Subject: Re: [OPSEC] New Version Notification for draft-paine-smart-indicators-of-compromise-02.txt

From: Ron Bonica <[email-masked]>
Date: Wed, 3 Feb 2021 17:03:58 +0000

Folks,

This appears to be a well-written draft that reflects current practice.

Could I ask for two volunteers to read and comment on the draft?

                                                           Ron

Juniper Business Use Only
From: OPSEC <[email-masked]> On Behalf Of Kirsty P
Sent: Tuesday, January 26, 2021 6:19 AM
To: [email-masked]
Cc: Ollie Whitehouse <[email-masked]>
Subject: [OPSEC] Fw: New Version Notification for draft-paine-smart-indicators-of-compromise-02.txt

[External Email. Be cautious of content]

Hi OPSEC,

Please see below for details of our new draft on Indicators of Compromise (IoCs), updated based on previous comments. We think it might be suitable for OPSEC, but we'd like to hear your comments, discussion or feedback on this draft - please get in touch!

Kirsty & Ollie

________________________________
From: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Sent: 13 January 2021 17:44
To: Kirsty P <[email-masked]<mailto:[email-masked]>>; Kirsty P <[email-masked]<mailto:[email-masked]>>; Ollie Whitehouse <[email-masked]<mailto:[email-masked]>>
Subject: New Version Notification for draft-paine-smart-indicators-of-compromise-02.txt

A new version of I-D, draft-paine-smart-indicators-of-compromise-02.txt
has been successfully submitted by Kirsty Paine and posted to the
IETF repository.

Name:           draft-paine-smart-indicators-of-compromise
Revision:       02
Title:          Indicators of Compromise (IoCs) and Their Role in Attack Defence
Document date:  2021-01-13
Group:          Individual Submission
Pages:          18
URL:            https://www.ietf.org/archive/id/draft-paine-smart-indicators-of-compromise-02.txt
Status:         https://datatracker.ietf.org/doc/draft-paine-smart-indicators-of-compromise/
Htmlized:       https://datatracker.ietf.org/doc/html/draft-paine-smart-indicators-of-compromise
Htmlized:       https://tools.ietf.org/html/draft-paine-smart-indicators-of-compromise-02
Diff:           https://www.ietf.org/rfcdiff?url2=draft-paine-smart-indicators-of-compromise-02

Abstract:
   Indicators of Compromise (IoCs) are an important technique in attack
   defence (often called cyber defence).  This document outlines the
   different types of IoC, their associated benefits and limitations,
   and discusses their effective use.  It also contextualises the role
   of IoCs in defending against attacks through describing a recent case
   study.  This draft does not pre-suppose where IoCs can be found or
   should be detected - as they can be discovered and deployed in
   networks, endpoints or elsewhere - rather, engineers should be aware
   that they need to be detectable (either by endpoints, security
   appliances or network-based defences, or ideally all) to be
   effective.  The purpose of this draft is to document both the
   operational issues, but also the best practices associated with use
   of IoCs today.  This draft provides a foundation for proposals for
   new approaches to operational challenges in network security.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]<mailto:[email-masked]>. All material is UK Crown Copyright (c)

---

From: Fernando Gont <[email-masked]>
Date: Fri, 5 Feb 2021 03:18:50 -0300

Hi, Ron,

I can volunteer for reviewing this draft if that'd be of help.

Thanks!

