Subject: [scap_interest] SCAP BOF Agenda - any more items?
From: Stephen Hanna <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Wed, 27 Oct 2010 16:36:25 -0400
List-Id: "Discussion List for IETFers interested in the Security Content Automation Protocol \(SCAP\)." <scap_interest.ietf.org>

Kent and I have put together a draft agenda for the
SCAP BOF, which is included below and available online
at http://www.ietf.org/proceedings/79/agenda/scap.txt

Do you have any more items that should be on the list?
If so, please send them to us. And either way, I look
forward to seeing you at the SCAP BOF in Beijing!

Thanks,

Steve Hanna

-------

IETF 79 SCAP BOF Proposed Agenda
=================================

Date: Tuesday, November 9, 2010
Time: 1520-1810
BOF info: http://trac.tools.ietf.org/bof/trac/wiki/WikiStart#Security
BOF email: [email-masked]
BOF email archive: http://www.ietf.org/mail-archive/web/scap_interest

Welcome and Agenda Overview
  Presenter: Tim Grance
  Time: 10 minutes

SCAP Overview 
  Presenters: David Waltermire and Kent Landfield
  Time: 40 minutes
  Relevant Documents:
    http://www.ietf.org/internet-drafts/draft-landfield-scap-naming-00.txt
    http://www.ietf.org/internet-drafts/draft-waltermire-scap-xccdf-00.txt

Compare and Contrast MIBs and Yang Modules with SCAP capabilities
  Presenter: Tim Polk
  Time: 20 minutes

NEA/SCAP Integration
  Presenter: Steve Hanna
  Time: 30 minutes 

CYBEX Usage of SCAP Specifications
  Presenter: Takeshi Takahashi
  Time: 15 minutes
  Relevant Documents:
    http://www.ietf.org/internet-drafts/draft-takahashi-cybex-intro-00.txt

Customer Perspective - Boeing
  Presenter: Stephen Whitlock
  Time: 10 minutes 

Open Mic - 45 minutes

From: <[email-masked]>
To: <[email-masked]>
Date: Fri, 22 Oct 2010 12:04:27 -0500
Accept-Language: en-US
acceptlanguage: en-US
Subject: [scap_interest] Any comments on the drafts that were posted?

--_000_B277F0D458571E469F8E7AD2DD8A210233DDB0E6C9AMERDALEXMB1c_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

All,

The drafts are out and available. I hope you have had some time to read through them. If not, please do. We really need your input to make them right.

I KNOW they are not perfect so send your comments to the list.   The two document are located at:

http://www.ietf.org/internet-drafts/draft-landfield-scap-naming-00.txt

http://www.ietf.org/internet-drafts/draft-waltermire-scap-xccdf-00.txt

If you have read them and have no issues with them, I'd like the list to hear that too. ;-)

Thanks.

--
Kent Landfield
Director, Content Strategy, Architecture and Standards
McAfee, Inc.
+1 972.963.7096 Direct
+1 817.637.8026 Mobile
[email-masked]<mailto:[email-masked]>

--_000_B277F0D458571E469F8E7AD2DD8A210233DDB0E6C9AMERDALEXMB1c_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Consolas;
	panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
	{font-family:Verdana;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
	{mso-style-priority:99;
	mso-style-link:"Plain Text Char";
	margin:0in;
	margin-bottom:.0001pt;
	font-size:10.5pt;
	font-family:Consolas;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
span.PlainTextChar
	{mso-style-name:"Plain Text Char";
	mso-style-priority:99;
	mso-style-link:"Plain Text";
	font-family:Consolas;}
.MsoChpDefault
	{mso-style-type:export-only;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext="edit">
  <o:idmap v:ext="edit" data="1" />
 </o:shapelayout></xml><![endif]-->
</head>

<body lang=EN-US link=blue vlink=purple>

<div class=WordSection1>

<p class=MsoNormal>All,<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>The drafts are out and available. I hope you have had some
time to read through them. If not, please do. We really need your input to make
them right.&nbsp; <o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>I KNOW they are not perfect so send your comments to the
list.&nbsp;&nbsp; The two document are located at:<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoPlainText><a
href="http://www.ietf.org/internet-drafts/draft-landfield-scap-naming-00.txt">http://www.ietf.org/internet-drafts/draft-landfield-scap-naming-00.txt</a><o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoPlainText><a
href="http://www.ietf.org/internet-drafts/draft-waltermire-scap-xccdf-00.txt">http://www.ietf.org/internet-drafts/draft-waltermire-scap-xccdf-00.txt</a><o:p></o:p></p>

<p class=MsoPlainText><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>If you have read them and have no issues with them, I&#8217;d
like the list to hear that too. ;-)<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>Thanks.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal><span style='font-size:9.0pt;font-family:"Verdana","sans-serif"'>--</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>

<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";
color:#666666'>Kent Landfield</span></b><span style='font-size:10.0pt;
font-family:"Arial","sans-serif"'><br>
</span><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";
color:#666666'>Director, Content Strategy, Architecture and Standards </span><span
style='font-family:"Arial","sans-serif"'><br>
</span><b><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";
color:#CC0033'>McAfee, Inc.</span></b><span style='font-family:"Verdana","sans-serif";
color:#666666'><br>
</span><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";
color:#666666'>+1 972.963.7096 Direct</span><span style='font-size:9.0pt;
font-family:"Verdana","sans-serif"'><br>
</span><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";
color:#666666'>+1&nbsp;817.637.8026 Mobile</span><span style='font-size:7.5pt;
font-family:"Verdana","sans-serif"'><br>
</span><span style='font-size:9.0pt;font-family:"Verdana","sans-serif"'><a
href="mailto:[email-masked]"><span style='font-size:7.5pt;
color:#666666'>[email-masked]</span></a></span><o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

