Subject: [mile] MILE WG draft adoption for RFC6045-bis

From: <[email-masked]>
Date: Tue, 25 Oct 2011 18:25:55 -0400

Hello,

Thank you all for your hard work in helping to move us to a WG status!  The next step is to ask for adoption of drafts.  

The first document in which I would like to request working group adoption is RFC6045-bis with my hat on as editor of the document.  Please respond to the mailing list within a week (Nov 2nd) stating if you support RFC6045-bis adoption by the working group.  Also, please include if you are willing to review the draft in your response on adoption. 

http://tools.ietf.org/html/draft-moriarty-mile-rfc6045-bis-01

A consensus call will follow from Brian Trammell as Working Group chair.

Thank you!
Kathleen

-----Original Message-----
From: IESG Secretary [mailto:[email-masked]] 
Sent: Tuesday, October 25, 2011 12:46 PM
To: IETF Announcement list
Cc: Moriarty, Kathleen; [email-masked]; [email-masked]
Subject: WG Action: Managed Incident Lightweight Exchange (mile) 

A new IETF working group has been formed in the Security Area.  For 
additional information, please contact the Area Directors or the WG 
Chairs.

Managed Incident Lightweight Exchange (mile)
--------------------------------------------
Status: Proposed Working Group Charter
Last Updated: 2011-09-21

Chairs:
     Kathleen Moriarty <[email-masked]>
     Brian Trammell <[email-masked]>

Security Area Directors:
     Stephen Farrell <[email-masked]>
     Sean Turner <[email-masked]>

Security Area Advisor:
     Sean Turner <[email-masked]>

Mailing Lists:
     General Discussion: [email-masked]
     To Subscribe:       http://www.ietf.org/mailman/listinfo/mile
     Archive:            http://www.ietf.org/mail-archive/web/mile

Description:

The Managed Incident Lightweight Exchange (MILE) working group will
develop standards and extensions for the purpose of improving incident
information sharing and handling capabilities based on the work
developed in the IETF Extended INCident Handling (INCH) working group.
The Incident Object Description Exchange Format (IODEF) in RFC5070 and
Real-time Inter-network Defense (RID) in RFC6045 were developed in the
INCH working group by international Computer Security Incident Response
Teams (CSIRTs) and industry to meet the needs of a global community
interested in sharing, handling, and exchanging incident information.
The extensions and guidance created by the MILE working group assists
with the daily operations of CSIRTs at an organization, service
provider, law enforcement, and at the country level.  The application of
IODEF and RID to interdomain incident information cooperative exchange
and sharing has recently expanded and the need for extensions has become
more important. Efforts continue to deploy IODEF and RID, as well as to
extend them to support specific use cases covering reporting and
mitigation of current threats such as anti-phishing extensions.

An incident could be a benign configuration issue, IT incident, an
infraction to a service level agreement (SLA), a system compromise,
socially engineered phishing attack, or a denial-of-service (DoS)
attack, etc.  When an incident is detected, the response may include
simply filing a report, notification to the source of the incident, a
request to a third party for resolution/mitigation, or a request to
locate the source.  IODEF defines a data representation that provides a
standard format for sharing information commonly exchanged about
computer security incidents.  RID enables the secure exchange of
incident related information in an IODEF format providing options for
security, privacy, and policy setting.

MILE leverages collaboration and sharing experiences with the work
developed in the INCH working group which includes the data model
detailed in the IODEF, existing extensions to the IODEF for
Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure
exchange of information.  MILE will also leverage the experience gained
in using IODEF and RID in operational contexts. Related work, drafted
outside of INCH will also be reviewed and includes RFC5941, Sharing
Transaction Fraud Data.

The MILE working group provides coordination for these various extension
efforts to improve the capabilities for exchanging incident information.
  MILE has several objectives with the first being a description a
subset of IODEF focused on ease of deployment and applicability to
current information security data sharing use cases.  MILE also
describes a generalization of RID for secure exchange of other
security-relevant XML formats.  MILE produces additional guidance needed
for the successful exchange of incident information for new use cases
according to policy, security, and privacy requirements.  Finally, MILE
produces a document template with guidance for defining IODEF extensions
to be followed when producing extensions to IODEF as appropriate, for:

  * labeling incident reports with data protection, data retention, and
    other policies, regulations, and
    laws restricting the handling of those reports
  * referencing structured security information from within incident
    reports
  * reporting forensic data generated during an incident investigation
    (computer or accounting)

The WG will produce the following:

  * An informational document on IODEF Guidance.
  * A Standards Track document specifying the Real-time Inter-network
    Defense (RID).
  * A Standards Track document specifying the transport for RID.
  * An informational template for extensions to IODEF.
  * A Standards Track document for IODEF Extensions in IANA XML Registry.
  * A Standards Track document for IODEF Extension to support
    structured cybersecurity information.
  * A Standards Track document for Labeling for data protection,
    retention, policies, and regulations.
  * A Standards Track document for GRC Report Exchange.
  * A Standards Track document for IODEF Extension to support forensics.

