Subject: Re: [mile] New ENISA report: Detect, SHARE, Protect

From: "Chernin, Michael A." <[email-masked]>
Date: Wed, 4 Dec 2013 21:57:45 +0000

Thanks for the report Romain. I will second Mr. Millar that sections 1-3 provide valuable information regards to the barriers to sharing.

My concerns start in section 4, where the Data Exchange formats are compared. At our current sharing maturity level, people are doing a lot of research on specification selection, and during this time specification perception holds a lot of value. I am concerned about the primary image (Figure 6) used to open section 4. My input is below:

*         It's easy to imagine a standard/specification that can do everything. While there is an asterisk next to MACCSA stating that it's in the definition phase, the way it spans the entire chart gives it a superior perception to other more defined specifications like IODEF and STIX.

*         I am unable to locate a definition for Network and File observable columns on the chart. All the specifications compared have key coverage differences in these areas.

*         Critical areas that both STIX and IODEF excel at, like email, are missing as a column entirely

*         Key observable columns that STIX excels at are missing entirely:  Actors, Campaigns, TTP, Targeting, Windows objects, Unix objects, Privileges, Package Manager Data, User Account Data, DNS, etc. These missing columns make STIX appear less capable. If you add those columns in, than a completely different story is told and STIX appears the most capable.

Thanks
Aharon

DTCC Non-Confidential (White)

<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or
entity to whom they are addressed. If you have received this email
in error, please notify us immediately and delete the email and any
attachments from your system. The recipient should check this email
and any attachments for the presence of viruses.  The company
accepts no liability for any damage caused by any virus transmitted
by this email.</FONT>

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 4 Dec 2013 17:41:00 -0500

Thanks Tom & Aaron for sharing your feedback.  These are helpful discussions.

I can assist on the MACCSA question for those not familiar as it is not in itself a format, but rather a framework that references and includes other efforts.  It actually covers quite a bit from identity and access management through to sharing formats and protocols referencing work from several international standards bodies as appropriate.  This was done to show that standards existed and could be combined to provide the necessary coverage without having to invent anything new.  The work that proceeded MACCSA involved about 18 nations who had requirements for international standards (IETF, ISO, ITU, etc.) and the ability to update and evolve referenced standards as needed in the future.  I think there are over 30 nations involved now.  In addition to the MILE work, the MITRE work is mentioned and will be included more directly when it moves to a standards body.  It is mentioned and described in the current version.  Last time I looked at the MACCSA framework, it did not compare the formats as that is not the purpose of the framework.  Many large efforts like the NATO CDXI for example, are looking IODEF, STIX, as well as OpenIOC to use what they need, where they need it.  MACCSA is putting all of the pieces together.

In terms of comparisons, I see the formats as suitable for different use cases and think the report comes at a very good time as Aaron points out.  Even within a use case, sharing between different entities could vary greatly and thus the requirements for exchange could vary.  Privacy and information leakage concerns could limit what is used for sharing with certain parties and it may be desirable to just support a minimum baseline of what should be exchanged in those situations.  For other exchanges (even in the same sharing model), richer data sets and information may be very important (Aaron's 4th bullet - I would say STIX is the most robust as capable depends on your use case and requirements.  Not everyone can handle that much information as they are lacking analyst resources to deal with threat actors, campaigns, etc.).  That's part of the reason I think use cases based sharing models are very important as well as having options to choose formats and protocols that meet your requirements.

Thanks again for all of your efforts on this report Romain!

Best regards,
Kathleen

From: mile [mailto:[email-masked]] On Behalf Of Chernin, Michael A.
Sent: Wednesday, December 04, 2013 4:58 PM
To: [email-masked]
Subject: Re: [mile] New ENISA report: Detect, SHARE, Protect

Thanks
Aharon

_____________________________________________________________
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.