Subject: [mile] Consensus Call - SCI draft MMDEF as MTI

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 13 Mar 2013 15:04:29 -0400

Hello,

In today's MILE session, a call for consensus began to include MMDEF in the SCI draft as the mandatory-to-implement (MTI) specification.  The call for consensus will last for 2 weeks and we ask that you contribute your opinion.  The vote in the room was unanimous and we want to make sure we hear from participants not in attendance.

Poll will end on Wednesday next week.

Thank you!
Kathleen

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 13 Mar 2013 15:06:10 -0400

Yes.

On 3/13/2013 3:04 PM, Moriarty, Kathleen wrote:
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Thu, 14 Mar 2013 13:59:59 +0000

I agree with MMDEF included in SCI.
I am not sure why it must be MTI. Due to some audio problems I missed part of the call yesterday. Can you briefly summarize why we want it MTI?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Wednesday, March 13, 2013 3:04 PM
To: [email-masked]
Subject: [mile] Consensus Call - SCI draft MMDEF as MTI

Hello,

Thank you!
Kathleen

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Thu, 14 Mar 2013 10:38:10 -0400

Hello Panos,

Thank you for joining us remotely!  The recording is available for those who were not able to attend during the session.

We need to choose one included schema as MTI for 'black box' testing of the method described.  Essentially, if you can exchange using the MTI spec, then any other specs supported should theoretically work as the pattern has been established.

MMDEF was recommended as it is in use by the eCrime WG as an extension to IODEF/RFC5901.  It replaced the method to include malware in exchanges and seemed to make sense to adopt more broadly as it is maintained by a group in IEEE focused on that particular problem.

BTW, I meant to say the last call will end in two weeks from yesterday, Wednesday March 27th.

Thank you!
Kathleen
________________________________________
From: Panos Kampanakis (pkampana) [[email-masked]]
Sent: Thursday, March 14, 2013 9:59 AM
To: Moriarty, Kathleen; [email-masked]
Subject: RE: Consensus Call - SCI draft MMDEF as MTI

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Wednesday, March 13, 2013 3:04 PM
To: [email-masked]
Subject: [mile] Consensus Call - SCI draft MMDEF as MTI

Hello,

Thank you!
Kathleen

---

From: "Black, David" <[email-masked]>
Date: Thu, 14 Mar 2013 10:53:43 -0400

I support MMDEF as the MTI, and since MMDEF is a malware spec, I'd like
to resurrect a previously-discussed suggestion that the SCI draft include
discussion of the "EICAR Standard Anti-Virus Test File" as a specific
example that SHOULD (or MUST?) be supported for black-box testing purposes.

See: http://www.eicar.org/86-0-Intended-use.html

Thanks,
--David

> Sent: Thursday, March 14, 2013 10:38 AM
> To: Panos Kampanakis (pkampana); [email-masked]
> Subject: Re: [mile] Consensus Call - SCI draft MMDEF as MTI
> 
> Hello Panos,
> 
> Thank you for joining us remotely!  The recording is available for those who
> were not able to attend during the session.
> 
> We need to choose one included schema as MTI for 'black box' testing of the
> method described.  Essentially, if you can exchange using the MTI spec, then
> any other specs supported should theoretically work as the pattern has been
> established.
> 
> MMDEF was recommended as it is in use by the eCrime WG as an extension to
> IODEF/RFC5901.  It replaced the method to include malware in exchanges and
> seemed to make sense to adopt more broadly as it is maintained by a group in
> IEEE focused on that particular problem.
> 
> I am not sure why it must be MTI. Due to some audio problems I missed part of
> the call yesterday. Can you briefly summarize why we want it MTI?
> 
> In today's MILE session, a call for consensus began to include MMDEF in the
> SCI draft as the mandatory-to-implement (MTI) specification.  The call for
> consensus will last for 2 weeks and we ask that you contribute your opinion.
> The vote in the room was unanimous and we want to make sure we hear from
> participants not in attendance.
>

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Thu, 14 Mar 2013 15:28:08 +0000

Makes sense.  I thought that CVE was MTI in the SCI draft. At least that is my recollection from previous descussions.
But I agree with MMDEF being the MTI also.
Rgs,
Panos

-----Original Message-----
From: Moriarty, Kathleen [mailto:[email-masked]] 
Sent: Thursday, March 14, 2013 10:38 AM
To: Panos Kampanakis (pkampana); [email-masked]
Subject: RE: Consensus Call - SCI draft MMDEF as MTI

Hello Panos,

Thank you!
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Moriarty, Kathleen
Sent: Wednesday, March 13, 2013 3:04 PM
To: [email-masked]
Subject: [mile] Consensus Call - SCI draft MMDEF as MTI

Hello,

Thank you!
Kathleen

---

From: "Takeshi Takahashi" <[email-masked]>
Date: Sat, 23 Mar 2013 17:16:56 +0900

Hi all,

I remember the discussion on the EICAR and agree upon David's kind
suggestion.
The attached is the revised SCI draft, whose section 10 talks about the
EICAR (with an example XML).

Kind regards,
Take

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Black, David
> Sent: Thursday, March 14, 2013 11:54 PM
> I support MMDEF as the MTI, and since MMDEF is a malware spec, I'd like to
> resurrect a previously-discussed suggestion that the SCI draft include
example
> that SHOULD (or MUST?) be supported for black-box testing purposes.
> 
> > Thank you for joining us remotely!  The recording is available for
> > those who were not able to attend during the session.
> >
> > We need to choose one included schema as MTI for 'black box' testing
> > of the method described.  Essentially, if you can exchange using the
> > MTI spec, then any other specs supported should theoretically work as
> > the pattern has been established.
> >
> > MMDEF was recommended as it is in use by the eCrime WG as an
> extension
> > to IODEF/RFC5901.  It replaced the method to include malware in
> > exchanges and seemed to make sense to adopt more broadly as it is
> > maintained by a group in IEEE focused on that particular problem.
> >
> > I am not sure why it must be MTI. Due to some audio problems I missed
> > part of the call yesterday. Can you briefly summarize why we want it
MTI?
> > In today's MILE session, a call for consensus began to include MMDEF
> > in the SCI draft as the mandatory-to-implement (MTI) specification.
> > The call for consensus will last for 2 weeks and we ask that you
contribute
> your opinion.
> > The vote in the room was unanimous and we want to make sure we hear
> > from participants not in attendance.
> >

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 27 Mar 2013 20:59:20 -0400

Hello,

Thank you for voicing your opinions at the MILE meeting, the two week period is up and we have full agreement.  We will move forward with MMDEF as the MTI for the SCI draft.

Take - Thank you for updating the draft to include MMDEF as the MTI as well as the update below.  Could you expand the acronym for MTI in the draft and update the version to the latest?

Bets regards,
Kathleen 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Takeshi Takahashi
Sent: Saturday, March 23, 2013 4:17 AM
To: [email-masked]
Subject: Re: [mile] Consensus Call - SCI draft MMDEF as MTI

Hi all,

Kind regards,
Take

example
MTI?
contribute

---

From: Eric Burger <[email-masked]>
Date: Wed, 27 Mar 2013 22:25:48 -0400

Did we ever find a stable reference for MMDEF?

---

From: "Martin, Robert A." <[email-masked]>
Date: Thu, 28 Mar 2013 08:35:36 -0400

This page would seem to provide that.

<http://standards.ieee.org/develop/indconn/icsg/mmdef.html>

On 3/27/13 10:25 PM, Eric Burger wrote:
> .