The drafts under consideration as WG items include:
   * Real-time Inter-network Defense (RID) bis:
      draft-moriarty-mile-rfc6045-bis-01
   * Transport of Real-time Inter-network Defense (RID) Messages bis:
      draft-trammell-mile-rfc6046-bis-00
   * Template for extensions to IODEF:
      draft-trammell-mile-template-01.txt
   * IODEF Extensions in IANA XML Registry:
      draft-trammell-mile-iodef-xmlreg-00.txt
   * GRC Report Exchange (Generalized RID for XML reports/documents):
      draft-moriarty-mile-grc-exchange-00.txt
   * IODEF-extension to support structured cybersecurity information:
      draft-takahashi-mile-sci-00.txt

Milestones

WGLC = Working Group Last Call

2011-11 - WGLC Real-time Inter-network Defense (RID)
2011-11 - WGLC Transport for Real-time Inter-network Defense (RID)
2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for
           consideration as Standards Track document
2011-12 - Submit Transport Real-time Inter-network Defense (RID) to
           IESG for consideration as Standards Track document
2011-12 - WGLC Template for extensions to IODEF
2011-12 - WGLC IODEF Extensions in IANA XML Registry
2011-12 - WGLC IODEF Extension to support structured cybersecurity
           information
2012-02 - Submit Template for extensions to IODEF to IESG for
           consideration as Informational document
2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for
           consideration as Standards Track document
2012-02 - Submit IODEF Extension to support structured cybersecurity
           information to IESG for consideration as Standards Track
           document
2012-03 - WGLC IODEF Extension Labeling for data protection, retention,
           policies, and regulations
2012-03 - WGLC IODEF Guidance
2012-04 - Submit IODEF Extension Labeling for data protection,
           retention, policies, and regulations to IESG for
           consideration as Standards Track document
2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as
           Informational document
2012-05 - WGLC GRC Report Exchange
2012-06 - Submit GRC Report Exchange to IESG for consideration as
           Standards Track document
2012-06 - WGLC Forensics extension
2012-07 - Submit IODEF Forensics extension to IESG for consideration as
           Standards Track document

---

From: <[email-masked]>
Date: Wed, 26 Oct 2011 10:03:31 -0400

Congratulations on the formation of the WG!

The RFC6045-bis draft should be adopted by the mile WG; the draft contains some important improvements over RFC 6045.

I've already reviewed the draft, and would be willing to take another look ... as my time availability permits ;-).

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

> From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
> Sent: Tuesday, October 25, 2011 6:26 PM
> To: [email-masked]
> Subject: [mile] MILE WG draft adoption for RFC6045-bis
> 
> Hello,
> 
> The first document in which I would like to request working group adoption is RFC6045-bis with my hat
> on as editor of the document.  Please respond to the mailing list within a week (Nov 2nd) stating if
> you support RFC6045-bis adoption by the working group.  Also, please include if you are willing to
> review the draft in your response on adoption.
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: Sean Turner <[email-masked]>
Date: Wed, 26 Oct 2011 12:23:35 -0400

Kathleen,

As a starting point for defining a proactive inter-network communication 
method to facilitate sharing incident handling data while integrating 
existing detection, tracing, source identification, and mitigation 
mechanisms for a complete incident handling solution - I think it's a 
great starting point.

Some comments based on a very quick skim:

The draft indicates that it updates RFC 6045.  Is there any reason that 
it shouldn't obsolete RFC 6045 and move RFC 6045 to Historic?  Do you 
expect that implementations of RFC 6045 will be around?  Do you want to 
strongly encourage them to do this updated version?  I know this might 
seem awfully procedural, but having a well thought out answer might save 
some time later in the process.

If this is a new and updated version, are new version #s needed in the 
protocol?  I read that the summary of revisions, but I think it's worth 
asking anyway.

Shouldn't the reference to RFC6046 be replaced with 
draft-trammell-mile-rfc6046-bis?

ID nits complains about the following:

  s4: r/[XMLnames/[XMLNames] - note the N in names

  I love me some RFC 5275, but it's not used in the draft.

spt

On 10/25/11 6:25 PM, [email-masked] wrote:
>       Kathleen Moriarty<[email-masked]>
>       Brian Trammell<[email-masked]>
>
> Security Area Directors:
>       Stephen Farrell<[email-masked]>
>       Sean Turner<[email-masked]>
>
> Security Area Advisor:
>       Sean Turner<[email-masked]>
>
> Mailing Lists:

---

From: <[email-masked]>
Date: Wed, 26 Oct 2011 13:06:20 -0400

Hi Se4an,

Thank you.  Yes, this should result in RFC6045 becoming obsolete as the improvements should be made.  I will update the schema version, thanks for the catch.  I had that in the back of my mind, so the reminder is helpful!