Regards,
Fernando

On 3/2/21 14:03, Ron Bonica wrote:
> *From:* OPSEC <[email-masked]> *On Behalf Of * Kirsty P
> *Sent:* Tuesday, January 26, 2021 6:19 AM
> *To:* [email-masked]
> *Cc:* Ollie Whitehouse <[email-masked]>
> *Subject:* [OPSEC] Fw: New Version Notification for 
> draft-paine-smart-indicators-of-compromise-02.txt
> 
> *[External Email. Be cautious of content]*
> 
> Hi OPSEC,
> 
> Please see below for details of our new draft on Indicators of 
> Compromise (IoCs), updated based on previous comments. We think it might 
> be suitable for OPSEC, but we'd like to hear your comments, discussion 
> or feedback on this draft - please get in touch!
> 
> Kirsty & Ollie
> 
> ------------------------------------------------------------------------
> 
> *From:[email-masked] <mailto:[email-masked]> 
> <[email-masked] <mailto:[email-masked]>>
> *Sent:* 13 January 2021 17:44
> *To:* Kirsty P <[email-masked] <mailto:[email-masked]>>; 
> Kirsty P <[email-masked] <mailto:[email-masked]>>; Ollie 
> Whitehouse <[email-masked] 
> <mailto:[email-masked]>>
> *Subject:* New Version Notification for 
> draft-paine-smart-indicators-of-compromise-02.txt
> 
> 
> URL: 
> https://www.ietf.org/archive/id/draft-paine-smart-indicators-of-compromise-02.txt
> Status: 
> https://datatracker.ietf.org/doc/draft-paine-smart-indicators-of-compromise/
> Htmlized: 
> https://datatracker.ietf.org/doc/html/draft-paine-smart-indicators-of-compromise
> Htmlized: 
> https://tools.ietf.org/html/draft-paine-smart-indicators-of-compromise-02
> Diff: 
> https://www.ietf.org/rfcdiff?url2=draft-paine-smart-indicators-of-compromise-02
> 
> Abstract:
> This information is exempt under the Freedom of Information Act 2000 
> (FOIA) and may be exempt under other UK information legislation. Refer 
> any FOIA queries to [email-masked] 
> <mailto:[email-masked]>. All material is UK Crown Copyright ©
> 
> 
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
> 

-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Ron Bonica <[email-masked]>
Date: Fri, 5 Feb 2021 16:36:35 +0000

Thanks!

-----Original Message-----
From: OPSEC <[email-masked]> On Behalf Of Fernando Gont
Sent: Friday, February 5, 2021 1:19 AM
To: Ron Bonica <rbonica=[email-masked]>; Kirsty P <Kirsty.p=[email-masked]>; [email-masked]
Cc: Ollie Whitehouse <[email-masked]>
Subject: Re: [OPSEC] New Version Notification for draft-paine-smart-indicators-of-compromise-02.txt

Hi, Ron,

Thanks!

Regards,
Fernando

On 3/2/21 14:03, Ron Bonica wrote:
> Compromise (IoCs), updated based on previous comments. We think it 
> might be suitable for OPSEC, but we'd like to hear your comments, 
> discussion or feedback on this draft - please get in touch!
>
> Kirsty & Ollie
>
> A new version of I-D, 
> has been successfully submitted by Kirsty Paine and posted to the IETF 
> repository.
>
> https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-pain
> e-smart-indicators-of-compromise-02.txt__;!!NEt6yMaO-gk!VcW92ERPAPayFO
> lFzJEh-DIIcloEr885XwOQTqB4SgLNP76lq-_wkqRxnGvUm5F7$
> Status:
> https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-pai
> ne-smart-indicators-of-compromise/__;!!NEt6yMaO-gk!VcW92ERPAPayFOlFzJE
> h-DIIcloEr885XwOQTqB4SgLNP76lq-_wkqRxnJcMSZWa$
> Htmlized:
> https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draf
> t-paine-smart-indicators-of-compromise__;!!NEt6yMaO-gk!VcW92ERPAPayFOl
> FzJEh-DIIcloEr885XwOQTqB4SgLNP76lq-_wkqRxnBO_ajPm$
> Htmlized:
> https://urldefense.com/v3/__https://tools.ietf.org/html/draft-paine-sm
> art-indicators-of-compromise-02__;!!NEt6yMaO-gk!VcW92ERPAPayFOlFzJEh-D
> IIcloEr885XwOQTqB4SgLNP76lq-_wkqRxnCdEa4wA$
> Diff:
> https://urldefense.com/v3/__https://www.ietf.org/rfcdiff?url2=draft-pa
> ine-smart-indicators-of-compromise-02__;!!NEt6yMaO-gk!VcW92ERPAPayFOlF
> zJEh-DIIcloEr885XwOQTqB4SgLNP76lq-_wkqRxnNzNmLSB$
>
> Abstract:
> Please note that it may take a couple of minutes from the time of 
> submission until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
> <mailto:[email-masked]>. All material is UK Crown Copyright (c)
>
>
> https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/opse
> c__;!!NEt6yMaO-gk!VcW92ERPAPayFOlFzJEh-DIIcloEr885XwOQTqB4SgLNP76lq-_w
> kqRxnEY1aznN$
>

_______________________________________________
OPSEC mailing list
[email-masked]
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/opsec__;!!NEt6yMaO-gk!VcW92ERPAPayFOlFzJEh-DIIcloEr885XwOQTqB4SgLNP76lq-_wkqRxnEY1aznN$