Subject: Re: [mile] New ENISA report: Detect, SHARE, Protect

From: <[email-masked]>
Date: Mon, 2 Dec 2013 12:18:25 -0600

Romain,

The survey research and findings (sections 2-3) are quite good and I
really appreciate the effort that went into it. The findings in
particular do a great job of summarizing the challenges facing
CERT-to-CERT info sharing without glossing over important technical
details. 

However, I don't see a similar explanation of methodology for section 4,
and in fact section 4 seems a bit confusing overall. It's not especially
clear which efforts are currently in operational use, which are proposed
for future use, and the relationship between 4.1 efforts and 4.2
examples is also not clear. Perhaps it is because this section is
offered as background material rather than in direct support of the
survey research and recommendations - in which case, it may have best
been included as an Appendix or Annex to the report. 

I note that in the acknowledgements you thank active participants and
architects from at least four of the named efforts listed in section 4 -
were reviewers sought from the other listed efforts? I doubt that the
STIX community would agree with the representation in Figure 6.

 - Tom Millar

[email-masked]
BB: [email-masked] / 202-631-1915
24x7: [email-masked] / 888-282-0870 

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Romain Bourgue
Sent: Tuesday, November 26, 2013 11:23 AM
To: [email-masked]
Subject: [mile] New ENISA report: Detect, SHARE, Protect

Dear all,
 
ENISA has released a new report on solutions for improving threat data
exchange among CERTs.
This report analyses the current practices and challenges CERTs are
facing in the area of threat data exchange and take stock of related
standards and technical solutions.
IODEF and RID (and STIX and TAXII) are part of the analysed standards.
The report also covers emerging technical solutions like CIF and MISP
that could help CERTs in sharing data more efficiently. We also made
some recommendations for better data exchange practices among CERTs.
This report is the result of a cooperative work involving CERTs teams
(mainly EU National and Governmental teams). 
 
I hope you'll find it interesting and helpful. Feel free to disseminate
it!
 
https://www.enisa.europa.eu/media/press-releases/enisa-calls-for-better-
data-sharing-and-interoperability-among-certs-to-mitigate-cyberattacks
<https://www.enisa.europa.eu/media/press-releases/enisa-calls-for-better
-data-sharing-and-interoperability-among-certs-to-mitigate-cyberattacks>

Best regards,
 
Romain Bourgue
Operational Security - CERT Relations
ENISA - Securing Europe's Information Society
Tel: +30 281 440 96 62 Mob: +30 695 178 22 71

---

From: Romain Bourgue <[email-masked]>
Date: Tue, 3 Dec 2013 08:10:06 +0000

Hello Tom,

Thank you very much for your comments and your interest in our report.
I'm glad that you liked the analysis of the current situation and challenges in the data sharing practices of CERT.

I understand your point regarding section 4. If you felt like this section was missing explained reasoning and methodology it's because of a deliberate choice of a factual-only approach so that technical teams could identify by themselves their own interest for a particular standard or tool.

A large number of CERT teams, at least in Europe, just don't know about these standards, tools and projects but they all have specific expectations when it comes to sharing data. We thought that basing this section on an analytic approach would have excluded some specific reasoning and therefore, it could have limited their adoptions. 
We were driven by simplification and vulgarisation, I hope it was not at a too big expense of accuracy. But you're right, our approach should have been explained more clearly in this section.

Still, lately, a team involved in the development of an incident messaging tool was about to create a new common data model, after reading the report, they got in touch with the STIX community and decided to implement a generic event mapping using STIX/Cybox.
Our motivation is precisely that. If more teams get to know these standards, tools and projects, we believe that sharing communities would grow and information would flow more easily.

Thanks again for your comments!

-Romain

> From: [email-masked] [mailto:[email-masked]]
> Sent: 02 December 2013 20:19
> To: Romain Bourgue; [email-masked]
> Subject: RE: [mile] New ENISA report: Detect, SHARE, Protect
> 
> Romain,
> 
> The survey research and findings (sections 2-3) are quite good and I really
> appreciate the effort that went into it. The findings in particular do a great
> job of summarizing the challenges facing CERT-to-CERT info sharing without
> glossing over important technical details.
> 
> However, I don't see a similar explanation of methodology for section 4, and
> in fact section 4 seems a bit confusing overall. It's not especially clear which
> efforts are currently in operational use, which are proposed for future use,
> and the relationship between 4.1 efforts and 4.2 examples is also not clear.
> Perhaps it is because this section is offered as background material rather
> than in direct support of the survey research and recommendations - in
> which case, it may have best been included as an Appendix or Annex to the
> report.
> 
> architects from at least four of the named efforts listed in section 4 - were
> reviewers sought from the other listed efforts? I doubt that the STIX
> community would agree with the representation in Figure 6.
> 
>  - Tom Millar
> 
> This report analyses the current practices and challenges CERTs are facing in
> the area of threat data exchange and take stock of related standards and
> technical solutions.
> The report also covers emerging technical solutions like CIF and MISP that
> could help CERTs in sharing data more efficiently. We also made some
> recommendations for better data exchange practices among CERTs.
> This report is the result of a cooperative work involving CERTs teams (mainly
> EU National and Governmental teams).
> 
> I hope you'll find it interesting and helpful. Feel free to disseminate it!
>