</div>

</body>

</html>

--_000_B277F0D458571E469F8E7AD2DD8A210233DDB0E6C9AMERDALEXMB1c_--

Date: Thu, 21 Oct 2010 13:51:02 -0400
From: Tony Rutkowski <[email-masked]>
Organization: Yaana Technologies
To: Michael Chernin <[email-masked]>
Cc: Malcolm Johnson <[email-masked]>, [email-masked], [email-masked]
Subject: Re: [scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation
Reply-To: [email-masked]

This is a multi-part message in MIME format.
--------------000909020308030903060407
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

  Hi Michael,

> I am trying to wrap my head around the CYBEX standard. Is this 
> standard creating new standards that replace existing SCAP standards ? 
> Or is this standard using existing SCAP standards as it's core? Or 
> does this standard simply not care what standard is being used at it's 
> core, as long as its a standard? How does the CYBEX standard impact 
> the SCAP interest list and SCAP's future with the IETF?

First, the CYBEX work is not trying to replace anything!
It's attempting to establish a rough global consensus on
1) a comprehensive, coherent conceptualization of
cybersecurity, and 2) an interoperable, extensible set
of related structured information exchange and associated
discovery and trust specifications

Second, we found over the past year that the term "SCAP
standards" was used very differently in diverse forums
and seems to constantly evolve.   So our ITU-T group chose
to refer to these various usages as "security automation"
schema use cases or tools, and we've begun to avoid
using SCAP.  This also avoids any conflicts with NIST's
SCAP implementation(s) for US federal networks and systems.

In addition, CYBEX clearly encompasses much more than
just security automation.

If one assumes that the SCAP interest list and the resulting
IETF work involves potential application of the various
MITRE/CNIS/FIRST specifications to implementations of IETF
protocols, there is mutual interest in adopting common
conceptualizations and approaches to the extent desired.

There is also value in looking at how other bodies and
user communities are innovating with and implementing
these specifications.  The Japan ISOG-J/NICT example
is a notable one.  Trusted discovery of all the autonomous,
diverse security automation schema is a major emerging
challenge they are especially focussing on.

For reference purposes, it's also useful to know that those
specifications are also being instantiated in ITU-T versions
that will be available in six languages, freely available
online, and evangelized for global cybersecurity use.

Hope this helps.

--tony

--------------000909020308030903060407
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#ffffff" text="#3333ff">
    Hi Michael,<br>
    <br>
    <blockquote
cite="mid:[email-masked]"
      type="cite"><font face="sans-serif" size="2">I am trying to wrap
        my head around the
        CYBEX standard. Is this standard creating new standards that
        replace existing
        SCAP standards ? Or is this standard using existing SCAP
        standards as it's
        core? Or does this standard simply not care what standard is
        being used
        at it's core, as long as its a standard? How does the CYBEX
        standard impact
        the SCAP interest list and SCAP's future with the IETF?</font>
      <br>
    </blockquote>
    <tt><br>
      First, the CYBEX work is not trying to replace anything!&nbsp; <br>
      It's attempting to establish a rough global consensus on <br>
      1) a comprehensive, coherent conceptualization of <br>
      cybersecurity, and 2) an interoperable, extensible set <br>
      of related structured information exchange and associated <br>
      discovery and trust specifications<br>
      <br>
      Second, we found over the past year that the term "SCAP <br>
      standards" was used very differently in diverse forums<br>
      and seems to constantly evolve. &nbsp; So our ITU-T group chose<br>
      to refer to these various usages as "security automation"<br>
      schema use cases or tools, and we've begun to avoid <br>
      using SCAP.&nbsp; This also avoids any conflicts with NIST's<br>
      SCAP implementation(s) for US federal networks and systems.<br>
      <br>
      In addition, CYBEX clearly encompasses much more than<br>
      just security automation.<br>
      <br>
      If one assumes that the SCAP interest list and the resulting<br>
      IETF work involves potential application of the various <br>
      MITRE/CNIS/FIRST specifications to implementations of IETF <br>
      protocols, there is mutual interest in adopting common<br>
      conceptualizations and approaches to the extent desired.<br>
      <br>
      There is also value in looking at how other bodies and<br>
      user communities are innovating with and implementing <br>
      these specifications.&nbsp; The Japan ISOG-J/NICT example<br>
      is a notable one.&nbsp; Trusted discovery of all the autonomous,<br>
      diverse security automation schema is a major emerging <br>
      challenge they are especially focussing on. <br>
      <br>
      For reference purposes, it's also useful to know that those<br>
      specifications are also being instantiated in ITU-T versions<br>
      that will be available in six languages, freely available<br>
      online, and evangelized for global cybersecurity use.<br>
      <br>
      Hope this helps.<br>
      <br>
      --tony<br>
    </tt>
  </body>
</html>

--------------000909020308030903060407--

To: [email-masked]
From: Michael Chernin <[email-masked]>
Date: Thu, 21 Oct 2010 13:01:47 -0400
Cc: Malcolm Johnson <[email-masked]>, [email-masked], [email-masked]
Subject: Re: [scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation

--=_mixed 005D8C74852577C3_Content-Type: multipart/alternative;
	boundary="=_alternative 005D8C74852577C3_="

--=_alternative 005D8C74852577C3_Content-Type: text/plain;
	charset="US-ASCII"

Tony -

I am trying to wrap my head around the CYBEX standard. Is this standard 
creating new standards that replace existing SCAP standards ? Or is this 
standard using existing SCAP standards as it's core? Or does this standard 
simply not care what standard is being used at it's core, as long as its a 
standard? How does the CYBEX standard impact the SCAP interest list and 
SCAP's future with the IETF?

I viewed the presentation that was attached, but it was difficult to 
determine the message without hearing the details that were given during 
the presentation.

Aharon
---------------------------------------------------
Michael "Aharon" Chernin
Security Automation Program Manager
Corporate Information Security -Depository Trust & Clearing Corporation
[email-masked]

Tony Rutkowski <[email-masked]> 
Sent by: [email-masked]
10/20/2010 04:30 PM
Please respond to
[email-masked]

To
[email-masked]
cc
Malcolm Johnson <[email-masked]>, [email-masked]
Subject
[scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation

Dear all,

At the ITU-T cybersecurity standards group (Q4/17)
interim meeting in Tokyo last week, the participants
noted the new effort to introduce into the IETF some of
the systems assurance standards under the general aegis
the SCAP BOF and this interest list.

An effort leveraging the same concepts and underlying
standardization work was started within the ITU-T last
year among an array of industry and government
participants and organizations for outlining ways of
sharing and exchanging structured information, that is
called the Cybersecurity Information Exchange Framework
or CYBEX for short.  CYBEX identified the entire array
of information assurance, incident response, forensics
and trust specifications - most of which were in use or
under development in the respective communities - as
part of this Framework.   The CYBEX framework is
scheduled for approval as as Recommendation ITU-T
X.1500, together with CVE and CVSS as X.1520 and X.1521
respectively.  Many others are in various stages of
maturity.  The editors of X.1500 include US DHS,
Japan's NICT, MITRE, Microsoft, FIRST, Cisco, and Yaana
Technologies.

Part of that framework of course includes the use of
security automation schemas such as SCAP as a means 
to facilitate systems, services, devices of all kinds 
to make them "measurably" secure as to potential 
vulnerabilities and threats.  The U.S. federal 
system implementation of SCAP is included as an
example in the X.1500 appendix, as is a similar
implementation in Japan known as JVN.

The vision includes the potential development, use, and
evolution of innumerable numbers of public and private
security automation schemas for innumerable systems,
services, and devices - similar in many ways to the
deployment of network management MIBs over the past 25
years.  The IETF is one of many standards bodies that
should be developing security content automation schemas, 
and the BOF list plus a scheduled event at the upcoming 
Beijing IETF meeting next month is an important step in 
that direction.

This development was discussed at some length at the
Tokyo Interim Meeting and there was significant
enthusiasm for working with IETF (and many other
standards bodies) in developing these implementations
for their standards based protocols and services.
Also demonstrated in Tokyo was the rather remarkable
work demonstrated by the Japan network security
community of a RDF-based discovery mechanism for CYBEX
should be an essential mechanism for enabling use of
all the many distributed instances of security
automation schema.  The platform is part of a CYBEX
discovery specification designated X.cybex-discovery.
In addition, an entire new OID Arc 2.48 has been 
allocated for cybersecurity information exchange 
structured identity purposes.

Dr. Takehashi of NICT, as well as Q4/17 associate
rapporteur Dr. Kadobayashi of NAIST, who have been
developing CYBEX related concepts, tools, and
implementations within Japan's ICT security
community, will be present in Beijing for the IETF
meeting, and we hope can contribute to the SCAP BOF.

An introduction to CYBEX is attached that was presented
last week to the Japan ICT security technical community
hosted by ISOG-J prior to the ITU-T Interim Meeting. 

--tony rutkowski, ITU-T Q.4/17 (cybersecurity) Rapporteur
_______________________________________________
scap_interest mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scap_interest

<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or
entity to whom they are addressed. If you have received this email
in error, please notify us immediately and delete the email and any
attachments from your system. The recipient should check this email
and any attachments for the presence of viruses.  The company
accepts no liability for any damage caused by any virus transmitted
by this email.</FONT>
--=_alternative 005D8C74852577C3_Content-Type: text/html;
	charset="US-ASCII"

