Re: [Cacao] [EXT] Consensus call for CACAO Charter

[Bret Jordan <[e-mail]>]

Chris,

Thanks for your questions.  Let me try and respond and add to what Allan has said.


> [inacio] In this case, do (at least you and Bret) intend that the data model for CACAO is will use the STIX data model?  Following from that, there isn’t really a data modeling task and that the real work would be creating the necessary serializations for playbooks.  



CACAO will not be using the STIXv2 Data Model since if STIXv2 supported this functionality there would be no need for this group. However, it is vitally important that CACAO be linkable to other STIXv2 data in the graph.  But luckily we know a thing or two about STIXv2.  There is also a lot of concepts that we have learned from designing and implementing cyber threat intelligence based on STIXv2.  So all of that knowledge will flow in to this working group.  Meaning, we know how IDs need to be done to support this, we know how versioning needs to work, we understand what type of data needs to be related in the graph and how to do it. The real challenge will be getting the sequencing of atomic actions and any temporal / conditional logic right.

I am somewhat alarmed that we have to give this much detail and be this prescriptive in the charter.  A charter IMHO should focus on the goals that we want to achieve and some general guidance (subject to change) on how we believe we will be able to solve it. With that said, if we need to give super explicit details about how we are going to write that part of the content then here is some text. 


Old Text:
 - CACAO JSON Data Model
   - Create a JSON data model that can capture and enable collaborative courses of action

New Text
 - Design a data model for CACAO
   - This working group will define a normative data model for CACAO using property tables similar to how the OASIS STIXv2 data model was defined. This data model will be designed to explicitly work with I-JSON and all examples will be done in JSON. The working group will also define JSON as the mandatory to implement serialization for this version of CACAO. The working group may decide to also document the data model in other non-normative forms that would be located in an an appendix. 

Do we need to give that kind of details for all aspects of the Charter?

Some of said there is not much discussion on the list.  Well there is not much to discuss when nearly all of the supporters of this work agreed to version 1 or 2 of the charter.  We are now on version 6 soon to be version 7. I know if I was not a sponsor of this work, I would be bored and some what irritated that we were not yet working on real things.

Also I would imagine that most people will communicate and provide most of their feedback during the weekly working calls (that we will setup) and in the Google Docs directly. So I would think that overall, list traffic will always be light.  But just like we do with the STIX community, we will try to always send notes to the list about what was talked about and discussed on the working calls.  

I am thinking that we may need to add the following to the charter as well, just to keep us from having endless debates about how we are going to do work. Something like:

“This working group plans on holding weekly working calls from 8:00 AM-9:00 AM US-Pacific and the working groups plans on using Google Docs for all specification work. While working group members can always send comments and suggestions via email, it will be encouraged to document all comments and suggestions directly in Google docs to enable a more rapid development and response process."
 
All in all I am really coming around to this idea that we need an IETFv2.  We should be able to spin up working groups in terms of days or weeks rather than months or years.  You could then define actual measurable targets that a working group has to achieve every year, otherwise it gets automatically closed.  We have spent / wasted so much time trying to find the perfect text for the charter.  


Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

>> 
>> text.)
>> 
>>  
>> 
>> Any language you would like to propose?
>> 
>>  
>> 
>> * CACAO data model
>> 
>> A data model will be developed in an appropriate language that will allow serialization into data serialization formats including at a minimum JSON and possibly others.
>> 
>>  
>> 
>> Any better?
>> 
>>  
>> 
>>  
>> 
> 
> Allan,
> 
> [inacio] Thank you for the response, this is REALLY helpful.