Subject: Re: [mile] IODEF Guidance and existing implementations

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Tue, 2 Jul 2013 14:50:48 +0000

Thank you Kathleen.

> I would like to see us use the IODEF guidance document to work through use cases and document what gets shared with whom for various use cases, then demonstrated using RFC5070-bis.
I can keep the usecases and document them in the Guidance doc. But what is going to be different compared to the usecases in the bis doc? Will we just describe them using prose text and the bis document will have the actual XML?

Panos

From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Friday, June 28, 2013 11:32 AM
To: [email-masked]
Subject: [mile] IODEF Guidance and existing implementations

Hi Panos & Others,

Panos had asked about moving the examples from the IODEF Guidance to RFC5070-bis, was that the right thing to do?

I would like to see us use the IODEF guidance document to work through use cases and document what gets shared with whom for various use cases, then demonstrated using RFC5070-bis.  Implementations are increasing and I think this would be really helpful so that those implementations have guidance to implement the use cases relevant to their users.

We could start with documentation on some of the existing use cases that have been implemented, some in development, and then look to see how we can share effectively with new use cases.

The existing and active implementations I am aware of include:
o   APWG Anti-phishing - using IODEF
o   APWG eCrime - using IODEF
o   XMPP Operators using IODEF over XMPP for active exchanges
o   Blackthorn - Using IODEF + extensions for communications between several nations, with IODEF accessed on mobile platforms

Names may not be ready to be public:
o   energy sector organization using IODEF over XMPP
o   reports sent via IODEF for consumption from a sharing group

PoCs:
o  Multiple PoCs in play using IODEF + RID between several vendors in support of the MACCSA framework

Implementations:

  *   DFLabs - has the Digital Investigation Manager product using IODEF since at least 2007
  *   Arcsite supports imports of RFC5070 formatted IODEF reports, there may be other vendors?
  *   Blackthorn - product using IODEF + private extensions for active sharing
  *   Open Source RID Agent with RFC5070-bis support in java from EMC/RSA - on GitHub: https://github.com/RSAIntelShare/RID-Server
  *   Open source RID Agent implementation in Python from MITRE - I don't have the link, but it is compatible with the EMC/RSA one
  *   CSI Extension support for IODEF on Github from NICT in Java:
https://github.com/TakeshiTakahashi/IODEF-SCI/wiki/IODEF-SCI-tools

  *   eCRISP-X:  Suports eCrime use cases using IODEF RFC5070, from Pat Cain:
http://sourceforge.net/projects/ecrisp-x

  *   eCRISP-X: Phisihing report support - can't find the link, but know it exists for the APWG use case
  *   iodeflib: a python library to create, parse & edit IODEF:
http://www.decalage.info/python/iodeflib

  *   IODEF/RID - older versions (RFC6045, RFC6046 and RFC5070) in open source from Japan: http://www.ipa.go.jp/security/fy16/development/IODEF/api/index.html
  *   IODEF & RID implementation in Japanese from the Information technology Protection Agency (IPA):
http://www.cysols.com/research/iodef/IODEFApp.html

  *   CPAN IODEF perl module to create & parse IODEF:
http://search.cpan.org/~johng/XML-IODEF-0.06/

  *   Collective Intelligence Framework (CIF) from Ren-ISAC uses a modified version of IODEF for their active sharing platform
The CERT.org site that tracked this in the past has a few others listed and also says the following organizations have active projects using IODEF on their page http://www.cert.org/ietf/inch/inch.html :  CERT/CC: AirCERT, JPCERT/CC: Internet Scan Data Acquisition Systems (ISDAS), and eCSIRT.net: The European CSIRT Network

If I missed any, please add to the list.  It would be good to get these on a web page or wiki as a running list that can be amended as there is a lot of development/PoC activity right now.

For the IODEF Guidance, we can look at the use cases, determine what is successful and get the use cases documented.