<br><font size=2 face="sans-serif">Tony -</font>
<br>
<br><font size=2 face="sans-serif">I am trying to wrap my head around the
CYBEX standard. Is this standard creating new standards that replace existing
SCAP standards ? Or is this standard using existing SCAP standards as it's
core? Or does this standard simply not care what standard is being used
at it's core, as long as its a standard? How does the CYBEX standard impact
the SCAP interest list and SCAP's future with the IETF?</font>
<br>
<br><font size=2 face="sans-serif">I viewed the presentation that was attached,
but it was difficult to determine the message without hearing the details
that were given during the presentation.</font>
<br>
<br><font size=2 face="sans-serif">Aharon</font>
<br><font size=2 face="sans-serif">---------------------------------------------------<br>
Michael &quot;Aharon&quot; Chernin<br>
Security Automation Program Manager<br>
Corporate Information Security -Depository Trust &amp; Clearing Corporation<br>
[email-masked]<br>
</font>
<br>
<br>
<br>
<br>
<br>
<table width0%>
<tr valign=top>
<td width@%><font size=1 face="sans-serif"><b>Tony Rutkowski &lt;[email-masked]&gt;</b>
</font>
<br><font size=1 face="sans-serif">Sent by: [email-masked]</font>
<p><font size=1 face="sans-serif">10/20/2010 04:30 PM</font>
<table border>
<tr valign=top>
<td bgcolor=white>
<div alignÎnter><font size=1 face="sans-serif">Please respond to<br>
[email-masked]</font></div></table>
<br>
<td widthY%>
<table width0%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td><font size=1 face="sans-serif">[email-masked]</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td><font size=1 face="sans-serif">Malcolm Johnson &lt;[email-masked]&gt;,
[email-masked]</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">[scap_interest] IETF SCAP and ITU-T
CYBEX synergies and cooperation</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=3 color=#3333ff><tt>Dear all,<br>
<br>
At the ITU-T cybersecurity standards group (Q4/17)<br>
interim meeting in Tokyo last week, the participants<br>
noted the new effort to introduce into the IETF some of<br>
the systems assurance standards under the general aegis<br>
the SCAP BOF and this interest list.<br>
<br>
An effort leveraging the same concepts and underlying<br>
standardization work was started within the ITU-T last<br>
year among an array of industry and government<br>
participants and organizations for outlining ways of<br>
sharing and exchanging structured information, that is<br>
called the Cybersecurity Information Exchange Framework<br>
or CYBEX for short. &nbsp;CYBEX identified the entire array<br>
of information assurance, incident response, forensics<br>
and trust specifications - most of which were in use or<br>
under development in the respective communities - as<br>
part of this Framework. &nbsp; The CYBEX framework is<br>
scheduled for approval as as Recommendation ITU-T<br>
X.1500, together with CVE and CVSS as X.1520 and X.1521<br>
respectively. &nbsp;Many others are in various stages of<br>
maturity. &nbsp;The editors of X.1500 include US DHS,<br>
Japan's NICT, MITRE, Microsoft, FIRST, Cisco, and Yaana<br>
Technologies.<br>
<br>
Part of that framework of course includes the use of<br>
security automation schemas such as SCAP as a means <br>
to facilitate systems, services, devices of all kinds <br>
to make them &quot;measurably&quot; secure as to potential <br>
vulnerabilities and threats. &nbsp;The U.S. federal <br>
system implementation of SCAP is included as an<br>
example in the X.1500 appendix, as is a similar<br>
implementation in Japan known as JVN.<br>
<br>
The vision includes the potential development, use, and<br>
evolution of innumerable numbers of public and private<br>
security automation schemas for innumerable systems,<br>
services, and devices - similar in many ways to the<br>
deployment of network management MIBs over the past 25<br>
years. &nbsp;The IETF is one of many standards bodies that<br>
should be developing security content automation schemas, <br>
and the BOF list plus a scheduled event at the upcoming <br>
Beijing IETF meeting next month is an important step in <br>
that direction.<br>
<br>
This development was discussed at some length at the<br>
Tokyo Interim Meeting and there was significant<br>
enthusiasm for working with IETF (and many other<br>
standards bodies) in developing these implementations<br>
for their standards based protocols and services.<br>
Also demonstrated in Tokyo was the rather remarkable<br>
work demonstrated by the Japan network security<br>
community of a RDF-based discovery mechanism for CYBEX<br>
should be an essential mechanism for enabling use of<br>
all the many distributed instances of security<br>
automation schema. &nbsp;The platform is part of a CYBEX<br>
discovery specification designated X.cybex-discovery.<br>
In addition, an entire new OID Arc 2.48 has been <br>
allocated for cybersecurity information exchange <br>
structured identity purposes.<br>
<br>
Dr. Takehashi of NICT, as well as Q4/17 associate<br>
rapporteur Dr. Kadobayashi of NAIST, who have been<br>
developing CYBEX related concepts, tools, and<br>
implementations within Japan's ICT security<br>
community, will be present in Beijing for the IETF<br>
meeting, and we hope can contribute to the SCAP BOF.<br>
<br>
An introduction to CYBEX is attached that was presented<br>
last week to the Japan ICT security technical community<br>
hosted by ISOG-J prior to the ITU-T Interim Meeting. </tt></font><font size=3 color=#3333ff><br>
<br>
--tony rutkowski, ITU-T Q.4/17 (cybersecurity) Rapporteur<br>
</font><font size=2><tt>_______________________________________________<br>
scap_interest mailing list<br>
[email-masked]<br>
https://www.ietf.org/mailman/listinfo/scap_interest<br>
</tt></font>
<br>

<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or
entity to whom they are addressed. If you have received this email
in error, please notify us immediately and delete the email and any
attachments from your system. The recipient should check this email
and any attachments for the presence of viruses.  The company
accepts no liability for any damage caused by any virus transmitted
by this email.</FONT>
--=_alternative 005D8C74852577C3_=--

--=_mixed 005D8C74852577C3_Content-Type: application/octet-stream;
	name="ISOG-J_seminar_1.1.pptx"
Content-Disposition: attachment; filename="ISOG-J_seminar_1.1.pptx"
Content-Transfer-Encoding: base64

--=_mixed 005D8C74852577C3_=--

Date: Wed, 20 Oct 2010 16:48:09 -0400
From: Sean Turner <[email-masked]>
To: [email-masked]
Cc: Malcolm Johnson <[email-masked]>, [email-masked]
Subject: Re: [scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation

Also note that there is the following draft:

https://datatracker.ietf.org/doc/draft-takahashi-cybex-intro/

spt

On 10/20/10 4:30 PM, Tony Rutkowski wrote:
> Dear all,
>
> At the ITU-T cybersecurity standards group (Q4/17)
> interim meeting in Tokyo last week, the participants
> noted the new effort to introduce into the IETF some of
> the systems assurance standards under the general aegis
> the SCAP BOF and this interest list.
>
> An effort leveraging the same concepts and underlying
> standardization work was started within the ITU-T last
> year among an array of industry and government
> participants and organizations for outlining ways of
> sharing and exchanging structured information, that is
> called the Cybersecurity Information Exchange Framework
> or CYBEX for short. CYBEX identified the entire array
> of information assurance, incident response, forensics
> and trust specifications - most of which were in use or
> under development in the respective communities - as
> part of this Framework. The CYBEX framework is
> scheduled for approval as as Recommendation ITU-T
> X.1500, together with CVE and CVSS as X.1520 and X.1521
> respectively. Many others are in various stages of
> maturity. The editors of X.1500 include US DHS,
> Japan's NICT, MITRE, Microsoft, FIRST, Cisco, and Yaana
> Technologies.
>
> Part of that framework of course includes the use of
> security automation schemas such as SCAP as a means
> to facilitate systems, services, devices of all kinds
> to make them "measurably" secure as to potential
> vulnerabilities and threats. The U.S. federal
> system implementation of SCAP is included as an
> example in the X.1500 appendix, as is a similar
> implementation in Japan known as JVN.
>
> The vision includes the potential development, use, and
> evolution of innumerable numbers of public and private
> security automation schemas for innumerable systems,
> services, and devices - similar in many ways to the
> deployment of network management MIBs over the past 25
> years. The IETF is one of many standards bodies that
> should be developing security content automation schemas,
> and the BOF list plus a scheduled event at the upcoming
> Beijing IETF meeting next month is an important step in
> that direction.
>
> This development was discussed at some length at the
> Tokyo Interim Meeting and there was significant
> enthusiasm for working with IETF (and many other
> standards bodies) in developing these implementations
> for their standards based protocols and services.
> Also demonstrated in Tokyo was the rather remarkable
> work demonstrated by the Japan network security
> community of a RDF-based discovery mechanism for CYBEX
> should be an essential mechanism for enabling use of
> all the many distributed instances of security
> automation schema. The platform is part of a CYBEX
> discovery specification designated X.cybex-discovery.
> In addition, an entire new OID Arc 2.48 has been
> allocated for cybersecurity information exchange
> structured identity purposes.
>
> Dr. Takehashi of NICT, as well as Q4/17 associate
> rapporteur Dr. Kadobayashi of NAIST, who have been
> developing CYBEX related concepts, tools, and
> implementations within Japan's ICT security
> community, will be present in Beijing for the IETF
> meeting, and we hope can contribute to the SCAP BOF.
>
> An introduction to CYBEX is attached that was presented
> last week to the Japan ICT security technical community
> hosted by ISOG-J prior to the ITU-T Interim Meeting.
>
> --tony rutkowski, ITU-T Q.4/17 (cybersecurity) Rapporteur
>
>
>
> _______________________________________________
> scap_interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scap_interest

Date: Wed, 20 Oct 2010 16:30:20 -0400
From: Tony Rutkowski <[email-masked]>
Organization: Yaana Technologies
To: [email-masked]
Cc: Malcolm Johnson <[email-masked]>, [email-masked]
Subject: [scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation
Reply-To: [email-masked]

This is a multi-part message in MIME format.
--------------040605030202070107010401
Content-Type: multipart/alternative;
 boundary="------------070204070008090607050400"

--------------070204070008090607050400
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

  Dear all,

At the ITU-T cybersecurity standards group (Q4/17)
interim meeting in Tokyo last week, the participants
noted the new effort to introduce into the IETF some of
the systems assurance standards under the general aegis
the SCAP BOF and this interest list.

An effort leveraging the same concepts and underlying
standardization work was started within the ITU-T last
year among an array of industry and government
participants and organizations for outlining ways of
sharing and exchanging structured information, that is
called the Cybersecurity Information Exchange Framework
or CYBEX for short.  CYBEX identified the entire array
of information assurance, incident response, forensics
and trust specifications - most of which were in use or
under development in the respective communities - as
part of this Framework.   The CYBEX framework is
scheduled for approval as as Recommendation ITU-T
X.1500, together with CVE and CVSS as X.1520 and X.1521
respectively.  Many others are in various stages of
maturity.  The editors of X.1500 include US DHS,
Japan's NICT, MITRE, Microsoft, FIRST, Cisco, and Yaana
Technologies.

Part of that framework of course includes the use of
security automation schemas such as SCAP as a means
to facilitate systems, services, devices of all kinds
to make them "measurably" secure as to potential
vulnerabilities and threats.  The U.S. federal
system implementation of SCAP is included as an
example in the X.1500 appendix, as is a similar
implementation in Japan known as JVN.

