Subject: [mile] IODEF Guidance and existing implementations

From: "Moriarty, Kathleen" <[email-masked]>
Date: Fri, 28 Jun 2013 11:31:50 -0400

Hi Panos & Others,

Panos had asked about moving the examples from the IODEF Guidance to RFC5070-bis, was that the right thing to do?

I would like to see us use the IODEF guidance document to work through use cases and document what gets shared with whom for various use cases, then demonstrated using RFC5070-bis.  Implementations are increasing and I think this would be really helpful so that those implementations have guidance to implement the use cases relevant to their users.

We could start with documentation on some of the existing use cases that have been implemented, some in development, and then look to see how we can share effectively with new use cases.

The existing and active implementations I am aware of include:
o   APWG Anti-phishing - using IODEF
o   APWG eCrime - using IODEF
o   XMPP Operators using IODEF over XMPP for active exchanges
o   Blackthorn - Using IODEF + extensions for communications between several nations, with IODEF accessed on mobile platforms

Names may not be ready to be public:
o   energy sector organization using IODEF over XMPP
o   reports sent via IODEF for consumption from a sharing group

PoCs:
o  Multiple PoCs in play using IODEF + RID between several vendors in support of the MACCSA framework

Implementations:
*       DFLabs - has the Digital Investigation Manager product using IODEF since at least 2007
*       Arcsite supports imports of RFC5070 formatted IODEF reports, there may be other vendors?
*       Blackthorn - product using IODEF + private extensions for active sharing
*       Open Source RID Agent with RFC5070-bis support in java from EMC/RSA - on GitHub: https://github.com/RSAIntelShare/RID-Server
*       Open source RID Agent implementation in Python from MITRE - I don't have the link, but it is compatible with the EMC/RSA one
*       CSI Extension support for IODEF on Github from NICT in Java:
https://github.com/TakeshiTakahashi/IODEF-SCI/wiki/IODEF-SCI-tools
*       eCRISP-X:  Suports eCrime use cases using IODEF RFC5070, from Pat Cain:
http://sourceforge.net/projects/ecrisp-x
*       eCRISP-X: Phisihing report support - can't find the link, but know it exists for the APWG use case
*       iodeflib: a python library to create, parse & edit IODEF:
http://www.decalage.info/python/iodeflib
*       IODEF/RID - older versions (RFC6045, RFC6046 and RFC5070) in open source from Japan: http://www.ipa.go.jp/security/fy16/development/IODEF/api/index.html
*       IODEF & RID implementation in Japanese from the Information technology Protection Agency (IPA):
http://www.cysols.com/research/iodef/IODEFApp.html
*       CPAN IODEF perl module to create & parse IODEF:
http://search.cpan.org/~johng/XML-IODEF-0.06/
*       Collective Intelligence Framework (CIF) from Ren-ISAC uses a modified version of IODEF for their active sharing platform
The CERT.org site that tracked this in the past has a few others listed and also says the following organizations have active projects using IODEF on their page http://www.cert.org/ietf/inch/inch.html :  CERT/CC: AirCERT, JPCERT/CC: Internet Scan Data Acquisition Systems (ISDAS), and eCSIRT.net: The European CSIRT Network

If I missed any, please add to the list.  It would be good to get these on a web page or wiki as a running list that can be amended as there is a lot of development/PoC activity right now.

For the IODEF Guidance, we can look at the use cases, determine what is successful and get the use cases documented.

Thank you,
Kathleen