Subject: Re: [mile] Updated charter for review

From: "Field, John" <[email-masked]>
Date: Tue, 2 Apr 2013 09:56:57 -0400

Kathleen,

Thanks.
Overall I think the charter looks good.

I do have two comments/suggestions for the group's consideration.  First, I would add one additional sentence at the very beginning, as shown below.  In addition, I would add some additional text into the 4th paragraph.  (Just in case of CR/LF issues, the 4th paragraph is the paragraph that describes an incident).

Here is the charter text with my suggested changes.

Thanks,
John

    <add text>
    An incident is an unplanned event that occurs in an information infrastructure.
   </add text>

    An incident could be a benign configuration issue, IT incident, an
    infraction to a service level agreement (SLA), a system compromise,
    socially engineered phishing attack, or a denial-of-service (DoS)
    attack, etc.  When an incident is detected,

   <delete text>
    the
    </delete text>

    <add text>
    or suspected, there may be a need for organizations to collaborate.
    This collaboration effort may take several forms including joint analysis,
    Information dissemination, and/or a coordinated operational response.
    Examples of
   </add text>

   response may include simply filing a report, notification to the source of the incident, a
    request to a third party for resolution/mitigation, information sharing
    on identified indicators of compromise, or a request to
    locate the source.  IODEF defines a data representation that provides a
    standard format for sharing information commonly exchanged about
    computer security incidents, which includes indicators with or without the
    relevant context information.  IODEF will be updated to meet the current and
    future needs, maintaining the built in extensibility, of information sharing
    where indicators with rich context for actionable sharing is provided.
    RID enables the secure exchange of incident related information in an IODEF
    format providing options for security, privacy, and policy setting.

    MILE leverages collaboration and sharing experiences with prior work
    including the IODEF data model detailed in the IODEF, existing extensions
    to the IODEF for Anti-phishing (RFC5901), and RID (RFC6545, RFC6546) for
    the secure exchange of information.  MILE will also leverage the experience
    gained in using IODEF and RID in operational contexts.

    The MILE working group provides coordination for IODEF and RID extensions that
    improve capabilities for exchanging indicator and incident information.
    MILE's objectives include the update of IODEF coupled with guidance information
    to enhance interoperability, deployment ease, and applicability to current
    information security data sharing use cases. MILE will also describe a
    generalization of RID for secure exchange of other security-relevant XML
    formats. MILE will produce additional guidance needed for the successful
    exchange of indicator and incident information for new use cases according to policy,
    security, and privacy requirements. Finally, MILE produced a document
    template with guidance for defining IODEF extensions to be followed when
    producing extensions to IODEF as appropriate.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Tuesday, March 26, 2013 8:00 PM
To: [email-masked]
Subject: Re: [mile] Updated charter for review

The good news, people are reading it, however, I sent out the wrong version.  The corrected one is included in this message.

Please provide feedback over the next 2 weeks.  We'll move the charter to the next stage in the approval process after April 9th.

Thank you!
Kathleen

Managed Incident Lightweight Exchange (mile)
--------------------------------------------

Charter

Current Status: Active

Chairs:
     Kathleen Moriarty
     Brian Trammell

Security Area Directors:
     Stephen Farrell
     Sean Turner

Security Area Advisor:
     Sean Turner

Mailing Lists:
     General Discussion: [email-masked]<mailto:[email-masked]>
     To Subscribe:       https://www.ietf.org/mailman/listinfo/mile
     Archive:            http://www.ietf.org/mail-archive/web/mile/

Description of Working Group:

    The Managed Incident Lightweight Exchange (MILE) working group develops
    standards for the purpose of improving incident and indicator information
    sharing and handling capabilities. The Incident Object
    Description Exchange Format (IODEF) in RFC5070 and Real-time Inter-network
    Defense (RID) in RFC6045 were developed in the INCH working group by
    international Computer Security Incident Response Teams (CSIRTs) and
    industry to meet the needs of a global community interested in sharing,
    handling, and exchanging incident and indicator information.

    The working group will define enhancements and extensions to IODEF and RID
    and provide guidance for applying them. It will also focus on improving the
    interoperability of existing and new IODEF implementations, and the
    interoperation of IODEF and its extensions and enhancements with related
    standards for information sharing. The extensions and guidance created by
    the MILE working group assist with the daily operations of CSIRTs at an
    organization, service providers, law enforcement, and at the national level.

    The working group has completed Proposed Standard revisions of RID (RFC 6545)
    and RID transport (RFC 6546). This transport was designed to meet specific usage
    requirements of CSIRTs and related industry groups. In order to meet different
    usage requirements for other communities, the working group will consider
    alternate transport or bindings for RID and IODEF information.

