Re: [mile] New Version Notification - draft-ietf-mile-rolie-02.txt

All,

The following is a short summary of the changes we have made to ROLIE in latest draft update and some ideas on the path forward. This new draft is the first step in a series of planned changes and additions to the draft in order to generalize ROLIE to support more general sharing of cyber security information, support greater automation, and enhance the readability, usability, and extensibility of the draft.

First and foremost, the major changes to ROLIE in this version of the draft are:

*         Changed the expansion of the acronym to "Resource-Oriented Lightweight Information Exchange" in order to reflect the idea that ROLIE will be used to exchange any cyber security information, including, but not limited to: Indicators, Incidents, Vulnerabilities, Configuration Checklists, and Software tags.

*         Rewrote and reduced much of the front matter of the document in order to recast ROLIE in light of its new title and expanded goal. This manifested primarily as removing the CSIRT focus of the Abstract, Introduction, and Background sections.

*         Created a new supplementary document that contains the CSIRT focused materials and examples. Some background revolving around CSIRT usage of ROLIE and all of the non-normative examples present in section 4 were moved into this document. Specific requirements and link relations for the IODEF and RID formats were also moved into this document. We will be posting this as a new personal draft in the near future.

*         Began re-working the normative requirements to allow for other information categories. This is ultimately the biggest area of change in the document, and sets up our plan moving forward with ROLIE.

The plan for the normative requirements of the content model is to establish an "information-type" IANA table that lists the following:

1.       A list of "information-type" category values supported by ROLIE (e.g. indicators, vulnerabilities, configuration checklists, software tags).

2.       A short description of each information type.

3.       A link to a specification that describes the definition of ROLIE entries for the information type. These additional specifications will describe the expected formats for a given information type, required link relations, and other requirements and usage guidance for an information type in ROLIE.
As an example, consider the CSIRT draft as the specification for inclusion of incident and indicator entries in ROLIE. This draft will contain requirements and non-normative examples of using the CSIRT relevant formats (IODEF and RID) with ROLIE. These specifications would be written for each information type we'd like ROLIE to support. This provides for a great deal of extensibility in ROLIE going forward.

In terms of the ROLIE draft, moving all format requirements and usage guidance into separate drafts greatly reduces the length and complexity of the ROLIE draft, and creates a more streamlined writing, editing, and reading process.

The goal of this next set of changes is to define this IANA table enumerating the specifications for ROLIE information types. This will allow implementers of ROLIE to select the information types that are meaningful to their implementations, supporting the data formats that best suit their needs for their given implementation goals. The specifications in the associated IANA table entries would then provide the specific implementation guidance for the related formats inside ROLIE. Additional new features can be created later by creating extensions over the information type specifications as needed in the future.

This draft represents our first steps in this direction. We will be working on the major changes listed above in the GitHub project at https://github.com/CISecurity/ROLIE. The next steps of changing the requirements, creating an IANA table, and writing the additional documents are our current focus of work.

Questions, comments, and concerns are welcome.
Thanks,
Stephen Banghart

-----Original Message-----
From: mile [mailto:mile-bounces@ietf.org] On Behalf Of internet-drafts@ietf.org
Sent: Friday, June 03, 2016 11:07 AM
To: mile@ietf.org; mile-chairs@tools.ietf.org; Nancy Cam-Winget <ncamwing@cisco.com>
Subject: [mile] New Version Notification - draft-ietf-mile-rolie-02.txt

A new version (-02) has been submitted for draft-ietf-mile-rolie:

https://www.ietf.org/internet-drafts/draft-ietf-mile-rolie-02.txt

The IETF datatracker page for this Internet-Draft is:

https://datatracker.ietf.org/doc/draft-ietf-mile-rolie/

Diff from previous version:

https://www.ietf.org/rfcdiff?url2=draft-ietf-mile-rolie-02

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

IETF Secretariat.

_______________________________________________

mile mailing list

mile@ietf.org<mailto:mile@ietf.org>

https://www.ietf.org/mailman/listinfo/mile