I was thinking about how group keys might be used in some use cases, so the reference to 5275 was part of my thought process as I was trying to figure out the right references (did not accomplish this).  If you have suggestions, it may be something that should get considered.

Thanks,
Kathleen

-----Original Message-----
From: Sean Turner [mailto:[email-masked]] 
Sent: Wednesday, October 26, 2011 12:24 PM
To: Moriarty, Kathleen
Cc: [email-masked]
Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis

Kathleen,

spt

---

From: "Takeshi Takahashi" <[email-masked]>
Date: Fri, 28 Oct 2011 15:24:05 +0900

Hello Kathleen and all,

I also would like to see the RFC6045-bis to be adopted by the MILE WG.
I've already read the document, and in my understanding, the draft is
carefully designed to handle IODEF document and its extension documents.

Kind Regards,
Take

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Wednesday, October 26, 2011 11:04 PM
To: [email-masked]; [email-masked]
Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis

The RFC6045-bis draft should be adopted by the mile WG; the draft contains
some important improvements over RFC 6045.

I've already reviewed the draft, and would be willing to take another look
... as my time availability permits ;-).

Thanks,
--David

> Thank you all for your hard work in helping to move us to a WG status!  
> The next step is to ask for adoption of drafts.
> 
> The first document in which I would like to request working group 
> adoption is RFC6045-bis with my hat on as editor of the document.  
> Please respond to the mailing list within a week (Nov 2nd) stating if 
> you support RFC6045-bis adoption by the working group.  Also, please
include if you are willing to review the draft in your response on adoption.
> Status: Proposed Working Group Charter Last Updated: 2011-09-21
> 
> Chairs:
> INCH working group by international Computer Security Incident 
> Response Teams (CSIRTs) and industry to meet the needs of a global 
> community interested in sharing, handling, and exchanging incident
information.
> provider, law enforcement, and at the country level.  The application 
> of IODEF and RID to interdomain incident information cooperative 
> exchange and sharing has recently expanded and the need for extensions 
> has become more important. Efforts continue to deploy IODEF and RID, 
> as well as to extend them to support specific use cases covering 
> reporting and mitigation of current threats such as anti-phishing
extensions.
> locate the source.  IODEF defines a data representation that provides 
> a standard format for sharing information commonly exchanged about 
> exchange of information.  MILE will also leverage the experience 
> gained in using IODEF and RID in operational contexts. Related work, 
> drafted outside of INCH will also be reviewed and includes RFC5941, 
> Sharing Transaction Fraud Data.
> 
> The MILE working group provides coordination for these various 
> extension efforts to improve the capabilities for exchanging incident
information.
> security-relevant XML formats.  MILE produces additional guidance 
> needed for the successful exchange of incident information for new use 
> cases according to policy, security, and privacy requirements.  
> Finally, MILE produces a document template with guidance for defining 
> IODEF extensions to be followed when producing extensions to IODEF as

---

From: "Martin, Robert A." <[email-masked]>
Date: Fri, 28 Oct 2011 13:31:06 -0400

Congratualations to all for getting this work area started.

RFC6045 should definetly be adopted by the MILE Working Group.  It fills 
a needed and critical part of the functionality needed to support 
automation in incident handling amongst organizations.

Bob

On 10/25/11 6:25 PM, [email-masked] wrote:
> .

---

From: <[email-masked]>
Date: Fri, 28 Oct 2011 12:42:53 -0500

I too support RFC6045-bis being adopted by the working group.

Kent Landfield
Director Content Strategy, Architecture and Standards

McAfee, Inc.
5000 Headquarters Dr.
Plano, Texas 75024

Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Bob Martin <[email-masked]<mailto:[email-masked]>>
Date: Fri, 28 Oct 2011 12:31:06 -0500
To: Kathleen Moriarty <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [mile] MILE WG draft adoption for RFC6045-bis

Bob

On 10/25/11 6:25 PM, [email-masked]<mailto:[email-masked]> wrote:
Hello,

Thank you!
Kathleen

-----Original Message-----
From: IESG Secretary [mailto:[email-masked]]
Sent: Tuesday, October 25, 2011 12:46 PM
To: IETF Announcement list
Cc: Moriarty, Kathleen; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: WG Action: Managed Incident Lightweight Exchange (mile)

Chairs:
       Kathleen Moriarty<[email-masked]<mailto:[email-masked]>>
       Brian Trammell<[email-masked]<mailto:[email-masked]>>

Security Area Directors:
       Stephen Farrell<[email-masked]<mailto:[email-masked]>>
       Sean Turner<[email-masked]<mailto:[email-masked]>>

Security Area Advisor:
       Sean Turner<[email-masked]<mailto:[email-masked]>>

Mailing Lists:
       General Discussion: [email-masked]<mailto:[email-masked]>
       To Subscribe:       http://www.ietf.org/mailman/listinfo/mile
       Archive:            http://www.ietf.org/mail-archive/web/mile

Description:

Milestones

_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile
.

_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile