[scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation

[Tony Rutkowski <[e-mail]>]

  Dear all,

At the ITU-T cybersecurity standards group (Q4/17)
interim meeting in Tokyo last week, the participants
noted the new effort to introduce into the IETF some of
the systems assurance standards under the general aegis
the SCAP BOF and this interest list.

An effort leveraging the same concepts and underlying
standardization work was started within the ITU-T last
year among an array of industry and government
participants and organizations for outlining ways of
sharing and exchanging structured information, that is
called the Cybersecurity Information Exchange Framework
or CYBEX for short.  CYBEX identified the entire array
of information assurance, incident response, forensics
and trust specifications - most of which were in use or
under development in the respective communities - as
part of this Framework.   The CYBEX framework is
scheduled for approval as as Recommendation ITU-T
X.1500, together with CVE and CVSS as X.1520 and X.1521
respectively.  Many others are in various stages of
maturity.  The editors of X.1500 include US DHS,
Japan's NICT, MITRE, Microsoft, FIRST, Cisco, and Yaana
Technologies.

Part of that framework of course includes the use of
security automation schemas such as SCAP as a means
to facilitate systems, services, devices of all kinds
to make them "measurably" secure as to potential
vulnerabilities and threats.  The U.S. federal
system implementation of SCAP is included as an
example in the X.1500 appendix, as is a similar
implementation in Japan known as JVN.

The vision includes the potential development, use, and
evolution of innumerable numbers of public and private
security automation schemas for innumerable systems,
services, and devices - similar in many ways to the
deployment of network management MIBs over the past 25
years.  The IETF is one of many standards bodies that
should be developing security content automation schemas,
and the BOF list plus a scheduled event at the upcoming
Beijing IETF meeting next month is an important step in
that direction.

This development was discussed at some length at the
Tokyo Interim Meeting and there was significant
enthusiasm for working with IETF (and many other
standards bodies) in developing these implementations
for their standards based protocols and services.
Also demonstrated in Tokyo was the rather remarkable
work demonstrated by the Japan network security
community of a RDF-based discovery mechanism for CYBEX
should be an essential mechanism for enabling use of
all the many distributed instances of security
automation schema.  The platform is part of a CYBEX
discovery specification designated X.cybex-discovery.
In addition, an entire new OID Arc 2.48 has been
allocated for cybersecurity information exchange
structured identity purposes.

Dr. Takehashi of NICT, as well as Q4/17 associate
rapporteur Dr. Kadobayashi of NAIST, who have been
developing CYBEX related concepts, tools, and
implementations within Japan's ICT security
community, will be present in Beijing for the IETF
meeting, and we hope can contribute to the SCAP BOF.

An introduction to CYBEX is attached that was presented
last week to the Japan ICT security technical community
hosted by ISOG-J prior to the ITU-T Interim Meeting.

--tony rutkowski, ITU-T Q.4/17 (cybersecurity) Rapporteur