The vision includes the potential development, use, and
evolution of innumerable numbers of public and private
security automation schemas for innumerable systems,
services, and devices - similar in many ways to the
deployment of network management MIBs over the past 25
years.  The IETF is one of many standards bodies that
should be developing security content automation schemas,
and the BOF list plus a scheduled event at the upcoming
Beijing IETF meeting next month is an important step in
that direction.

This development was discussed at some length at the
Tokyo Interim Meeting and there was significant
enthusiasm for working with IETF (and many other
standards bodies) in developing these implementations
for their standards based protocols and services.
Also demonstrated in Tokyo was the rather remarkable
work demonstrated by the Japan network security
community of a RDF-based discovery mechanism for CYBEX
should be an essential mechanism for enabling use of
all the many distributed instances of security
automation schema.  The platform is part of a CYBEX
discovery specification designated X.cybex-discovery.
In addition, an entire new OID Arc 2.48 has been
allocated for cybersecurity information exchange
structured identity purposes.

Dr. Takehashi of NICT, as well as Q4/17 associate
rapporteur Dr. Kadobayashi of NAIST, who have been
developing CYBEX related concepts, tools, and
implementations within Japan's ICT security
community, will be present in Beijing for the IETF
meeting, and we hope can contribute to the SCAP BOF.

An introduction to CYBEX is attached that was presented
last week to the Japan ICT security technical community
hosted by ISOG-J prior to the ITU-T Interim Meeting.

--tony rutkowski, ITU-T Q.4/17 (cybersecurity) Rapporteur

--------------070204070008090607050400
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
  </head>
  <body text="#3333ff" bgcolor="#ffffff">
    <tt>Dear all,<br>
      <br>
      At the ITU-T cybersecurity standards group (Q4/17)<br>
      interim meeting in Tokyo last week, the participants<br>
      noted the new effort to introduce into the IETF some of<br>
      the systems assurance standards under the general aegis<br>
      the SCAP BOF and this interest list.<br>
      <br>
      An effort leveraging the same concepts and underlying<br>
      standardization work was started within the ITU-T last<br>
      year among an array of industry and government<br>
      participants and organizations for outlining ways of<br>
      sharing and exchanging structured information, that is<br>
      called the Cybersecurity Information Exchange Framework<br>
      or CYBEX for short.&nbsp; CYBEX identified the entire array<br>
      of information assurance, incident response, forensics<br>
      and trust specifications - most of which were in use or<br>
      under development in the respective communities - as<br>
      part of this Framework.&nbsp;&nbsp; The CYBEX framework is<br>
      scheduled for approval as as Recommendation ITU-T<br>
      X.1500, together with CVE and CVSS as X.1520 and X.1521<br>
      respectively.&nbsp; Many others are in various stages of<br>
      maturity.&nbsp; The editors of X.1500 include US DHS,<br>
      Japan's NICT, MITRE, Microsoft, FIRST, Cisco, and Yaana<br>
      Technologies.<br>
      <br>
      Part of that framework of course includes the use of<br>
      security automation schemas such as SCAP as a means <br>
      to facilitate systems, services, devices of all kinds <br>
      to make them "measurably" secure as to potential <br>
      vulnerabilities and threats.&nbsp; The U.S. federal <br>
      system implementation of SCAP is included as an<br>
      example in the X.1500 appendix, as is a similar<br>
      implementation in Japan known as JVN.<br>
      <br>
      The vision includes the potential development, use, and<br>
      evolution of innumerable numbers of public and private<br>
      security automation schemas for innumerable systems,<br>
      services, and devices - similar in many ways to the<br>
      deployment of network management MIBs over the past 25<br>
      years.&nbsp; The IETF is one of many standards bodies that<br>
      should be developing security content automation schemas, <br>
      and the BOF list plus a scheduled event at the upcoming <br>
      Beijing IETF meeting next month is an important step in <br>
      that direction.<br>
      <br>
      This development was discussed at some length at the<br>
      Tokyo Interim Meeting and there was significant<br>
      enthusiasm for working with IETF (and many other<br>
      standards bodies) in developing these implementations<br>
      for their standards based protocols and services.<br>
      Also demonstrated in Tokyo was the rather remarkable<br>
      work demonstrated by the Japan network security<br>
      community of a RDF-based discovery mechanism for CYBEX<br>
      should be an essential mechanism for enabling use of<br>
      all the many distributed instances of security<br>
      automation schema.&nbsp; The platform is part of a CYBEX<br>
      discovery specification designated X.cybex-discovery.<br>
      In addition, an entire new OID Arc 2.48 has been <br>
      allocated for cybersecurity information exchange <br>
      structured identity purposes.<br>
      <br>
      Dr. Takehashi of NICT, as well as Q4/17 associate<br>
      rapporteur Dr. Kadobayashi of NAIST, who have been<br>
      developing CYBEX related concepts, tools, and<br>
      implementations within Japan's ICT security<br>
      community, will be present in Beijing for the IETF<br>
      meeting, and we hope can contribute to the SCAP BOF.<br>
      <br>
      An introduction to CYBEX is attached that was presented<br>
      last week to the Japan ICT security technical community<br>
      hosted by ISOG-J prior to the ITU-T Interim Meeting. <br>
    </tt><br>
    --tony rutkowski, ITU-T Q.4/17 (cybersecurity) Rapporteur<br>
    <br>
  </body>
</html>

--------------070204070008090607050400--

--------------040605030202070107010401
Content-Type: application/vnd.openxmlformats-officedocument.presentationml.presentation;
 name="ISOG-J_seminar_1.1.pptx"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="ISOG-J_seminar_1.1.pptx"

