Re: [mile] IODEF Guidance and existing implementations

[Eric Burger <[e-mail]>]

On the one hand, it is nice to have everything in a single document. On the other hand, it is really hard to get big documents reviewed, revised, reviewed, revised, area reviewed, revised, IESG reviewed, revised, and IETF reviewed. A pair of smaller documents will be much easier to get done. Moreover, the use cases will expand over time (I hope), yet the protocol will not change that much (I hope). Thus, two documents may be easier to manage and ultimately get published.

On Jul 2, 2013, at 10:50 AM, Panos Kampanakis (pkampana) <[e-mail]> wrote:

> Thank you Kathleen.
>  
> > I would like to see us use the IODEF guidance document to work through use cases and document what gets shared with whom for various use cases, then demonstrated using RFC5070-bis. 
> I can keep the usecases and document them in the Guidance doc. But what is going to be different compared to the usecases in the bis doc? Will we just describe them using prose text and the bis document will have the actual XML?
>  
> Panos
>  
>  
>  
>  
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Moriarty, Kathleen
> Sent: Friday, June 28, 2013 11:32 AM
> To: [e-mail]
> Subject: [mile] IODEF Guidance and existing implementations
>  
> Hi Panos & Others,
>  
> Panos had asked about moving the examples from the IODEF Guidance to RFC5070-bis, was that the right thing to do?
>  
> I would like to see us use the IODEF guidance document to work through use cases and document what gets shared with whom for various use cases, then demonstrated using RFC5070-bis.  Implementations are increasing and I think this would be really helpful so that those implementations have guidance to implement the use cases relevant to their users.
>  
> We could start with documentation on some of the existing use cases that have been implemented, some in development, and then look to see how we can share effectively with new use cases.
>  
> The existing and active implementations I am aware of include:
> o   APWG Anti-phishing – using IODEF
> o   APWG eCrime – using IODEF
> o   XMPP Operators using IODEF over XMPP for active exchanges
> o   Blackthorn – Using IODEF + extensions for communications between several nations, with IODEF accessed on mobile platforms
>  
> Names may not be ready to be public:
> o   energy sector organization using IODEF over XMPP
> o   reports sent via IODEF for consumption from a sharing group
>  
> PoCs:
> o  Multiple PoCs in play using IODEF + RID between several vendors in support of the MACCSA framework
>  
> Implementations:
> DFLabs – has the Digital Investigation Manager product using IODEF since at least 2007
> Arcsite supports imports of RFC5070 formatted IODEF reports, there may be other vendors?
> Blackthorn – product using IODEF + private extensions for active sharing
> Open Source RID Agent with RFC5070-bis support in java from EMC/RSA – on GitHub: https://github.com/RSAIntelShare/RID-Server
> Open source RID Agent implementation in Python from MITRE – I don’t have the link, but it is compatible with the EMC/RSA one
> CSI Extension support for IODEF on Github from NICT in Java:
> https://github.com/TakeshiTakahashi/IODEF-SCI/wiki/IODEF-SCI-tools
> eCRISP-X:  Suports eCrime use cases using IODEF RFC5070, from Pat Cain:
> http://sourceforge.net/projects/ecrisp-x
> eCRISP-X: Phisihing report support – can’t find the link, but know it exists for the APWG use case
> iodeflib: a python library to create, parse & edit IODEF:
> http://www.decalage.info/python/iodeflib
> IODEF/RID – older versions (RFC6045, RFC6046 and RFC5070) in open source from Japan: http://www.ipa.go.jp/security/fy16/development/IODEF/api/index.html
> IODEF & RID implementation in Japanese from the Information technology Protection Agency (IPA):
> http://www.cysols.com/research/iodef/IODEFApp.html
> CPAN IODEF perl module to create & parse IODEF:
> http://search.cpan.org/~johng/XML-IODEF-0.06/
> Collective Intelligence Framework (CIF) from Ren-ISAC uses a modified version of IODEF for their active sharing platform
> The CERT.org site that tracked this in the past has a few others listed and also says the following organizations have active projects using IODEF on their pagehttp://www.cert.org/ietf/inch/inch.html :  CERT/CC: AirCERT, JPCERT/CC: Internet Scan Data Acquisition Systems (ISDAS), and eCSIRT.net: The European CSIRT Network
>  
> If I missed any, please add to the list.  It would be good to get these on a web page or wiki as a running list that can be amended as there is a lot of development/PoC activity right now.
>  
> For the IODEF Guidance, we can look at the use cases, determine what is successful and get the use cases documented.
>  
> Thank you,
> Kathleen
>  
> _______________________________________________
> mile mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mile