[OPSEC]Re: [Technical Errata Reported] RFC9424 (7964)

[Warren Kumari <[e-mail]>]

Doh!

As someone who has had many many long discussions (and also participated in
the FIRST TLP SIG - https://www.first.org/tlp/ ) I really should have
caught that during review.

Sorry, and I've marked it as VERIFIED.
W


On Tue, Jun 04, 2024 at 1:20 PM, James Sellwood <
[e-mail]> wrote:

> Good spot Andy. I agree those are the wrong way around.
>
> James
>
> .
>
> On 4 Jun 2024, at 11:12, Andrew S2 <[e-mail]> wrote:
>
> As both an author of the document and the reporter of this errata, I
> believe that this report should be verified.
>
> Thanks,
> Andy
>
> -----Original Message-----
> From: RFC Errata System <[e-mail]> Sent: Thursday, May
> 30, 2024 10:09 AM
> To: [e-mail]; [e-mail]; james.sellwood.ietf@
> gmail.com; Andrew S2 <[e-mail]>; [e-mail];
> [e-mail]; [e-mail]; [e-mail] Cc:
> Andrew S2 <[e-mail]>; [e-mail]; rfc-editor@rfc-editor.
> org Subject: [Technical Errata Reported] RFC9424 (7964)
>
> The following errata report has been submitted for RFC9424, "Indicators of
> Compromise (IoCs) and Their Role in Attack Defence".
>
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid7964
>
> --------------------------------------
> Type: Technical
> Reported by: Andrew Shaw <[e-mail]>
>
> Section: 3.2.3
>
> Original Text
> -------------
> At its simplest, this indicates that
> the receiver may share with anyone (TLP:CLEAR), share within the defined
> sharing community (TLP:GREEN), share within their organisation and their
> clients (TLP:AMBER+STRICT), share just within their organisation
> (TLP:AMBER), or not share with anyone outside the original specific IoC
> exchange (TLP:RED).
>
> Corrected Text
> --------------
> At its simplest, this indicates that
> the receiver may share with anyone (TLP:CLEAR), share within the defined
> sharing community (TLP:GREEN), share within their organisation and their
> clients (TLP:AMBER), share just within their organisation
> (TLP:AMBER+STRICT), or not share with anyone outside the original specific
> IoC exchange (TLP:RED).
>
> Notes
> -----
> The definitions of TLP:AMBER and TLP:AMBER+STRICT are the wrong way round
> in the original text.
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". (If it is spam, it will be
> removed shortly by the RFC Production Center.) Please use "Reply All" to
> discuss whether it should be verified or rejected. When a decision is
> reached, the verifying party will log in to change the status and edit the
> report, if necessary.
>
> --------------------------------------
> RFC9424 (draft-ietf-opsec-indicators-of-compromise-04)
> --------------------------------------
> Title : Indicators of Compromise (IoCs) and Their Role in Attack Defence
> Publication Date : August 2023
> Author(s) : K. Paine, O. Whitehouse, J. Sellwood, A. Shaw Category :
> INFORMATIONAL
> Source : Operational Security Capabilities for IP Network Infrastructure
> Stream : IETF
> Verifying Party : IESG
>