Subject: [mile] Review of Impact@type

From: "Roman D. Danyliw" <[email-masked]>
Date: Mon, 21 Jul 2014 19:48:14 +0000

Hello!

In Issue #10 (http://trac.tools.ietf.org/wg/mile/trac/ticket/10), we're tracking the need to review the completeness of Impact@type in 5070bis.  In -07, it is defined as follows:

---[ snip from Section 3.14.1 ]---
type
      Required. ENUM. Classifies the malicious activity into incident
      categories. The permitted values are shown below. The default
      value is "other".

      1. admin. Administrative privileges were attempted.
      2. dos. A denial of service was attempted.
      3. file. An action that impacts the integrity of a file or
          database was attempted.
      4. info-leak. An attempt was made to exfiltrate information.
      5. misconfiguration. An attempt was made to exploit a mis-
          configuration in a system.
      6. policy. Activity violating site's policy was attempted.
      7. recon. Reconnaissance activity was attempted.
      8. social-engineering. A social engineering attack was
          attempted.
      9. user. User privileges were attempted.
      10. unknown. The classification of this activity is unknown.
      11. ext-value. An escape value used to extend this attribute.
           See Section 5.1.
--[ end ]--

Are there additional values the working would like to include?

Roman

---

From: Daisuke MIYAMOTO <[email-masked]>
Date: Wed, 23 Jul 2014 22:37:21 +0900

Hello Roman,

Let me ask a clarification question.
Here, we assume an incident, where
  - my web server was hijacked.
  - the attacker gained a user-privilege to put files.
  - the attacker overtraded files (web pages) of my site.

In this case, what is the suitable value for Impact@type ?

Could it be one of the followings?
a) Choose "3. file".
    Primal concern is modified pages.
b) Choose "9. user".
    Root cause of the incident is stolen user privileges.
c) Choose either of them.
    Both options are reasonable.	

Kind regards,
Daisuke

(2014/07/22 4:48), Roman D. Danyliw wrote:
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile
>

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Thu, 31 Jul 2014 18:56:00 +0000

Hello Daisuke!

I don't think there is a single answer for all organizations.  IODEF provides the flexibility to categorize the incident in all three ways.  If pressed, I would lean towards (c).

Roman

> -----Original Message-----
> From: Daisuke MIYAMOTO [mailto:[email-masked]]
> Sent: Wednesday, July 23, 2014 9:37 AM
> To: Roman D. Danyliw; [email-masked]
> Subject: Re: [mile] Review of Impact@type
> 
> Hello Roman,
> 
> > In Issue #10 (http://trac.tools.ietf.org/wg/mile/trac/ticket/10), we're
> tracking the need to review the completeness of Impact@type in 5070bis.  In
> -07, it is defined as follows:
> >