Subject: [domainrep] Industry Taxonomy (Tentative requirements list)

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Tue, 31 Aug 2010 00:25:12 +0200

Hi,

there has been proposed (in general) two sorts of taxonomy: an Industry 
Taxonomy and a Threat Taxonomy. This message tries to summarize what's 
been said about Industry Taxonomy.

Industry taxonomy:

    * represents category of business
    * various registries proposed:
      - use NAICS (North America)
      - use ISIC (UN)
      - use Eurostat
      - use IANA registry
    * suggestion for categories 'unknown' and 'known malicious'
    * a code zero would mean don't know
    * for scalar reputation scoring, the value I would consider "Good"
      or "Bad" is different depending on the type of entity.  "Good" for
      a free webmail provider might well be "Bad" for a bank.
    * not a mandatory part of the reputation answer; it's optional
    * include a mechanism to identify which registry is used (naics,
      isic etc. )
    * "I think it should be as small as possible (but no smaller)"
    * Add WHOIS information (or define otherwise)?

Pro's

    * pro of IANA: not NA centric
    * pro of NAICS: complete set, can be used

Con's:

    * if organisation type is sent back, then why not any other element
      of the secret sauce? Seems like a slippery slope.
    * NAICS is NA-centric
    * ISIC is not as rich as NAICS
    * NAICS and ISIC (and probably Eurostat) can't describe every
      subcategory on earth
    * the nature of traffic from a domain could fit into several categories
    * do we really need it?

Questions:

    * What NAICS like number will scorekeeper.example use for domains
      lacking ownership details?
    * What prohibits bad actors from masquerading as legitimate entities?

As usual, some of these sentences were just copy-and-paste'd. And I've 
tried to stay away from judgments and biased reading.

/rolf