Subject: Re: [mile] IPR and Transfer Considerations

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 17 Aug 2012 12:03:31 -0400

David,

My apologies for not responding to this earlier.

NIST would like to submit Internet Drafts (I/Ds) for relevant NIST publications that are in scope with the MILE or SACM charters.  The NIST publications are not subject to trademark or copyright issues.    Anything NIST publishes is available in the public domain according to Title 17 of the United States Code.  We would be happy to submit disclosures for any NIST publications that would be needed to reiterate this.

To address the specification reference concern, one option would be to publish existing specifications as IETF individual contributions.  I have been told that it may be possible to publish an informational RFC based on the current specification revisions.  This provides a means to reference the initial submission while allowing the specification to evolve as well.

I look forward to working through these issues so that we can focus back on the technical work at hand.

Sincerely,
Dave

-------- Original Message --------
Subject: Re: [mile] IPR and Transfer Considerations
Date: Fri, 03 Aug 2012 22:21:05 +0000
From: David Misell <[email-masked]>
Reply-To: [email-masked]
Organization: CyberAware
To: Sean Turner <[email-masked]>
CC: Baker, Jon <[email-masked]>, [email-masked] <[email-masked]>, [email-masked]

Sean,

I had an in depth conversation following the confernce call at which I reasied someof these issues.

To be frank the MITRE IPR is a marketing campaign supporting the following branded Terms fromthe CPE web site cpe.mitre.org;as withnessed at various secuirty inductry event since 2009.

Going forward volunteer sector, IETF and OWASP, BCS and IET will all have similar works in progress, also potentially in support of NIST 800 best practise recommendations.

If we are to progress this, the best format may be to adopt creative commons, rename and avoid the following branded terms, unless they can be in some way opened  to more than "free for  public use", which would allow US enforcement of IPR in a unilateral way, as is currently being legistalted for.

for example how would I be able to train CVE terms mirroed to NIST 800 series best practice without paying MITRE a royalty.

Configurations (CCE)

Vulnerabilities (CVE)

Software Weakness Types (CWE)

Attack Patterns (CAPEC)

Cyber Observables (CybOX)

Log Format (CEE)

Software ID Tags (SWIDs)

Malware (MAEC)

Checklist Language (XCCDF)

Assessment Language (OVAL)

Security Content Automation (SCAP)

Making Security Measurable

What assurance can you give tha no IPR protection will be exerted at any point in the future on behalf of MITRE by US government, how can we assure a creative commons style approach.

Yours Faithfully,

Dave

David S Misell MSc (Information Security RHUL) MBCS CISSP

On Fri, 2012-08-03 at 11:11 -0700, Sean Turner wrote:
> On 8/3/12 8:27 AM, Baker, Jon wrote:
> > During the MILE WG session there were questions raised related to MITRE IPR. I would like to make sure that the list is aware that MITRE has accommodated all IPR related requests that have been made by this group. There are three issues that have been raised:
> >
> > 1- Shortly before the Paris meeting (IETF 83) a concern was raised about the wording in the disclaimer portion of our terms of use pages not aligning well with the wording that that IETF uses. At that time we made a small change to the disclaimer for all the relevant efforts we support. To the best of my knowledge, this issue was addressed.
> >
> > 2- At the Paris meeting it was clear that there was confusion about the licensing of CVE and several other efforts. I was asked, "How much does CVE cost?" This too has been addressed. CVE and these other efforts are clearly free to use.
> >
> > 3- Lastly, during the MILE WG session Tuesday of this week, it was made clear that MITRE needs to post IPR disclosures for all of the relevant efforts that MITRE supports. As of August 2, 2012 IPR disclosures have been submitted. I don't think they have been posted by the IETF yet.
>
> I checked with the secretariat and they've been submitted.  Thanks.
>
> > Are there other IPR concerns that we are not aware of?
>
> This is hard to answer without having seen the disclosure.
>
> MILE WG: When they're posted review them.
>
> spt
>
> > There were also questions raised about MITRE's willingness to transfer IPR to the IETF. I attended the Paris meeting (IETF 83) and during the SACM side meeting was given the opportunity to discuss MITRE's perspective on this topic. At the time I talked through what MITRE sees as the key distinctions to be made when considering transferring a given effort to any other organization. As a reminder I discussed the following:
> >
> > REGISTRIES VS. LANGUAGES
> > ----------------------------------
> > Roughly speaking, efforts can be grouped into two primary categories: registries of named objects (e.g. CVE) and languages for defining structured content (e.g. OVAL). As a rule, languages are good candidates to go to formal standards bodies as they mature. In contrast, while registries may be referred to by the work developed in standards bodies as external dependencies; standards bodies do not typically operate registries.
> >
> > EFFORTS HAVE MULTIPLE SUBCOMPONENTS
> > ------------------------------------------------------
> > Registries tend to have three primary sub-components, including:
> >       i) the syntax of the namespace,
> >       ii) the registry of officially recognized objects and
> >       iii) definitions of acceptable use (which may include product testing requirements).
> > Languages tend to have four primary sub-components, including:
> >       i) the specification of the language,
> >       ii) repositories of content written in that language,
> >       iii) a reference implementation that can be used to verify both the language and content authored in the language and
> >       iv) definitions of acceptable use (which may include product testing requirements).
> > These components need to be considered separately.
> >
> > USG EFFORTS VS. MITRE MANAGED EFFORTS
> > -------------------------------------------------------
> > In considering the transition of MITRE efforts to standards bodies and how these decisions will be made, it is important to clearly distinguish between US Government (USG) efforts and efforts that our sponsors have directed MITRE to operate as a neutral 3rd party under our FFRDC charter.
> >
> >
> > As you might imagine this leads to a sort of matrix that must be considered to ultimately ensure that a successful and appropriate transition is made for any given effort. Outside the MILE and SACM lists there are many organizations that depend upon the efforts that MITRE has led for many years, in some cases it is several hundred or more. In fact, it is hard to imagine an INFOSEC professional in the US that has not used CVE (either directly or indirectly)  in their career and CVE is translations are available in many other languages too. MITRE has a responsibility to ensure the stability of these efforts and not lose sight of the community that depends upon them today.
> >
> > Rest assured that MITRE and our sponsors view successful transfer of standards to international bodies as the ultimate goal of much of our standards work. MITRE is actively following the MILE and SACM lists, has raised awareness of the relevant IETF activities in the existing standards related forums that we host, and is actively engaging with our sponsors on the topic of international standards.
> >
> > Thanks,
> >
> > Jon
> >
> > ============================================
> > Jonathan O. Baker
> > G022 - IA Industry Collaboration
> > The MITRE Corporation
> > Email: [email-masked]
> >
> >
> > _______________________________________________
> > mile mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/mile
> >
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

--
Kind Regards,
dave
David S. Misell,
07710380044