Subject: WG Action: Extended Incident Handling (inch)

From: The IESG <[email-masked]>
Date: Fri, 16 Aug 2002 14:35:09 -0400

A new working group has been formed in the Security Area of the IETF.
For additional information, contact the Area Directors
or the WG Chair.

Extended Incident Handling (inch)
---------------------------------

áCharter
áLast Modified: 2002-07-23

áCurrent Status: Active Proposed Working Group

áChair(s):
áááá Roman Danyliwá <[email-masked]>

áSecurity Area Director(s):
áááá Jeffrey Schillerá <[email-masked]>
áááá Steve Belloviná <[email-masked]>

áSecurity Area Advisor:
áááá Jeffrey Schillerá <[email-masked]>

áMailing Lists: 
áááá General Discussion:[email-masked]
áááá To Subscribe:ááááá [email-masked]
áááááááá In Body:áááááá subscribe inch <first name> <last name>
áááá Archive:áááááááááá http://listserv.surfnet.nl/archives/inch.html

Description of Working Group:

Background

Computer security incidents occur across administrative domains often
spanning different organizations and national borders. Therefore, the
free exchange of incident information and statistics among involved
parties and the responsible Computer Security Incident Response Teams
(CSIRTs) is crucial for both reactionary analysis of current intruder
activity and proactive identification of trends that can lead to
incident prevention.

There is a substantial amount of related work in this domain in
TERENA's TF-CSIRT IODEF working group. The IODEF WG has already defined 
a set of requirements for exchanging incident information in RFC 3067: 
"TERENA'sá Incident Object Description and Exchange Format
Requirements" and proposed a data format implementing them in the 
"Incident Object Description and Exchange Format Data Model and 
Extensible Markup Language (XML) Document Type Definition"
(http://www.terena.nl/task-forces/tf-csirt/iodef/).

Scope

The purpose of the Incident Handling (inch) working group is to define
data formats for communication between

* a CSIRT and its constituency (e.g., users, customers, trusted
á reporters) which reports system misuse;

* a CSIRT and parties involved in an incident investigation (e.g., law
á enforcement, attacking site); and

* collaborating CSIRTs sharing information.

This format will support the now largely human-intensive dimension of
the incident handling process. It will represent the product of various
incremental data gathering and analysis operations performed by a CSIRT
from the time when the system misuse was initially reported (perhaps by
an automated system) till ultimate resolution. Specifically, the
working group will address the issues related to representing

* the source(s) and target(s) of system misuse, as well as the
á analysis of their behavior;

* the evidence to support any analysis results;

* a scheme to document the incident investigation and analysis
á process; and

* constructs to facilitate the exchange of security information
á across administrative domains (e.g., internationalization, data
á sensitivity).

The WG will investigate the information model needed to support the
typical, operational workflow of the incident handling processes found
at Internet Service Providers; Managed Security Service Providers; Risk
Analysis vendors; and traditional, internal CSIRTs.

Constraints

The WG will not attempt to

- define an incident or address the implications of sharing incident
á data across administrative domains;

- define a format for computer security related information for which
á there is already a standard, but where applicable, provide full
á compatibility (e.g. IDWG's IDMEF, Mitre's CVE); or

- define a protocol for exchanging the incident information.

Output of Working Group

1. A document describing the high-level functional requirements of a
áá data format for collaboration between CSIRTs and parties involved
áá when handling computer security incidents.

2. A specification of the extensible, incident data language that
áá describes the data formats that satisfy the requirements.

3. Guidelines for implementing the WG data format (Output #2 of the
áá WG).

4. A set of sample incident reports and their associate representation
áá in the incident data language.

áGoals and Milestones:

áá SEP 02áááááá Initial I-D of the implementation guidelines and examples 
ááááááááááááááá document 

áá DEC 02áááááá Initial I-D of the requirements specification 

áá DEC 02áááááá Submit requirements I-D to the IESG as Informational 

áá DEC 02áááááá Submit incident data language specification I-D to the IESG 
ááááááááááááááá as Proposed 

áá JAN 03áááááá Submit implementation guidelines I-D to the IESG as 
ááááááááááááááá Informational