GgAADWkKAAAA
--------------040605030202070107010401--

Date: Tue, 19 Oct 2010 13:23:32 -0400
From: Sean Turner <[email-masked]>
To: [email-masked]
Subject: [scap_interest] Fwd: I-D ACTION:draft-waltermire-scap-xccdf-00.txt

This is a multi-part message in MIME format.
--------------000901000004060803090604
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Of possible interest to this list.

spt

-------- Original Message --------
Subject: I-D ACTION:draft-waltermire-scap-xccdf-00.txt
Date: Mon, 18 Oct 2010 14:45:01 -0700 (PDT)
From: [email-masked]
Reply-To: [email-masked]
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

	Title		: The Extensible Configuration Checklist Description Format 
(XCCDF) Version 1.1.4
	Author(s)	: D. Waltermire
	Filename	: draft-waltermire-scap-xccdf-00.txt
	Pages		: 70
	Date		: 2010-10-18
	
This document specifies the data model and Extensible Markup
    Language (XML) representation for the Extensible Configuration
    Checklist Description Format (XCCDF) Version 1.1.4. An XCCDF
    document is a structured collection of security configuration rules
    for some set of target systems. The XCCDF specification is designed
    to support information interchange, document generation,
    organizational and situational tailoring, automated compliance
    testing, and compliance scoring. The specification also defines a
    data model and format for storing results of security guidance or
    checklist compliance testing. The intent of XCCDF is to provide a
    uniform foundation for expression of security checklists and other
    configuration guidance, and thereby foster more widespread
    application of good security practices.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-waltermire-scap-xccdf-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--------------000901000004060803090604
Content-Type: Message/External-body;
 name="draft-waltermire-scap-xccdf-00.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="draft-waltermire-scap-xccdf-00.txt"

Content-Type: text/plain
Content-ID: <[email-masked]>

--------------000901000004060803090604
Content-Type: text/plain;
 name="Attached Message Part"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="Attached Message Part"

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

--------------000901000004060803090604--

Date: Tue, 19 Oct 2010 13:23:08 -0400
From: Sean Turner <[email-masked]>
To: [email-masked]
Subject: [scap_interest] Fwd: I-D Action:draft-landfield-scap-naming-00.txt

This is a multi-part message in MIME format.
--------------060506090808010605030503
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Of possible interest to this list.

spt

-------- Original Message --------
Subject: I-D Action:draft-landfield-scap-naming-00.txt
Date: Mon, 18 Oct 2010 13:30:04 -0700 (PDT)
From: [email-masked]
Reply-To: [email-masked]
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.

	Title           : Naming Conventions for Vulnerabilities and 
Configurations
	Author(s)       : K. Landfield
	Filename        : draft-landfield-scap-naming-00.txt
	Pages           : 10
	Date            : 2010-10-18

This document provides an overview of the naming conventions
currently in use for vulnerabilities and configurations.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-landfield-scap-naming-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--------------060506090808010605030503
Content-Type: Message/External-body;
 name="draft-landfield-scap-naming-00.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="draft-landfield-scap-naming-00.txt"

Content-Type: text/plain
Content-ID: <[email-masked]>

--------------060506090808010605030503
Content-Type: text/plain;
 name="Attached Message Part"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="Attached Message Part"

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

--------------060506090808010605030503--

From: <[email-masked]>
To: <[email-masked]>
Date: Wed, 13 Oct 2010 13:22:36 -0500
Accept-Language: en-US
acceptlanguage: en-US
Subject: [scap_interest] Introducing Security Content Automation Protocol (SCAP) to the Internet Engineering Task Force (IETF)

--_000_B277F0D458571E469F8E7AD2DD8A210233D6EE5536AMERDALEXMB1c_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Introducing Security Content Automation Protocol (SCAP) to the Internet Engineering Task Force (IETF)

Overview

>From the beginning, the intent of the SCAP efforts has been to standardize areas allowing for real interoperability between security-related products.  SCAP and its component open data exchange specifications are being used in many different areas of network and computer security today.  From vulnerability management, to policy compliance, system configuration validation, network access, and threat reporting, SCAP usage is evolving and expanding. The security automation potential that SCAP provides is a real opportunity for the computing community to create a foundation of interoperability allowing much greater visibility into the state of our devices and networks.

The potential of SCAP is starting to be realized.  Independent testing labs have now validated SCAP compatibility in 40 products offered by 30 separate software vendors.  Numerous organizations are successfully using these products to reduce costs while improving security.  SCAP content can be and has been localized and is being sold globally.  But the full value of SCAP will only come when it achieves ubiquitous, worldwide adoption.

Additional information about SCAP is available at http://scap.nist.gov.

For this reason, leaders in the SCAP community (including NIST, NSA, MITRE, and commercial vendors) have decided to explore taking the most stable and successful SCAP specifications to the IETF for adoption as Standards Track RFCs.  This is a natural next step in the maturation of these efforts.
The IETF has a history of providing the structure and community needed to make standards efforts successful on a global scale (e.g. TCP, IP, HTTP, and TLS).  The SCAP community has done a good job getting the security automation component specifications to the level it has.  It is time however to widen the participation in these efforts and expand the areas that security automation addresses.

