Re: [Cacao] Proposed Charter Text

["Jason Keirstead" <[e-mail]>]

Hi - I just wanted to relay that IBM Security supports this charter as 
well, and that we're very interested in doing what we can to progress this 
work. 

We believe if progressed & widely adopted, it will help fill a large gap 
in the cybersecurity collaboration ecosystem.

-
Jason Keirstead
Lead Architect - IBM Security Connect
www.ibm.com/security

"Things may come to those who wait, but only the things left by those who 
hustle." - Unknown 




From:   "Arnaud.Taddei.IETF" 
<Arnaud.Taddei.IETF=[e-mail]>
To:     Jason Webb <[e-mail]>
Cc:     "[e-mail]" <[e-mail]>, "[e-mail]" 
<[e-mail]>, JACQUENET Christian TGI/OLN 
<[e-mail]>, Bret Jordan <[e-mail]>
Date:   12/12/2018 11:01 PM
Subject:        Re: [Cacao] Proposed Charter Text
Sent by:        "Cacao" <[e-mail]>



Likewise, this is a good charter that addresses a serious gap, let alone 
it is a very interesting area

Thank you for taking the time to create this environment here


Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday 11 December 2018 17:42, Jason Webb 
<[e-mail]> wrote:

Bret,

Thank you for your effort. This is an excellent charter. I feel that this 
is an important area that is not being addressed to date. This effort will 
help address problems in the security industry as we try to combat the 
ever growing and increasingly complicated threats to the cyber world. 

I am excited by the possibilities of this effort. The sooner we can move 
forward with this effort, the better.

Thanks,

Jason Webb




From: Cacao <[e-mail]> on behalf of 
[e-mail] <[e-mail]>
Sent: Tuesday, December 11, 2018 6:11 AM
To: Bret Jordan; [e-mail]
Cc: JACQUENET Christian TGI/OLN
Subject: Re: [Cacao] Proposed Charter Text 
 
Hi Bret,
 
Thank you for drafting and sharing a proposed charter.
 
I don’t have a gmail account, so I cannot modify the text online.
 
FWIW, please find our proposed modifications and comments to this proposed 
charter, both doc and pdf version are included:
 
doc: 
https://github.com/boucadair/IETF-Drafts-Reviews/raw/master/cacao-proposed%20charter-rev%2011122018a.docx
pdf: 
https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/cacao-proposed%20charter-rev%2011122018a.pdf 
 
 
Cheers,
Med
 
De : Cacao [mailto:[e-mail]] De la part de Bret Jordan
Envoyé : jeudi 6 décembre 2018 06:15
À : [e-mail]
Objet : Re: [Cacao] Proposed Charter Text
 
Any comments or suggestions for changes to this proposed charter?
 
Bret 
Sent from my Commodore 128D

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

On Dec 2, 2018, at 9:50 AM, Bret Jordan <[e-mail]> wrote:
All,
 
Here is some proposed charter text for this working group.  Please send me 
any suggestions or changes you would like to see.  You can see the live 
version as a Google Doc here: 
https://docs.google.com/document/d/1Kh7HEWeqj4-zWuPNDflDkKNJUaqZAOmUl9pBJBRjvv8/edit#
 
I am also attached it in IETF draft document form, not sure which was I 
should do it. The text is below…
 
 
 
 
Problem
Threat Actors and Intrusion Sets are advancing at an increasing rate 
relative to cyber defense. Further, cyber defenders typically have to 
manually identify and process prevention, mitigation, and remediation 
steps in order to protect their systems, networks, data, and users. 

Due to this increase and sophistication of cyber attacks the need for a 
secure mechanism that would enable system and network operators to respond 
to threats in machine relevant time has raised significantly. While some 
attacks may be well known to certain security experts and cyber 
researchers they are often not documented in a way that would enable 
automated mitigation or remediation.. A documented language for describing 
prevention, mitigation, and remediation actions is critical for cyber 
defenders to respond more quickly and reduce the exposure from an attack. 


Working Group
To enable and assist cyber defense, the Collaborative Automated Course of 
Action Operations (CACAO) for Cyber Security working group will focus on 
creating a solution to securely document and share the actions needed to 
prevent, mitigate, and remediate threats. This effort will focus on 
providing an information model, data serialization, and transport for 
defining, sharing, and processing Collaborative Automated Course of Action 
Operations (CACAO). 

Each collaborative course of action will consist of a sequence of cyber 
defense actions that can be coordinated and deployed across a set of 
heterogeneous cyber security systems such that both the actions requested 
and the resultant outcomes may be monitored and verified. 

The primary focus of this proposed working group will be the definition 
and the distribution of the sequence of actions (perhaps in a tree or 
graph). Where possible we will leverage existing efforts that *may* define 
the atomic actions to be included in a process or sequence.


Goals
This working group has the following major goals:
* Identify and document the use cases and requirements
 
* Create an information and data model that can capture and enable 
collaborative courses of action (sometimes called playbooks) that can be 
used to automate some parts of cyber defense
 
* Identify and document the system functions and roles that must exist 
with associated protocols to exchange information between those system 
functions
 
* Identify and document the configuration for a series of protocols that 
can be used to distribute courses of action in both direct delivery and 
publish-subscribe methods
 
* Define and create a series of tests and documents to assist with 
interoperability
 
Deliverables 
The working group plans to create informational and standards track draft 
documents some of which may be published through the IETF RFC stream.

Within the first year, the working group aims to:
1. Identify a solution for capturing and distributing multiple sequenced 
atomic actions, whether they be manual or automated.
2. Publish a standards track draft solution that can be used by 
organizations and vendors to create and distribute Courses of Action / 
Playbooks.
 
 
<draft-jordan-cacao-charter-00.txt>
 
Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that 
can not be unscrambled is an egg."
 
-- 
Cacao mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/cacao