Subject: RE: Draft NIST document

From: "Osterwald, Paul" <[email-masked]>
Date: Fri, 23 Feb 2001 16:32:01 -0600

John:

Been playing catchup so I've been out of the loop for a while.  I got a copy
dropped on my desk.  As you said it appears to be a good base document.  My
thought would be that we should send comments/suggesstion particualrly with
respect to the IDWG work towards standardization.  I think that we might
present the best "face" as it were if we pooled comments and then Mike and
Stuart forwarded our consolidated comments on to NIST as a representation of
an interested group of SME's.

Thoughts anyone?

> Paul Osterwald
> Sr. Security Engineer
> Intrusion.com
> 3940 Ruffin Road
> Suite C
> San Diego, CA  92123
> (858) 268-1236 x2232 (Work)
> (858) 268-7755 (Fax)
> (619) 865-2775 (Cell)
> http://www.intrusion.com
> mailto:[email-masked]
> 
And if this be the last time I go down to the sea once more, I shall always
remember the men who have sailed and served with me.  It has been my honour
and privilege to be with you this day.

To the sea once more for England.  God save the King.

-- Lord Nelson, First Lord of the Admiralty at Trafalger

-----Original Message-----
From: John C. C. White [mailto:[email-masked]]
Sent: Friday, February 23, 2001 6:17 AM
To: IDWG list
Subject: Draft NIST document

NIST (the US National Institute of Standards and Technology) has just
released a draft guidance document on intrusion detection systems. The
document is available at:

 http://csrc.nist.gov/publications/drafts.html

The document seems to be a nice primer on ID systems, but one thing it
lacks is any mention of the emergence of standards for communicating ID
information (i.e., the IDWG's reason for existence). NIST invites review
and comment on the document; it seems to me that we should individually
or collectively recommend that they include adherence to standardized
formats and protocols as something to look for when selecting ID
systems. They request that comments be submitted by March 14.

-John White-

---

From: Mike Erlinger <[email-masked]>
Date: Sat, 24 Feb 2001 15:00:02 -0800

i agree that pooling the comments would be best.  one consolidated message
is sure to be a lot easier to handle then a bunch of individual ones.  i am
willing to take whatever comments come out on the mailing list and 
consolidate them.

mike

-- 
mike erlinger, professor computer science
www:      http://www.cs.hmc.edu/~mike
email:    [email-masked]
smail:    computer science dept harvey mudd college,
          301 E. 12th Street, Claremont, CA, 91711 
909-621-8912,   FAX: 909-621-8465