Subject: [sacm] New draft for review and comment: draft-field-mile-rolie-00.txt

From: "Field, John" <[email-masked]>
Date: Thu, 6 Sep 2012 11:10:52 -0400

All,

Cross posting this announcement from MILE to SACM, as I think this may be of interest within the SCAP community as well.  

The new draft referenced below describes a RESTful HTTP binding for sharing incident, indicator, and other cyber security-related information.  In particular, the draft includes a suggested approach to retrieving a related benchmark resource.  

I hope you'll find this draft to be of interest.  

Please post any questions or comments to the MILE list.

Regards,
John

// John P. Field 
// Security Architect 
// EMC Office of the CTO 

-----Original Message-----
From: Field, John 
Sent: Thursday, September 06, 2012 10:53 AM
To: <[email-masked]>
Subject: New draft for review and comment: draft-field-mile-rolie-00.txt

All,

Please note that I have just posted a new draft for review and comment.  As stated in the abstract, the draft describes a RESTful HTTP binding for sharing incident, indicator, and other cyber security-related information.  I hope you'll find this document to be of interest, and I look forward to discussing any questions and/or comments that the group may have.

Regards,
John

// John P. Field 
// Security Architect 
// EMC Office of the CTO 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, September 05, 2012 9:59 PM
To: Field, John
Subject: New Version Notification for draft-field-mile-rolie-00.txt

A new version of I-D, draft-field-mile-rolie-00.txt
has been successfully submitted by John P. Field and posted to the
IETF repository.

Filename:	 draft-field-mile-rolie
Revision:	 00
Title:		 Resource-Oriented Lightweight Indicator Exchange
Creation date:	 2012-09-05
WG ID:		 Individual Submission
Number of pages: 41
URL:             http://www.ietf.org/internet-drafts/draft-field-mile-rolie-00.txt
Status:          http://datatracker.ietf.org/doc/draft-field-mile-rolie
Htmlized:        http://tools.ietf.org/html/draft-field-mile-rolie-00

Abstract:
   This document defines a resource-oriented approach to cyber security
   information sharing.  Using this approach, a CSIRT or other
   stakeholder may share and exchange representations of cyber security
   incidents, indicators, and other related information as Web-
   addressable resources.  The transport protocol binding is specified
   as HTTP(S) with a MIME media type of Atom+XML.  An appropriate set of
   link relation types specific to cyber security information sharing is
   defined.  The resource representations leverage the existing IODEF
   [RFC5070] and RID [RFC6545] specifications as appropriate.
   Coexistence with deployments that conform to existing specifications
   including RID [RFC6545] and Transport of Real-time Inter-network
   Defense (RID) Messages over HTTP/TLS [RFC6546] is supported via
   appropriate use of HTTP status codes.

The IETF Secretariat

---

From: Luis Nunez <[email-masked]>
Date: Thu, 6 Sep 2012 11:36:25 -0400

John,
this definitely is of interest and could be related to past discussions around content repositories.  

I know of two publicly accessible (REST) repositories that could potential host this type of content.

http://scaprepo.com/SCAPRepoWebService
http://scapsync.com/api/

NIST is also working on a repository with webservices.

It would be interesting to prototype a sample document and flesh out issues.

-ln

On Sep 6, 2012, at 11:10 AM, Field, John wrote:

> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm