[mile] Less is More

["Stoecker, Paul" <[e-mail]>]

As we have gone through this process of changing IODEF to essentially morph it from something used to share incidents to something used to share indicators, I have been getting the feeling that we are trying to make it everything to everybody.

I had thought that the goal was to be able to share IOCs so that the adage of "my detection becomes your prevention" will ring true.  If that is our goal isn't there a design paradigm that for efficiency you do the minimum needed to effectively solve the problem?  To that end, what is the minimum amount of context that we need to share IOCs?  Do we really need to pull in ARF, RFC 5901, etc.?  

Is IODEF really the solution as it was based on sharing Incident Information rather than IOCs?  Should IODEF become the Indicator Object Definition Exchange Format?  If so, aren't there better ways to handle some of the indicator data..like the System and Node classes being rewritten to handle multiple IPs better?  I guess what I am saying is, if you had to design a schema for the purpose of sharing IOCs starting from nothing would it turn out to look like IODEF or would it be something fundamentally different?

I am not being critical of the work to date or of some of the ideas being put forward, but I do like to do these types of thought experiments during a design process to make sure that we are happy with the direction and don't need to make any course corrections.  I see all of the discussion about adding more context and it starts me thinking that we are adding "complexity" and moving away from "less is more".  

One of the things about me, having spent time in a SOC is that I want to get immediately down to the issue.  Just tell me what I need to know to detect the malicious activity.  Once I find it I can take some very coarse, rudimentary actions to protect my environment while it gets escalated to a team to research it and gather the context needed to create effective long-term permanent solutions.  Hence my concerns about trying to do too much with IODEF.

Anyway, this is what happens when I am on holiday and my mind frees up to think about things ;-). 

Regards,

Paul

Sent from my iPad