[scap_interest] Report on the SG17 Geneva meeting concluded last week

[Tony Rutkowski <[e-mail]>]

Dear All,

Last Friday, the ITU-T Study Group 17 Plenary
formally approved for balloting, an ensemble
of SCAP related standards that include:

   X.1500, Cybersecurity Information Exchange Techniques
   X.1520, Common vulnerabilities and exposures (CVE)
   X.1521, Common vulnerability scoring system (CVSS)
   X.1261, Extended validation certificate framework

The approval was unanimous among all the many
national and industry representatives.  The
Recommendations now will be translated into
five other languages and sent to 191 countries
who seem likely to add their approval for final
adoption in April.  In the process, we will
have the first definitive compendium of
multilingual terms for cybersecurity information
exchange.

The X.1500, known as CYBEX, now involves a
broad array of different organizations as was
evident from the CYBEX workshop session (5.1)
preceding the SG17 meeting and the presentations
are downloadable.  See
http://www.itu.int/ITU-T/worksem/security/201012/programme.html

The attached tutorial was presented during a
special session last Wednesday, that among
other things describes applying SCAP to arbitrary
Future Networks.

X.1500 is attached, as well as the planned
array of SCAP related standards.  All of these
are destined for a dedicated series of standards:

Subject	                             Recommendation Series
----------------------------------------------------------
Cybersecurity Information Exchange      X.1500-X.1599
  Weakness/vulnerability/state exchange  X.1520-X.1539
  Event/incident/heuristics exchange     X.1540-X.1549
  Information exchange policy            X.1550-X.1559
  Heuristics and information request     X.1560-X.1569
  Identification, discovery and query    X.1570-X.1579
  Assured exchange                       X.1580-X.1589
  [Reserved]                             X.1590-X.1599

best,
tony (Q4/17 Rapporteur)

ps. There were two other developments of
note.  Steps were begun to implement the
special academic institution membership
category.  Also approved was a new work
item for trusted availability of network
security standards and related objects.