Subject: [mile] Feedback on draft-banghart-mile-rolie-csirt-02

From: Roman Danyliw <[email-masked]>
Date: Mon, 20 Nov 2017 16:23:19 +0000

Hi Stephen and John!

>From my reading of draft-banghart-mile-rolie-csirt-02, I have the following feedback:

(1) Section 3, Additional Requirements for the Atom Publishing Protocol

** Cite RFC5023 as the reference for Atom Publishing Protocol.

(2) Section 4,
** Cite RFC4287 as the reference for Atom Syndication Format.

(3) Section 3.1.2, User Authorization

** In the first sentence, I'd recommend replacing s/When the content model .../When the content for the Atom <content> element contains an <IODEF-Document>/ for readability.
** Also the first sentence states  "... the authorization MUST be adjudicated ... per Section 8.1.1".  What specific section in 8.1.1 is being referenced?  Is it @restriction?  Is it also worth noting that this adjudication will be done is outside the scope of the document -- some sites might treat @restriction="need-to-know" differently?
** <IODEF-Document> is mentioned but without citation.

(4) Section 4, Additonal Requirements for the Atom Syndication Format
** s/Additonal/Additional/ (typo in the Section title)

(5) Section 4.1, Additional Requirements for the atom:feed element
** s/Additonal/Additional/ (typo in the Section title)
** The first sentence states "A feed containing IODEF incident content MUST contain at least two additional <atom:category> elements."  What does it mean to contain "IODEF incident content"?  Is "IODEF incident content" an instance of an <IODEF-Document> whose includes at least one <Incident>?

(6) Section 4.2, Additonal Requirements for the atom:entry element
** s/Additonal/Additional/ (typo in the Section title)
** The first sentence states "An entry containing an IODEF payload."  What does it mean to contain an "IODEF payload"?  Is it an instance of <IODEF-Document>?

(7) Section 4.3.1, The IODEF Document

** s/<relatedActivity>/<RelatedActivity>/
** s/<history>/<History>/

(8) Section 5.1, "incident" information type

** The fifth bullet uses the language "effect and result information", it might be clearer to refer to it as the "incident impact"

(9) Section 5.3.1, IODEF Format

** Cite IODEF with an informative reference
** The last paragraph states that "The use of the IODEF format imposes additional requirements on the server."  Where are those requirement documented?

(10) Section 5.3.2, STIX Format

** Cite STIX with an informative reference

(11) Section 6.1, urn:ietf:params:rolie:property:csirt:ID

** The first sentence states that csirt:ID "provides an exposure point for an identifier ...".  What is an "exposure point"?  Is that a unique reference?
** Also, the first sentence states "... identifier from the indicator or incident document".  What is an "indicator" or "incident document" in this content?

(12) Section 8.1.1, Newly registered category values
** The second sentence notes that "This IODEF content exposure provides ..."  What is meant by "content exposure"?
** The second and third paragraphs make references to Section 3.2 of IODEF.  Which IODEF -- RFC 5070 or 7970?
** I'd recommend removing the attribute value examples (i.e., "e.g, public, need-to-know, private, default", "e.g. traceback, mitigation, reporting, or other") as these may change with the extension values in the IANA registry (assuming RFC7970 is the version of IODEF in question).

(13) Section 10, Security Considerations

** The first sentence states that this document is about "us[ing] ROLIE in high-security use cases".  I'm not sure what "high security" means in this context.
** In the same sentence, it says that "added care should be taken to fortify and secure ROLIE" -- like what? 
** Per the second sentence, I recommend:
s/The guidance in the ROILE core specification ... is strongly recommended/The security and privacy considerations of the ROILE core specification [I-D.ietf-mile-roile] are applicable./
** In the same sentence, it says that "implementers should consider adding additional security measures as they see fit" -- like what?
** The first sentence of the second paragraph references "closed sharing".  I'm not sure what that means.

Regards,
Roman