Subject: [mile] I-D Action: draft-ietf-mile-iodef-guidance-00.txt

From: [email-masked]
Date: Mon, 29 Apr 2013 20:22:04 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Managed Incident Lightweight Exchange Working Group of the IETF.

	Title           : IODEF Usage Guidance
	Author(s)       : Panos Kampanakis
	Filename        : draft-ietf-mile-iodef-guidance-00.txt
	Pages           : 7
	Date            : 2013-04-26

Abstract:
   The Incident Object Description Exchange Format [RFC5070] defines a
   data representation that provides a framework for sharing information
   commonly exchanged by Computer Security Incident Response Teams
   (CSIRTs) about computer security incidents.  Since the IODEF model
   includes a wealth of available options that can be used to describe a
   security incident or issue, it can be challenging for implementers to
   develop tools that can Leverage IODEF for incident sharing.  This
   document provides guidelines for IODEF users and implementers.  It
   will also address how common security indicators can be represented
   in IODEF.  The goal of this document is to make IODEF's adoption by
   vendors easier and encourage faster and wider adoption of the model
   by Computer Security Incident Response Teams (CSIRTs) around the
   world.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-mile-iodef-guidance-00

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Tue, 30 Apr 2013 13:13:21 +0000

Hello everyone,

This is the starting point of the IODEF Guidance doc that we wanted to write in order to motivate vendors to adopt and implement IODEF. 
It is far from being done, but it is a starting point. Its last section with the usecases might end up in the bis document that will come later, but for now I put them in the iodef guidance.

Comments and feedback are welcome.

Regards,
Panos

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Monday, April 29, 2013 11:22 PM
To: [email-masked]
Cc: [email-masked]
Subject: [mile] I-D Action: draft-ietf-mile-iodef-guidance-00.txt

Abstract:

_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile

---

From: Sean Turner <[email-masked]>
Date: Tue, 30 Apr 2013 11:52:41 -0600

Panos,

The audience for this document is both implementers and users.  Most of 
the time RFCs are targeted at implementers.  It'd be good to make sure 
it's clear which bis apply to which audience.

spt

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Tue, 30 Apr 2013 21:10:24 +0000

Thanks Paul.

To clarify, the bis will be for 5070.
This i0def-guidance-00 doc is mostly for implementers, but having more implementation will also mean that it will be easier for users to adopt it. So, it will benefit implementers first and users indirectly. I will make sure it is clearer in the doc.

Rgs,
Panos

-----Original Message-----
From: Sean Turner [mailto:[email-masked]] 
Sent: Tuesday, April 30, 2013 1:53 PM
To: Panos Kampanakis (pkampana)
Cc: [email-masked]
Subject: Re: [mile] I-D Action: draft-ietf-mile-iodef-guidance-00.txt

Panos,

The audience for this document is both implementers and users.  Most of the time RFCs are targeted at implementers.  It'd be good to make sure it's clear which bis apply to which audience.

spt

---

From: Sean Turner <[email-masked]>
Date: Tue, 30 Apr 2013 15:33:18 -0600

Ah so this will only be for IODEF and not for RID?

I think you might be able to weasel word it by saying users might also 
find this document of interest ;)

spt