Re: [Cacao] Updated Charter version 03

[Bret Jordan <[e-mail]>]

All,

Thanks for your comments.  Let me try and summarize things from my standpoint.  

1) This work is a very ambitious effort that requires that we try and implement and automate what is done today with playbooks in a SoC so that we can have a positive impact on cyber defense. 

2) Playbooks for cyber defense are in active use in nearly every modern SoC today. Yes, playbooks and run books are used for other things out side of the cyber domain, but from my standpoint, those other domains are out-of-scope for this project. So physical security, threat actor behavior, IT process, etc are all out of scope. 

3) I would hope that we could crawl, walk, jog, and then run.  Meaning, I would like to get a basic JSON data model in place within the next 6-9 months and start working on vendor integrations. If we try and boil the ocean and do everything in the first version of the standard, the industry will just pass us by and do their own thing.  We have a very narrow window to standardize this effort either here in the IETF or in another SDO.  If we miss this opportunity, then cyber defense will be stuck with multiple solutions that do not enable interoperability or rapid scalable defense. This means we will once again take a back seat to threat actors and intrusion sets.  So let's please try and avoid word-smithing things to death and bike shedding this work to prevent it from being successful.  Ask yourself, what do you fundamentally need for your SoC to make this work?  If you are a vendor, what do you need to make this integrate with your solutions?

4) I know some here in the IETF have a hard time with the term “cyber”.  But it is a real thing and very well understood in the industry. To put that in context there is about 180 Billion dollars a year spent on cyber defense and millions of individuals that work in the space. 

5) Yes, some technologies or concepts span between both cyber and physical security, but for the sake of this work, we are limiting this to cyber and not dealing with physical security.  For example data security and its child information security can span both cyber and physical security.  But we are only focused on the playbooks that are needed today for cyber defense. How organizations deal with physical security and what they do to ensure that does not need to be automated in vendor tools to respond at the time scale of threat actors and intrusion sets.


Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."