Thank you,
Kathleen

---

From: Eric Burger <[email-masked]>
Date: Sun, 14 Jul 2013 17:58:21 -0400

On the one hand, it is nice to have everything in a single document. On the other hand, it is really hard to get big documents reviewed, revised, reviewed, revised, area reviewed, revised, IESG reviewed, revised, and IETF reviewed. A pair of smaller documents will be much easier to get done. Moreover, the use cases will expand over time (I hope), yet the protocol will not change that much (I hope). Thus, two documents may be easier to manage and ultimately get published.

On Jul 2, 2013, at 10:50 AM, Panos Kampanakis (pkampana) <[email-masked]> wrote:

> o   APWG Anti-phishing – using IODEF
> o   APWG eCrime – using IODEF
> o   Blackthorn – Using IODEF + extensions for communications between several nations, with IODEF accessed on mobile platforms
>  
> DFLabs – has the Digital Investigation Manager product using IODEF since at least 2007
> Arcsite supports imports of RFC5070 formatted IODEF reports, there may be other vendors?
> Blackthorn – product using IODEF + private extensions for active sharing
> Open Source RID Agent with RFC5070-bis support in java from EMC/RSA – on GitHub: https://github.com/RSAIntelShare/RID-Server
> Open source RID Agent implementation in Python from MITRE – I don’t have the link, but it is compatible with the EMC/RSA one
> CSI Extension support for IODEF on Github from NICT in Java:
> eCRISP-X:  Suports eCrime use cases using IODEF RFC5070, from Pat Cain:
> eCRISP-X: Phisihing report support – can’t find the link, but know it exists for the APWG use case
> iodeflib: a python library to create, parse & edit IODEF:
> IODEF/RID – older versions (RFC6045, RFC6046 and RFC5070) in open source from Japan: http://www.ipa.go.jp/security/fy16/development/IODEF/api/index.html
> IODEF & RID implementation in Japanese from the Information technology Protection Agency (IPA):
> CPAN IODEF perl module to create & parse IODEF:
> Collective Intelligence Framework (CIF) from Ren-ISAC uses a modified version of IODEF for their active sharing platform
> The CERT.org site that tracked this in the past has a few others listed and also says the following organizations have active projects using IODEF on their pagehttp://www.cert.org/ietf/inch/inch.html :  CERT/CC: AirCERT, JPCERT/CC: Internet Scan Data Acquisition Systems (ISDAS), and eCSIRT.net: The European CSIRT Network
>  
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Mon, 15 Jul 2013 11:29:15 +0000

Thank you Eric.

That is a good point. I removed the usecases chapter. We decided that to drive adoption it would be better to add a chapter that summarizes some common uses of IODEF today, without going into specifics.

It is here http://www.ietf.org/staging/draft-ietf-mile-iodef-guidance-01.txt I still haven't received the Autor authentication confirmation email (some issue there). Note the doc still needs a lot of work that is how it will be for initial discussion in Berlin.

Panos

From: [email-masked] [mailto:[email-masked]] On Behalf Of Eric Burger
Sent: Sunday, July 14, 2013 5:58 PM
To: [email-masked] IETF
Subject: Re: [mile] IODEF Guidance and existing implementations

On Jul 2, 2013, at 10:50 AM, Panos Kampanakis (pkampana) <[email-masked]<mailto:[email-masked]>> wrote:

Thank you Kathleen.

Panos

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Moriarty, Kathleen
Sent: Friday, June 28, 2013 11:32 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [mile] IODEF Guidance and existing implementations

Hi Panos & Others,

PoCs:

Implementations:

  *   Collective Intelligence Framework (CIF) from Ren-ISAC uses a modified version of IODEF for their active sharing platform
The CERT.org<http://CERT.org> site that tracked this in the past has a few others listed and also says the following organizations have active projects using IODEF on their pagehttp://www.cert.org/ietf/inch/inch.html :  CERT/CC: AirCERT, JPCERT/CC: Internet Scan Data Acquisition Systems (ISDAS), and eCSIRT.net<http://eCSIRT.net>: The European CSIRT Network

Thank you,
Kathleen

_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile