Re: [scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation

[Tony Rutkowski <[e-mail]>]

  Hi Michael,

> I am trying to wrap my head around the CYBEX standard. Is this 
> standard creating new standards that replace existing SCAP standards ? 
> Or is this standard using existing SCAP standards as it's core? Or 
> does this standard simply not care what standard is being used at it's 
> core, as long as its a standard? How does the CYBEX standard impact 
> the SCAP interest list and SCAP's future with the IETF?

First, the CYBEX work is not trying to replace anything!
It's attempting to establish a rough global consensus on
1) a comprehensive, coherent conceptualization of
cybersecurity, and 2) an interoperable, extensible set
of related structured information exchange and associated
discovery and trust specifications

Second, we found over the past year that the term "SCAP
standards" was used very differently in diverse forums
and seems to constantly evolve.   So our ITU-T group chose
to refer to these various usages as "security automation"
schema use cases or tools, and we've begun to avoid
using SCAP.  This also avoids any conflicts with NIST's
SCAP implementation(s) for US federal networks and systems.

In addition, CYBEX clearly encompasses much more than
just security automation.

If one assumes that the SCAP interest list and the resulting
IETF work involves potential application of the various
MITRE/CNIS/FIRST specifications to implementations of IETF
protocols, there is mutual interest in adopting common
conceptualizations and approaches to the extent desired.

There is also value in looking at how other bodies and
user communities are innovating with and implementing
these specifications.  The Japan ISOG-J/NICT example
is a notable one.  Trusted discovery of all the autonomous,
diverse security automation schema is a major emerging
challenge they are especially focussing on.

For reference purposes, it's also useful to know that those
specifications are also being instantiated in ITU-T versions
that will be available in six languages, freely available
online, and evangelized for global cybersecurity use.

Hope this helps.

--tony