IETF Proceedings

IETF-96 Proceedings

Introduction | Area, Working Goup & BoF Reports | Plenaries | Training | Internet Research Task Force

Managed Incident Lightweight Exchange (mile) (WG)

Minutes | Jabber Logs | Mailing List Archives

Additional information is available at tools.ietf.org/wg/mile

Chair(s):

Secretary

David Waltermire

Security Area Area Director(s):

Assigned Area Director

Kathleen Moriarty

Status Update (provided 2016-07-21)

MILE met at IETF 96 at 10:00 on Thursday.
There were about 45 - 50 attendees in the room and Jabber.

[working group drafts]

1. RFC5070-bis will be published as an RFC soon.

Update after the WGLC was shared during the session, and the attendee seems to very happy to publish the draft as an RFC.

2. implement draft will be published as an RFC soon.

Though no presentation was done this time, we see no problem to proceed.

3. ROLIE draft was refined so that we can pursue submission to IESG by November.

The original ROLIE draft will be divided into two documents.
One is for general information exchange purpose, while the other is for incident-response specific purposes.

4. Review was requested for xmpp-grid and guidance drafts.

The content of the drafts seem to be good, but we need more review. We have seen quite many candidate reviewers for the drafts.

[individual draft]

1. the draft on JSON binding of IODEF is considered to be an WG draft.

The attendee today seem to be happy to make it as a WG draft, but we will ask consensus on this on the mailing list.

Recordings:

Video recording for 2016-07-21 10:00

Meeting Slides:

Charter (as of 2014-03-06):

The Managed Incident Lightweight Exchange (MILE) working group develops
standards to support computer and network security incident management;
an incident is an unplanned event that occurs in an information
technology (IT) infrastructure. An incident could be a benign
configuration issue, IT incident, a system compromise, socially engineered phishing attack, or a denial-of-service (DoS) attack, etc. When an incident is
detected, or suspected, there may be a need for organizations to
collaborate. This collaboration effort may take several forms including
joint analysis, information dissemination, and/or a coordinated
operational response. Examples of the response may include filing a
report, notifying the source of the incident, requesting that a third
party resolve/mitigate the incident, sharing select indicators of
compromise, or requesting that the source be located. By sharing
indicators of compromise associated with an incident or possible threat,
the information becomes a proactive defense for others that may include
mitigation options. The Incident Object Description Exchange Format
(IODEF) defines an information framework to represent computer and
network security incidents; IODEF is defined in RFC 5070 and has been
extended by RFC 5091 to support phishing reports; RFC 6484 provides a
template for defining extensions to IODEF. Real-time Inter-network
Defense (RID) defines a protocol to facilitate sharing computer and
network security incidents; RID is defined in RFC 6545, and RID over
HTTPS is defined in RFC 6546.

The MILE WG is focused on two areas: IODEF, the data format and extensions
to represent incident and indicator data, and RID, the policy and
transport for structured data. With respect to IODEF, the working group
will:

- Revise the IODEF document to incorporate enhancements and extensions
based on operational experience. Use by Computer Security Incident
Response Teams (CSIRTs) and others has exposed the need to extend IODEF
to support industry specific extensions, use case specific content, and
representations to associate information related to represented threats
(system, threat actors, campaigns, etc.). The value of information
sharing has been demonstrated and highlighted at an increasing rate
through the success of the Information Sharing and Analysis Centers
(ISACs) and the recent cyber security Executive Order in the US.
International groups, such as the Multinational Alliance for
Collaborative Cyber Situational Awareness (CCSA) have been running
experiments to determine what data is useful to exchange between
industries and nations to effectively mitigate threats. The work of
these and other groups have identified or are working to develop data
representations relevant to their use cases that may compliment/extend
IODEF or be useful to exchange using RID and related transport protocols.

- Provide guidance on the implementation and use of IODEF to aid
implementers in developing interoperable specifications.

With respect to RID, the working group will:

- Define a resource-oriented approach to cyber security information
sharing that follows the REST architectural style. This mechanism will
allow CSIRTS to be more dynamic and agile in collaborating with a
broader, and varying constituency.

- Provide guidance on the implementation and use of RID transports based
on use cases. The guidance document will show the relationship between
transport options (RID + RID transport and IODEF/RID + ROLIE) and may
identify the need for additional transport bindings.

- RID may require modifications to address data provenance, additional
policy options, or other changes now that there are multiple
interoperable implementations of RFC6545 and RFC6546. With the RID
implementations in the open source community, increased use and
experimentation may demonstrate the need for a revision.