Subject: [mile] VERIS

From: Luis Nunez <[email-masked]>
Date: Wed, 1 Aug 2012 11:11:28 -0400

Anyone familiar with Vocabulary for Event Recording and Incident Sharing (VERIS)?  Is this something that competes with MILE? or does it complement, cooperate with existing efforts?

Information sharing issues are on the rise and I would like to make sure we are aware of the various efforts under way.  We want to as a community avoid duplication.

http://securityblog.verizonbusiness.com/2012/08/01/announcing-veriscommunity-net/

thanks.

-ln

---

From: Kyle Maxwell <[email-masked]>
Date: Wed, 1 Aug 2012 10:25:25 -0500

I'm on the VERIS team here at Verizon, so I can help answer any specific
questions you might have. In a general sense, I don't believe VERIS and
MILE really compete but are complementary to each other.

On Wed, Aug 1, 2012 at 10:11 AM, Luis Nunez <[email-masked]> wrote:

> Anyone familiar with Vocabulary for Event Recording and Incident Sharing
> (VERIS)?  Is this something that competes with MILE? or does it complement,
> cooperate with existing efforts?
>
> Information sharing issues are on the rise and I would like to make sure
> we are aware of the various efforts under way.  We want to as a community
> avoid duplication.
>
>
> --
> Kyle Maxwell [<http://securityblog.verizonbusiness.com/2012/08/01/announcing-veriscommunity-net/>
> [email-masked]]
> http://www.xwell.org
> Twitter: @kylemaxwell
>
>

---

From: "Omar Santos (osantos)" <[email-masked]>
Date: Wed, 1 Aug 2012 15:43:34 +0000

Hi Kyle,

Thank you! I was going over the documentation (at the link below) and the case studies / other collateral material; and I do see a little overlap with SACM:

http://veriscommunity.net/doku.php

If the community is interested, would you mind giving a brief overview of VERIS in a few weeks? I can setup a Webex and record the session for those of you that cannot make it...

Regards,

Omar Santos
Incident Manager, PSIRT
Security Research and Operations
Cisco Systems, Inc.
Email: [email-masked]
Phone: +1 919 392 8635
PGP Key: 0x3AF27EDC

Cisco.com - http://www.cisco.com <http://www.cisco.com/>
Cisco Security Advisories and Notices - http://www.cisco.com/go/psirt

From: [email-masked] [mailto:[email-masked]] On Behalf Of Kyle Maxwell
Sent: Wednesday, August 01, 2012 11:25 AM
To: Luis Nunez
Cc: [email-masked]; [email-masked]
Subject: Re: [mile] VERIS

I'm on the VERIS team here at Verizon, so I can help answer any specific questions you might have. In a general sense, I don't believe VERIS and MILE really compete but are complementary to each other.
On Wed, Aug 1, 2012 at 10:11 AM, Luis Nunez <[email-masked]<mailto:[email-masked]>> wrote:
Anyone familiar with Vocabulary for Event Recording and Incident Sharing (VERIS)?  Is this something that competes with MILE? or does it complement, cooperate with existing efforts?

<http://securityblog.verizonbusiness.com/2012/08/01/announcing-veriscommunity-net/>
--
Kyle Maxwell [<http://securityblog.verizonbusiness.com/2012/08/01/announcing-veriscommunity-net/>[email-masked]<mailto:[email-masked]>]
http://www.xwell.org
Twitter: @kylemaxwell

---

From: Luis Nunez <[email-masked]>
Date: Wed, 1 Aug 2012 11:45:22 -0400

Hi Kyle,
thanks for the info and offer to field questions.  Maybe at some point it would worth while to see the connections and relationships of VERIS and MILE.  Some of the things we as a community grapple with is how the various frameworks/specifications interact and work together.

thanks.

-ln
On Aug 1, 2012, at 11:25 AM, Kyle Maxwell wrote:

> Kyle Maxwell [[email-masked]]
> http://www.xwell.org
> Twitter: @kylemaxwell
>

---

From: <[email-masked]>
Date: Wed, 1 Aug 2012 11:43:21 -0400

Hi Luis,

Veris actually compliments the work in MILE.  They have done some really good work and would great to see some of their lessons learned benefit the MILE work (if/where possible).  I think we have a few people on list from Verizon following the work.  Their input would be very helpful in the update to RFC5070 as well as if they think we need to extend to hit other important use cases.

There are a number of complimentary efforts that would be very nice to see come together so that we could have a consistent way to share and communicate incident information, learning from all of the hands-on experience.  We hit on this a little yesterday where we need to figure out if we include some additional high-level information in IODEF (the example was for malware) is needed and then we point to more detailed information.  We do want to target relevant use cases of data that people share who would be using this work.  Veris may have some other areas that could be very useful.  The hurdle with any proprietary format is the same that we ran into with the MITRE work, we need to be able to have normative references and be clear on IP concerns.  If work is brought into the IETF, that makes it clear and would be easier to unify the solutions.  This will be up to the other organizations and if they are interested in bringing the work into MILE.

We do want to make sure that we map back to use cases as we extend IODEF to ensure we are creating work that will be useful to the community (share the right things).  The VERIS work has put a lot of thought into this for their customers as I am sure the other vendor formats have as well.

Other related spaces where work has been done include malware (Mandiant's OpenIOC) and forensics (x.dexf from Korea and also work from Google, AFF).  The work from Korea transferred the IP, so we can build on that.  Hopefully, we can help the community by combining efforts using open standards enabling vendors to implement interoperable solutions.

Thanks,
Kathleen

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Luis Nunez [[email-masked]]
Sent: Wednesday, August 01, 2012 11:11 AM
To: [email-masked]; [email-masked]
Subject: [sacm] VERIS

thanks.

-ln
_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: <[email-masked]>
Date: Wed, 1 Aug 2012 11:46:29 -0400

We could also add a spot on the agenda for the next meeting as well.  That will be a few months out in Atlanta (as we are meeting now in Vancouver and had the MILE session last night).  A webex is a great idea as well.

Thank you!
Kathleen
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Luis Nunez [[email-masked]]
Sent: Wednesday, August 01, 2012 11:45 AM
To: Kyle Maxwell
Cc: [email-masked]; [email-masked]
Subject: Re: [mile] VERIS

Hi Kyle,

thanks.

-ln

--
Kyle Maxwell [[email-masked]<mailto:[email-masked]>]
http://www.xwell.org<http://www.xwell.org/>
Twitter: @kylemaxwell