Re: [mile] Proposed MILE charter

["Martin, Robert A." <[e-mail]>]

Agree.  This body of work will be a valuable addition for everyone in 
this topic area.

On 9/21/11 11:52 AM, [e-mail] wrote:
> I think this is a solid charter that does a good job of stating what we are trying to achieve in the proposed working group.
>
> Kent Landfield
> Director Content Strategy, Architecture and Standards
>
> McAfee, Inc.
> 5000 Headquarters Dr.
> Plano, Texas 75024
>
> Direct: +1.972.963.7096
> Mobile: [phone]
> Web: www.mcafee.com<http://www.mcafee.com/>
>
> From: "[e-mail]<mailto:[e-mail]>"<[e-mail]<mailto:[e-mail]>>
> Date: Wed, 21 Sep 2011 10:34:13 -0500
> To: "[e-mail]<mailto:[e-mail]>"<[e-mail]<mailto:[e-mail]>>
> Subject: [mile] Proposed MILE charter
>
> An updated version of the proposed charter is included below, this should be the final.  Thank you for the review and comments!
>
> Best regards,
> Kathleen
>
>
> Managed Incident Lightweight Exchange (mile)
> --------------------------------------------
>
> Proposed Working Group Charter
>
> Chairs:
>       TBD
>
> Security Area Directors:
>       Stephen Farrell<[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]<mailto:[e-mail]>>>
>       Sean Turner<[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]<mailto:[e-mail]>>>
>
> Security Area Advisor:
>       Sean Turner<[e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]<mailto:[e-mail]>>>>
>
> Mailing Lists:
>       General Discussion: [e-mail]<mailto:[e-mail]><mailto:[e-mail]<mailto:[e-mail]<mailto:[e-mail]<mailto:[e-mail]<mailto:[e-mail]<mailto:[e-mail]<mailto:[e-mail]>>>
>       To Subscribe:       http://www.ietf.org/mailman/listinfo/mile
>       Archive:            http://www.ietf.org/mail-archive/web/mile
>
> Description:
>
> The Managed Incident Lightweight Exchange (MILE) working group will
> develop standards and extensions for the purpose of improving incident
> information sharing and handling capabilities based on the work
> developed in the IETF Extended INCident Handling (INCH) working group.
> The Incident Object Description Exchange Format (IODEF) in RFC5070 and
> Real-time Inter-network Defense (RID) in RFC6045 were developed in the
> INCH working group by international Computer Security Incident Response
> Teams (CSIRTs) and industry to meet the needs of a global community
> interested in sharing, handling, and exchanging incident information.
> The extensions and guidance created by the MILE working group assists
> with the daily operations of CSIRTs at an organization, service
> provider, law enforcement, and at the country level.  The application of
> IODEF and RID to interdomain incident information cooperative exchange
> and sharing has recently expanded and the need for extensions has become
> more important. Efforts continue to deploy IODEF and RID, as well as to
> extend them to support specific use cases covering reporting and
> mitigation of current threats such as anti-phishing extensions.
>
> An incident could be a benign configuration issue, IT incident, an
> infraction to a service level agreement (SLA), a system compromise,
> socially engineered phishing attack, or a denial-of-service (DoS)
> attack, etc.  When an incident is detected, the response may include
> simply filing a report, notification to the source of the incident, a
> request to a third party for resolution/mitigation, or a request to
> locate the source.  IODEF defines a data representation that provides a
> standard format for sharing information commonly exchanged about
> computer security incidents.  RID enables the secure exchange of
> incident related information in an IODEF format providing options for
> security, privacy, and policy setting.
>
> MILE leverages collaboration and sharing experiences with the work
> developed in the INCH working group which includes the data model
> detailed in the IODEF, existing extensions to the IODEF for
> Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure
> exchange of information.  MILE will also leverage the experience gained
> in using IODEF and RID in operational contexts. Related work, drafted
> outside of INCH will also be reviewed and includes RFC5941, Sharing
> Transaction Fraud Data.
>
> The MILE working group provides coordination for these various extension
> efforts to improve the capabilities for exchanging incident information.
>    MILE has several objectives with the first being a description a