    An incident could be a benign configuration issue, IT incident, an
    infraction to a service level agreement (SLA), a system compromise,
    socially engineered phishing attack, or a denial-of-service (DoS)
    attack, etc.  When an incident is detected, the response may include
    simply filing a report, notification to the source of the incident, a
    request to a third party for resolution/mitigation, information sharing
    on identified indicators of compromise, or a request to
    locate the source.  IODEF defines a data representation that provides a
    standard format for sharing information commonly exchanged about
    computer security incidents, which includes indicators with or without the
    relevant context information.  IODEF will be updated to meet the current and
    future needs, maintaining the built in extensibility, of information sharing
    where indicators with rich context for actionable sharing is provided.
    RID enables the secure exchange of incident related information in an IODEF
    format providing options for security, privacy, and policy setting.

    MILE leverages collaboration and sharing experiences with prior work
    including the IODEF data model detailed in the IODEF, existing extensions
    to the IODEF for Anti-phishing (RFC5901), and RID (RFC6545, RFC6546) for
    the secure exchange of information.  MILE will also leverage the experience
    gained in using IODEF and RID in operational contexts.

    The MILE working group provides coordination for IODEF and RID extensions that
    improve capabilities for exchanging indicator and incident information.
    MILE's objectives include the update of IODEF coupled with guidance information
    to enhance interoperability, deployment ease, and applicability to current
    information security data sharing use cases. MILE will also describe a
    generalization of RID for secure exchange of other security-relevant XML
    formats. MILE will produce additional guidance needed for the successful
    exchange of indicator and incident information for new use cases according to policy,
    security, and privacy requirements. Finally, MILE produced a document
    template with guidance for defining IODEF extensions to be followed when
    producing extensions to IODEF as appropriate.

    [Removed laundry list of drafts -- outdated. We should update the milestones below as well]

Goals and Milestones:
  Done     - WGLC Real-time Inter-network Defense (RID)
  Done     - WGLC Transport for Real-time Inter-network Defense (RID)
  Done     - Submit Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document
  Done     - Submit Transport Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document
  Done     - WGLC Template for extensions to IODEF
  Done     - WGLC IODEF Extensions in IANA XML Registry
  Apr 2013 - WGLC IODEF Extension to support structured cybersecurity information
  Done     - Submit Template for extensions to IODEF to IESG for consideration as Informational document
  Done     - Submit IODEF Extensions in IANA XML Registry to IESG for consideration as Standards Track document
  Jun 2013 - Submit IODEF Extension to support structured cybersecurity information to IESG for consideration as Standards Track document.
  TBD      - WGLC RFC 5070bis
  TBD      - Submit RFC 5070bis to IESG for consideration as a Standards Track document
  TBD      - WGLC IODEF Reference Format
  TBD      - Submit IODEF Reference Format to IESG for consideration as a Standards Track document
  TBD      - WGLC Resource-Oriented Indicator Exchange
  TBD      - Submit Resource-Oriented Indicator Exchange to IESG for consideration as a Standards Track document

  [ old milestone bits below ]

  [no doc]- WGLC IODEF Guidance
  [no doc] - Submit IODEF Extension Labeling for data protection, retention, policies, and regulations to IESG for consideration as Standards Track document
  [no doc] - Submit WGLC IODEF Guidance to IESG for consideration as Informational document
  May 2012 - WGLC GRC Report Exchange [stalled]
  Jun 2012 - Submit GRC Report Exchange to IESG for consideration as Standards Track document [stalled]
  Jun 2012 - WGLC Forensics extension [stalled]
  Jul 2012 - Submit IODEF Forensics extension to IESG for consideration as Standards Track document [stalled]

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Tuesday, March 26, 2013 4:48 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [mile] Updated charter for review

As discussed at the MILE meeting, we need to revise the charter.  Brian and I updated the charter and it is attached for review and comment to the list.

Thank you in advance!

Best regards,
Kathleen & Brian

 [Outdated draft charter deleted]

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Tue, 9 Apr 2013 11:05:19 -0400

Hi John,

Thank you for the feedback.  Your suggestions look good.

Are there any other suggestions or views on John's input as we close out the review end of day today.

Thank you,
Kathleen

From: Field, John
Sent: Tuesday, April 02, 2013 9:57 AM
To: Moriarty, Kathleen; [email-masked]
Subject: RE: Updated charter for review

Kathleen,

Thanks.

Thanks,
John

    <add text>

   <delete text>
    the
    </delete text>

    <add text>

Thank you!
Kathleen

Charter

Current Status: Active

Chairs:
     Kathleen Moriarty
     Brian Trammell

Security Area Directors:
     Stephen Farrell
     Sean Turner

Security Area Advisor:
     Sean Turner

Mailing Lists:

Goals and Milestones:

Thank you in advance!

Best regards,
Kathleen & Brian

---

From: "Field, John" <[email-masked]>
Date: Wed, 10 Apr 2013 09:29:11 -0400

Kathleen,

Thanks.

One clarification on my prior note....I previously wrote:

>>First, I would add one additional sentence at the very beginning, as shown below.

I meant to say that this first text insertion would be at the very beginning (of the immediately following) paragraph... *not* at the very beginning of the charter.

So, the text will read as it appears below.

Regards,
John

From: Moriarty, Kathleen
Sent: Tuesday, April 09, 2013 11:05 AM
To: Field, John; [email-masked]
Subject: RE: Updated charter for review

Hi John,

Thank you,
Kathleen

From: Field, John
Sent: Tuesday, April 02, 2013 9:57 AM
To: Moriarty, Kathleen; [email-masked]<mailto:[email-masked]>
Subject: RE: Updated charter for review

Kathleen,

Thanks.

Thanks,
John

    <add text>

   <delete text>
    the
    </delete text>

    <add text>

Thank you!
Kathleen

Charter

Current Status: Active

Chairs:
     Kathleen Moriarty
     Brian Trammell

Security Area Directors:
     Stephen Farrell
     Sean Turner

Security Area Advisor:
     Sean Turner

Mailing Lists:

Goals and Milestones:

Thank you in advance!

Best regards,
Kathleen & Brian

---

From: Sean Turner <[email-masked]>
Date: Tue, 30 Apr 2013 10:25:09 -0600

I've got a couple of questions:

On 3/26/13 5:59 PM, Moriarty, Kathleen wrote:

..snip

>      handling, and exchanging incident and indicator information.

When reading this, I need to know when the WG can declare success.  For 
the next item how will that happen and when can we say we're done 
defining enhancements?  Do we need some kind of requirements document to 
say what's being considering for inclusion?

>      and provide guidance for applying them.

This I understand, one implementation did foo and one did bar.  Is there 
a list of these somewhere?  Are we planning on doing bake-offs to find 
them out?

>      It will also focus on
> improving the
>      interoperability of existing and new IODEF implementations,

What does this mean and how will this be done?  What are the related 
information sharing standards?

>      and the
>      standards for information sharing.

Isn't the last sentence advertising?  I mean the guidance might 
certainly provide guidance if those groups use them, but if not then it 
won't right?  Are members from the communities going to come and speak 
up wrt to whether they think the guidance provided is actually useful?

>      The extensions and guidance
> created by

The following makes it seem like we need a document that lists different 
communities and their requirements - no?  Can we give an example of 
another community?

>      alternate transport or bindings for RID and IODEF information.

I think we need to move what an incident is earlier, but we'll do that 
after I figure somethings out.

>      request to a third party for resolution/mitigation,

I think we need to define what information sharing is somewhere.  I 
think I know what it means and I bet a lot of people on this list know 
what it means, but I very much doubt some of my fellow ADs will know 
what's it's supposed to be.  How's "information sharing" different than 
submitting a report - I shared some information right?

>      information sharing
>      on identified indicators of compromise,

>      or a request to
>      relevant context information.

Is there a document that's going to specify what the requirements are 
for the future needs?

>      IODEF will be updated to meet the
> current and

There's some duplication below that we could work on removing, but 
getting the earlier questions answered first is more important.

>      producing extensions to IODEF as appropriate.

Agreed a lesson learned is to include the names of the drafts on which 
your work will be listed, but we really need to include the

>    Done     - Submit Real-time Inter-network Defense (RID) to IESG for
> consideration as Standards Track document
>
>    Done     - Submit Transport Real-time Inter-network Defense (RID) to
> IESG for consideration as Standards Track document
>
>    Done     - Submit IODEF Extensions in IANA XML Registry to IESG for
> consideration as Standards Track document
>
>    Jun 2013 - Submit IODEF Extension to support structured cybersecurity
> information to IESG for consideration as Standards Track document.
>
>    TBD      - WGLC RFC 5070bis
>
>    TBD      - Submit Resource-Oriented Indicator Exchange to IESG for
> consideration as a Standards Track document
>
>    [no doc] - Submit IODEF Extension Labeling for data protection,
> retention, policies, and regulations to IESG for consideration as
> Standards Track document
>
> *From:[email-masked] [mailto:[email-masked]] *On Behalf
> Of *Moriarty, Kathleen
> *Sent:* Tuesday, March 26, 2013 4:48 PM
> *To:* [email-masked]
> *Subject:* [mile] Updated charter for review
>
> As discussed at the MILE meeting, we need to revise the charter.  Brian
> and I updated the charter and it is attached for review and comment to
> the list.
>
> Thank you in advance!
>
> Best regards,
>
> Kathleen & Brian
>
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile
>