Subject: [mile] Feedback on draft-murillo-mile-cps-00 and implications for 5070bis

From: "Roman D. Danyliw" <[email-masked]>
Date: Thu, 31 Jul 2014 18:31:57 +0000

Hello!

The presentation on draft-multillo-mile-cps-00 at IETF 90 started a discussion on identifying data elements described by cps-00 that might also be relevant to enterprise incident reports.  In my judgment they are at least as follows:

(1) IncidentTitle (Section 5.6) and BriefDescriptionOfIncident (5.23) -- these are classes that quickly summarize the document.  A similar idea was proposed in the bullet #4 of the feedback from the NATO implementation by Lagadec Philippe (http://www.ietf.org/mail-archive/web/mile/current/msg01503.html).  Should we add a "Summary" class similarly defined as the Description class to IODEF-Document, Incident, and EventData?

(2) RecurrencePreventionMeasures (Section 5.22) -- should a free-form text description be added to describe future measures that should be taken to prevent the class of activity described in the document from occurring the future?

(3) EntryPoint (Section 5.15) and CommandAndControlCenters (Section 5.18) -- both of these classes attempt to categorize a system as having a given role in the incident -- entry point into a network by the attacker and the C2 servers of the attacker.  System@category in 5070bis also tries to categorize systems but with these enumerated values: source, target, intermediate, sensor, or infrastructure.  Only one category can be assigned per system.  NodeRole@attack-type is poorly documented (see Issue #40) but it allows for values of c2-server, sink-hole, malware-distribution, phishing, spear-phishing, recruiting, fraudulent-site, and dns-spoof.  

There appears to be a need to classify the intended role victim system independent of the incident, NodeRole@category, but also the role it played in an incident/event especially in categorizing the attacker infrastructure, NodeRole@attack-type/EntryPoint/CommandAndControlCenters.  It seems like we should reconcile these.  In 5070bis, there appears to be overlap between System@category and NodeRole@attack-type.  EntryPoint and CommandAndControlCenters from cps-00 suggest new enumerated values for these attributes (or perhaps for a new one)?

Any strong feelings for adopting these concepts into 5070bis?  I'm thinking all three are useful and easy to implement.

It was also suggested that certain overlap might exist.  Comparing cps-00 with 5070bis-07, I believe certain cps data elements can already be represented without an extension.  They are as follows:

** ReportingParty (Section 5.7) = Incident/Contact@role={reporter, creator}
** ReportReliability (Section 5.8) = {Incident,EventData}/Confidence
** TargetSystem (Section 5.11) = EventData/Flow/System@category="target"/Node/NodeRole
** Exploit (Section 5.14) = Incident/Method
** PerpetratingParty (Section 5.16) = Incident/RelatedActivity
** DetectioMethod (Section 5.17) = EventData/Discovery
** OrganizationalImpact (Section 5.21) = Assessment/{BusinessImpact,MonetaryImpact}
** Logs (Section 5.24) = RecordData