> subset of IODEF focused on ease of deployment and applicability to
> current information security data sharing use cases.  MILE also
> describes a generalization of RID for secure exchange of other
> security-relevant XML formats.  MILE produces additional guidance needed
> for the successful exchange of incident information for new use cases
> according to policy, security, and privacy requirements.  Finally, MILE
> produces a document template with guidance for defining IODEF extensions
> to be followed when producing extensions to IODEF as appropriate, for:
>
>    * labeling incident reports with data protection, data retention, and
>      other policies, regulations, and
>      laws restricting the handling of those reports
>    * referencing structured security information from within incident
>      reports
>    * reporting forensic data generated during an incident investigation
>      (computer or accounting)
>
> The WG will produce the following:
>
>    * An informational document on IODEF Guidance.
>    * A Standards Track document specifying the Real-time Inter-network
>      Defense (RID).
>    * A Standards Track document specifying the transport for RID.
>    * An informational template for extensions to IODEF.
>    * A Standards Track document for IODEF Extensions in IANA XML Registry.
>    * A Standards Track document for IODEF Extension to support
>      structured cybersecurity information.
>    * A Standards Track document for Labeling for data protection,
>      retention, policies, and regulations.
>    * A Standards Track document for GRC Report Exchange.
>    * A Standards Track document for IODEF Extension to support forensics.
>
> The drafts under consideration as WG items include:
>     * Real-time Inter-network Defense (RID) bis:
>        draft-moriarty-mile-rfc6045-bis-01
>     * Transport of Real-time Inter-network Defense (RID) Messages bis:
>        draft-trammell-mile-rfc6046-bis-00
>     * Template for extensions to IODEF:
>         draft-trammell-mile-template-01.txt
>     * IODEF Extensions in IANA XML Registry:
>         draft-trammell-mile-iodef-xmlreg-00.txt
>     * GRC Report Exchange (Generalized RID for XML reports/documents):
>         draft-moriarty-mile-grc-exchange-00.txt
>     * IODEF-extension to support structured cybersecurity information:
>         draft-takahashi-mile-sci-00.txt
>
> Milestones
>
> WGLC = Working Group Last Call
>
> 2011-11 - WGLC Real-time Inter-network Defense (RID)
> 2011-11 - WGLC Transport for Real-time Inter-network Defense (RID)
> 2011-12 - Submit Real-time Inter-network Defense (RID) to IESG for
>             consideration as Standards Track document
> 2011-12 - Submit Transport Real-time Inter-network Defense (RID) to
>             IESG for consideration as Standards Track document
> 2011-12 - WGLC Template for extensions to IODEF
> 2011-12 - WGLC IODEF Extensions in IANA XML Registry
> 2011-12 - WGLC IODEF Extension to support structured cybersecurity
>             information
> 2012-02 - Submit Template for extensions to IODEF to IESG for
>             consideration as Informational document
> 2012-02 - Submit IODEF Extensions in IANA XML Registry to IESG for
>             consideration as Standards Track document
> 2012-02 - Submit IODEF Extension to support structured cybersecurity
>             information to IESG for consideration as Standards Track
>             document
> 2012-03 - WGLC IODEF Extension Labeling for data protection, retention,
>             policies, and regulations
> 2012-03 - WGLC IODEF Guidance
> 2012-04 - Submit IODEF Extension Labeling for data protection,
>             retention, policies, and regulations to IESG for
>             consideration as Standards Track document
> 2012-04 - Submit WGLC IODEF Guidance to IESG for consideration as
>             Informational document
> 2012-05 - WGLC GRC Report Exchange
> 2012-06 - Submit GRC Report Exchange to IESG for consideration as
>             Standards Track document
> 2012-06 - WGLC Forensics extension
> 2012-07 - Submit IODEF Forensics extension to IESG for consideration as
>             Standards Track document
>
>
>
> _______________________________________________
> mile mailing list
> [e-mail]<mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/mile
>
> _______________________________________________
> mile mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mile
> .
>