need to be
   equipped and ready to assist in communicating and tracing security
   incidents with tools and procedures in place before the occurrence of
   an attack.  Real-time Inter-network Defense (RID) outlines a
   proactive inter-network communication method to facilitate sharing
   incident handling data while integrating existing detection, tracing,
   source identification, and mitigation mechanisms for a complete
   incident handling solution.  Combining these capabilities in a
   communication system provides a way to achieve higher security levels
   on networks.  Policy guidelines for handling incidents are
   recommended and can be agreed upon by a consortium using the security
   recommendations and considerations.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-mile-rfc6045-bis-06.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-mile-rfc6045-bis-06.txt

---

From: <[email-masked]>
Date: Mon, 16 Jan 2012 22:49:50 -0500

Thank you for the reviews and comments during last call!  The updated version of RID addresses all comments received during the last call period and are as follows:

Updates the schema:
    Adds two Justification enumerations
    Adds language support with lang attribute at the top level
    Removes attributes that were listed in the UML description, but not 
implemented in the schema
    URL definition fixed in schema

Adds more references for XML digital signature and encryption guidance to 
increase interoperability between implementations.

Replaces the Traceback example, fixing the problem with the detached signature 
from the limit of a tool

Removes the term network provider to use the more generic service provider 
everywhere in the document as it still appeared in a few places.

Combines the definition of TraceRequest and Investigation into one definition for 
'Request' with the ability to still select either 'TraceRequest' or 
InvestigationRequest' as the MsgType for parsing and handling purposes.

Changes IncidentQuery name to the more generic 'Query'

Changes the name RequestAuthorization to Acknowledgement as it more 
appropriately fits the purpose of this message.

The ability to respond to any message type with an Acknowledgement message 
was nested deeply in the communication flow section.  The text has been adjusted 
to make sure this ability is clear and information is not conflicting throughout the 
document.

The possible responses for messages are now succinctly described.

It is now explicitly stated that a stream of Report messages are possible during an 
investigation.  Since Report messages can be pushed asynchronously, this was 
possible, but not stated.

IANA text and supporting information to send other XML documents over RID was 
added, using CVRF as the example and first entry in the IANA registry.  This ability 
supports the application area review looking for extensibility and a request to the 
mailing list for this functionality.

Fixed 'updates RFC6045' text according to AD guidance.

Added in explicit text to state the use of shared keys is acceptable per the security 
review recommendation.

removed option for nesting enveloped signatures as the guidance on it is only at a 
high level and may result in incompatibility issues.

Thank you!
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Monday, January 16, 2012 10:46 PM
To: [email-masked]
Cc: [email-masked]
Subject: [mile] I-D Action: draft-ietf-mile-rfc6045-bis-06.txt

_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile