Subject: [mile] I-D Action: draft-ietf-mile-iodef-guidance-05.txt

From: [email-masked]
Date: Mon, 04 Apr 2016 13:12:45 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Managed Incident Lightweight Exchange of the IETF.

        Title           : IODEF Usage Guidance
        Authors         : Mio Suzuki
                          Panos Kampanakis
	Filename        : draft-ietf-mile-iodef-guidance-05.txt
	Pages           : 28
	Date            : 2016-04-04

Abstract:
   The Incident Object Description Exchange Format [RFC5070] defines a
   data representation that provides a framework for sharing information
   commonly exchanged by Computer Security Incident Response Teams
   (CSIRTs) about computer security incidents.  Since the IODEF model
   includes a wealth of available options that can be used to describe a
   security incident or issue, it can be challenging for implementers to
   develop tools that can Leverage IODEF for incident sharing.  This
   document provides guidelines for IODEF implementers.  It will also
   address how common security indicators can be represented in IODEF
   and use-cases of how IODEF is being used so far.  The goal of this
   document is to make IODEF's adoption by vendors easier and encourage
   faster and wider adoption of the model by Computer Security Incident
   Response Teams (CSIRTs) around the world.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-mile-iodef-guidance/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-mile-iodef-guidance-05

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-iodef-guidance-05

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Mio SUZUKI <[email-masked]>
Date: Mon, 4 Apr 2016 17:38:42 -0300

Hello all,

This is Mio from NICT.

So sorry for my slow work.
Except for examples in “Appendix” section, almost all sections have been filled.
Could you please give me all sorts of comments or feedbacks?

The summaries of this -05 update are
  (1)  Fix some sentences following Panos-san’s suggestion 
  (2)  Changed section title from "Restrictions in IODEF" to "Disclosure level of IODEF" and added some description
  (3)  Mixed "Recommended classes to implement" section with "Unnecessary Fields" section into "Minimal IODEF document" section
  (4)  Added description to "Decide what IODEF will be used for" section, "Implementations" section, and "Security Considerations” section

To-Do lists are
  (1) Convert and add examples of spear phishing and watchlist/malware to "Appendix".
  (2) Modify examples in "Appendix" to follow the current schema.
      Following IODEFv2 is better? Currently, only “Malware Delivery URL” sample follows IODEFv2 schema.

Regards,
mio

> 2016/04/04 17:12, [email-masked]:
> 
> 
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile