Re: [mile] Updated charter for review

["Moriarty, Kathleen" <[e-mail]>]

Hi John,

Thank you for the feedback.  Your suggestions look good.

Are there any other suggestions or views on John's input as we close out the review end of day today.

Thank you,
Kathleen

From: Field, John
Sent: Tuesday, April 02, 2013 9:57 AM
To: Moriarty, Kathleen; [e-mail]
Subject: RE: Updated charter for review

Kathleen,

Thanks.
Overall I think the charter looks good.

I do have two comments/suggestions for the group's consideration.  First, I would add one additional sentence at the very beginning, as shown below.  In addition, I would add some additional text into the 4th paragraph.  (Just in case of CR/LF issues, the 4th paragraph is the paragraph that describes an incident).

Here is the charter text with my suggested changes.

Thanks,
John


    <add text>
    An incident is an unplanned event that occurs in an information infrastructure.
   </add text>

    An incident could be a benign configuration issue, IT incident, an
    infraction to a service level agreement (SLA), a system compromise,
    socially engineered phishing attack, or a denial-of-service (DoS)
    attack, etc.  When an incident is detected,

   <delete text>
    the
    </delete text>

    <add text>
    or suspected, there may be a need for organizations to collaborate.
    This collaboration effort may take several forms including joint analysis,
    Information dissemination, and/or a coordinated operational response.
    Examples of
   </add text>

   response may include simply filing a report, notification to the source of the incident, a
    request to a third party for resolution/mitigation, information sharing
    on identified indicators of compromise, or a request to
    locate the source.  IODEF defines a data representation that provides a
    standard format for sharing information commonly exchanged about
    computer security incidents, which includes indicators with or without the
    relevant context information.  IODEF will be updated to meet the current and
    future needs, maintaining the built in extensibility, of information sharing
    where indicators with rich context for actionable sharing is provided.
    RID enables the secure exchange of incident related information in an IODEF
    format providing options for security, privacy, and policy setting.

    MILE leverages collaboration and sharing experiences with prior work
    including the IODEF data model detailed in the IODEF, existing extensions
    to the IODEF for Anti-phishing (RFC5901), and RID (RFC6545, RFC6546) for
    the secure exchange of information.  MILE will also leverage the experience
    gained in using IODEF and RID in operational contexts.

    The MILE working group provides coordination for IODEF and RID extensions that
    improve capabilities for exchanging indicator and incident information.
    MILE's objectives include the update of IODEF coupled with guidance information
    to enhance interoperability, deployment ease, and applicability to current
    information security data sharing use cases. MILE will also describe a
    generalization of RID for secure exchange of other security-relevant XML
    formats. MILE will produce additional guidance needed for the successful
    exchange of indicator and incident information for new use cases according to policy,
    security, and privacy requirements. Finally, MILE produced a document
    template with guidance for defining IODEF extensions to be followed when
    producing extensions to IODEF as appropriate.




From: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]] On Behalf Of Moriarty, Kathleen
Sent: Tuesday, March 26, 2013 8:00 PM
To: [e-mail]<mailto:[e-mail]>
Subject: Re: [mile] Updated charter for review

The good news, people are reading it, however, I sent out the wrong version.  The corrected one is included in this message.

Please provide feedback over the next 2 weeks.  We'll move the charter to the next stage in the approval process after April 9th.

Thank you!
Kathleen

Managed Incident Lightweight Exchange (mile)
--------------------------------------------

Charter

Current Status: Active

Chairs:
     Kathleen Moriarty
     Brian Trammell

Security Area Directors:
     Stephen Farrell
     Sean Turner

Security Area Advisor:
     Sean Turner

Mailing Lists:
     General Discussion: [e-mail]<mailto:[e-mail]>
     To Subscribe:       https://www.ietf.org/mailman/listinfo/mile
     Archive:            http://www.ietf.org/mail-archive/web/mile/

Description of Working Group:


    The Managed Incident Lightweight Exchange (MILE) working group develops
    standards for the purpose of improving incident and indicator information
    sharing and handling capabilities. The Incident Object
    Description Exchange Format (IODEF) in RFC5070 and Real-time Inter-network
    Defense (RID) in RFC6045 were developed in the INCH working group by
    international Computer Security Incident Response Teams (CSIRTs) and
    industry to meet the needs of a global community interested in sharing,
    handling, and exchanging incident and indicator information.

    The working group will define enhancements and extensions to IODEF and RID
    and provide guidance for applying them. It will also focus on improving the
    interoperability of existing and new IODEF implementations, and the
    interoperation of IODEF and its extensions and enhancements with related
    standards for information sharing. The extensions and guidance created by
    the MILE working group assist with the daily operations of CSIRTs at an
    organization, service providers, law enforcement, and at the national level.

    The working group has completed Proposed Standard revisions of RID (RFC 6545)
    and RID transport (RFC 6546). This transport was designed to meet specific usage
    requirements of CSIRTs and related industry groups. In order to meet different
    usage requirements for other communities, the working group will consider
    alternate transport or bindings for RID and IODEF information.

    An incident could be a benign configuration issue, IT incident, an
    infraction to a service level agreement (SLA), a system compromise,
    socially engineered phishing attack, or a denial-of-service (DoS)
    attack, etc.  When an incident is detected, the response may include
    simply filing a report, notification to the source of the incident, a
    request to a third party for resolution/mitigation, information sharing
    on identified indicators of compromise, or a request to
    locate the source.  IODEF defines a data representation that provides a
    standard format for sharing information commonly exchanged about
    computer security incidents, which includes indicators with or without the
    relevant context information.  IODEF will be updated to meet the current and
    future needs, maintaining the built in extensibility, of information sharing
    where indicators with rich context for actionable sharing is provided.
    RID enables the secure exchange of incident related information in an IODEF
    format providing options for security, privacy, and policy setting.

    MILE leverages collaboration and sharing experiences with prior work
    including the IODEF data model detailed in the IODEF, existing extensions
    to the IODEF for Anti-phishing (RFC5901), and RID (RFC6545, RFC6546) for
    the secure exchange of information.  MILE will also leverage the experience
    gained in using IODEF and RID in operational contexts.

    The MILE working group provides coordination for IODEF and RID extensions that
    improve capabilities for exchanging indicator and incident information.
    MILE's objectives include the update of IODEF coupled with guidance information
    to enhance interoperability, deployment ease, and applicability to current
    information security data sharing use cases. MILE will also describe a
    generalization of RID for secure exchange of other security-relevant XML
    formats. MILE will produce additional guidance needed for the successful
    exchange of indicator and incident information for new use cases according to policy,
    security, and privacy requirements. Finally, MILE produced a document
    template with guidance for defining IODEF extensions to be followed when
    producing extensions to IODEF as appropriate.

    [Removed laundry list of drafts -- outdated. We should update the milestones below as well]

Goals and Milestones:
  Done     - WGLC Real-time Inter-network Defense (RID)
  Done     - WGLC Transport for Real-time Inter-network Defense (RID)
  Done     - Submit Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document
  Done     - Submit Transport Real-time Inter-network Defense (RID) to IESG for consideration as Standards Track document
  Done     - WGLC Template for extensions to IODEF
  Done     - WGLC IODEF Extensions in IANA XML Registry
  Apr 2013 - WGLC IODEF Extension to support structured cybersecurity information
  Done     - Submit Template for extensions to IODEF to IESG for consideration as Informational document
  Done     - Submit IODEF Extensions in IANA XML Registry to IESG for consideration as Standards Track document
  Jun 2013 - Submit IODEF Extension to support structured cybersecurity information to IESG for consideration as Standards Track document.
  TBD      - WGLC RFC 5070bis
  TBD      - Submit RFC 5070bis to IESG for consideration as a Standards Track document
  TBD      - WGLC IODEF Reference Format
  TBD      - Submit IODEF Reference Format to IESG for consideration as a Standards Track document
  TBD      - WGLC Resource-Oriented Indicator Exchange
  TBD      - Submit Resource-Oriented Indicator Exchange to IESG for consideration as a Standards Track document

  [ old milestone bits below ]

  [no doc]- WGLC IODEF Guidance
  [no doc] - Submit IODEF Extension Labeling for data protection, retention, policies, and regulations to IESG for consideration as Standards Track document
  [no doc] - Submit WGLC IODEF Guidance to IESG for consideration as Informational document
  May 2012 - WGLC GRC Report Exchange [stalled]
  Jun 2012 - Submit GRC Report Exchange to IESG for consideration as Standards Track document [stalled]
  Jun 2012 - WGLC Forensics extension [stalled]
  Jul 2012 - Submit IODEF Forensics extension to IESG for consideration as Standards Track document [stalled]

From: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]] On Behalf Of Moriarty, Kathleen
Sent: Tuesday, March 26, 2013 4:48 PM
To: [e-mail]<mailto:[e-mail]>
Subject: [mile] Updated charter for review

As discussed at the MILE meeting, we need to revise the charter.  Brian and I updated the charter and it is attached for review and comment to the list.

Thank you in advance!

Best regards,
Kathleen & Brian


 [Outdated draft charter deleted]