[OPSEC]Re: [Technical Errata Reported] RFC9424 (7964)

James Sellwood <james.sellwood.ietf@gmail.com> Tue, 04 June 2024 17:20 UTC

Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: James Sellwood <james.sellwood.ietf@gmail.com>
Mime-Version: 1.0 (1.0)
Date: Tue, 04 Jun 2024 18:20:18 +0100
Message-Id: <9B85F9BF-A634-438F-85EC-192FC5F64BFA@gmail.com>
References: <LO0P123MB4843EA81FEC5AB64B689BFA6E3F82@LO0P123MB4843.GBRP123.PROD.OUTLOOK.COM>
In-Reply-To: <LO0P123MB4843EA81FEC5AB64B689BFA6E3F82@LO0P123MB4843.GBRP123.PROD.OUTLOOK.COM>
To: Andrew S2 <andrew.s2@ncsc.gov.uk>
Message-ID-Hash: SOQQ3VCF6TRIC3YZN3VPFNBQSISD3UY5
CC: RFC Errata System <rfc-editor@rfc-editor.org>, ollie@binaryfirefly.com, warren@kumari.net, mjethanandani@gmail.com, opsec@ietf.org
Precedence: list
Subject: [OPSEC]Re: [Technical Errata Reported] RFC9424 (7964)
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsec/95ab-esjJSLlx_QpnjUR2zLYSp4>

Good spot Andy. I agree those are the wrong way around.

James

.

On 4 Jun 2024, at 11:12, Andrew S2 <andrew.s2@ncsc.gov.uk> wrote:

As both an author of the document and the reporter of this errata, I believe that this report should be verified.

Thanks,
Andy

-----Original Message-----
From: RFC Errata System <rfc-editor@rfc-editor.org>
Sent: Thursday, May 30, 2024 10:09 AM
To: kirsty.ietf@gmail.com; ollie@binaryfirefly.com; james.sellwood.ietf@gmail.com; Andrew S2 <andrew.s2@ncsc.gov.uk>; warren@kumari.net; mjethanandani@gmail.com; furry13@gmail.com; rbonica@juniper.net
Cc: Andrew S2 <andrew.s2@ncsc.gov.uk>; opsec@ietf.org; rfc-editor@rfc-editor.org
Subject: [Technical Errata Reported] RFC9424 (7964)

The following errata report has been submitted for RFC9424, "Indicators of Compromise (IoCs) and Their Role in Attack Defence".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7964

--------------------------------------
Type: Technical
Reported by: Andrew Shaw <andrew.s2@ncsc.gov.uk>

Section: 3.2.3

Original Text
-------------
At its simplest, this indicates that
  the receiver may share with anyone (TLP:CLEAR), share within the
  defined sharing community (TLP:GREEN), share within their
  organisation and their clients (TLP:AMBER+STRICT), share just within
  their organisation (TLP:AMBER), or not share with anyone outside the
  original specific IoC exchange (TLP:RED).


Corrected Text
--------------
At its simplest, this indicates that
  the receiver may share with anyone (TLP:CLEAR), share within the
  defined sharing community (TLP:GREEN), share within their
  organisation and their clients (TLP:AMBER), share just within
  their organisation (TLP:AMBER+STRICT), or not share with anyone
  outside the original specific IoC exchange (TLP:RED).


Notes
-----
The definitions of TLP:AMBER and TLP:AMBER+STRICT are the wrong way round in the original text.

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it will be removed shortly by the RFC Production Center.) Please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC9424 (draft-ietf-opsec-indicators-of-compromise-04)
--------------------------------------
Title               : Indicators of Compromise (IoCs) and Their Role in Attack Defence
Publication Date    : August 2023
Author(s)           : K. Paine, O. Whitehouse, J. Sellwood, A. Shaw
Category            : INFORMATIONAL
Source              : Operational Security Capabilities for IP Network Infrastructure
Stream              : IETF
Verifying Party     : IESG

[OPSEC][Technical Errata Reported] RFC9424 (7964) RFC Errata System
[OPSEC]Re: [Technical Errata Reported] RFC9424 (7… Andrew S2
[OPSEC]Re: [Technical Errata Reported] RFC9424 (7… James Sellwood
[OPSEC]Re: [Technical Errata Reported] RFC9424 (7… Warren Kumari