The SCAP specifications have been developed in a "publicly open participation" model. Anyone can participate and contribute. The intent was to assure all had a voice, from the commercial vendors, to the open source community, to governmental organizations and even to the individual contributors who just wanted to be a part of it.  This open dialog has assisted the community in assuring the SCAP specifications met the goals of the efforts and allowed the security community to buy into SCAP more quickly.  We will continue to use this model for the development of new SCAP specifications and capabilities.  For mature, stable specifications, IETF standardization will allow us to expand the circle of participation and adoption more widely.

Therefore, we invite all SCAP participants to join us in this new stage of our effort.  With your help, we can ensure that this stage is a success and that all requirements are properly considered. Read on to learn about the IETF and how you can be involved.

Introduction to the IETF

The IETF has been a cornerstone for the development of Internet protocols since 1986.  On its web site it states:

The Internet Engineering Task Force (IETF) is a large open international community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet architecture and the smooth operation of the Internet. It is open to any interested individual.

The actual technical work of the IETF is done in its working groups, which are organized by topic into several areas (e.g., routing, transport, security, etc.). Much of the work is handled via mailing lists. The IETF holds meetings three times per year.

The IETF's approach to participation and general structure are similar to the approaches SCAP development has used in the past but a bit more elaborate, as behooves an international standards body.    Information for IETF newcomers is available at http://www.ietf.org/newcomers.html. As described there, the first step in starting an IETF effort is a Birds of a Feather session, a BOF. Therefore, an SCAP BOF will be held at the next IETF meeting.

BOF Specifics: SCAP - Synergy of SCAP Program and IETF Activities

BOF Chairs: Steve Hanna, Kent Landfield
Responsible AD: Sean Turner
Location: IETF 79 - Beijing, China<http://www.ietf.org/meeting/79/index.html>

Goal:
Introduce the IETF community to the Security Content Automation Protocol (SCAP), discuss areas of synergy and overlap with IETF activities, and consider whether this technology is sufficiently mature for standardization. Finally, explore whether the IETF would be an appropriate venue for such standardization when ready.

Participating:

The BOF is scheduled for Tuesday, November 16th in the afternoon from 1520-1810, China Standard Time (UTC+8).  If you are unable to attend in person, but are still interested in participating there will be an audio stream available and a jabber room.  Specifics for the audio stream and jabber room will be made available in the near future.

We recognize that the time zone and location for this BOF are not convenient for many SCAP participants.  Rest assured that this is just one step in a lengthy process.  Assuming we proceed to create an SCAP Working Group, there will be many face-to-face meetings at IETF meetings around the world.  And the most important IETF activity happens on the email list anyway.  So there will be plenty of opportunities to participate even if you can't come to the Beijing BOF or participate by audio and jabber.

Internet Drafts:
Internet drafts (the first stage in the IETF standardization process) are in development focusing on XCCDF 1.1.4 and enumeration formats for CVE and CCE. We are targeting specifications for introduction to the IETF which we believe are well understood in the SCAP community.  For example, XCCDF is very stable, well documented and implemented by multiple vendors. Formats for the existing enumerations such as CVE and CCE are good candidates as well.  Note we are only talking about the actual enumeration formats, not the operational uses/administration of the enumerations.  That would remain outside the IETF, as it is today.

For more information on the BOF see the IETF BOFs page at

http://trac.tools.ietf.org/bof/trac/wiki/WikiStart#Security

To learn more about the IETF and its operations, take a look at http://www.ietf.org/tao.html.

How to participate

Please join us!

As a community, we need to assure the standards we depend on are vetted and recognized internationally. Working within the IETF allows us to build on the good work done within the SCAP community and establish a foundation for a globally recognized security automation framework.

We must ensure that the voices of experienced SCAP community members are well represented within the IETF standardization efforts.  IETF operates on the principles of rough consensus and running code.  We applaud this practical engineering approach, which echoes the practical approach taken with SCAP.  In order to ensure that our experience and expertise is properly considered during the IETF efforts, we MUST participate actively in the IETF process.  Therefore, it is essential for all of us who have been actively participating in SCAP development to also participate in the IETF SCAP effort moving forward.  As such a mailing list has been set up to discuss working with the IETF and to show your interest in the effort.  The IETF judges rough consensus based on email discussions NOT on face-to-face meeting attendance or voting. Therefore, it is ESSENTIAL that you join the SCAP mailing list and participate actively.  The mailing list is located at [email-masked]<mailto:[email-masked]>. The IETF uses Mailman to manage its mailing lists so to subscribe, fill in your information at https://www.ietf.org/mailman/listinfo/scap_interest. You will then receive a confirmation message in your inbox you will need to respond to in order to complete your subscription request.

Subscribe today!  Participate actively, especially on the email list!  We need your continued support to advance SCAP and security automation even further.

--
Kent Landfield
Director, Content Strategy, Architecture and Standards
McAfee, Inc.
+1 972.963.7096 Direct
+1 817.637.8026 Mobile
[email-masked]<mailto:[email-masked]>

--_000_B277F0D458571E469F8E7AD2DD8A210233D6EE5536AMERDALEXMB1c_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Cambria;
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Verdana;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
	{font-family:Consolas;
	panose-1:2 11 6 9 2 2 4 3 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
	{mso-style-priority:99;
	mso-style-link:"Plain Text Char";
	margin:0in;
	margin-bottom:.0001pt;
	font-size:10.5pt;
	font-family:Consolas;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
span.PlainTextChar
	{mso-style-name:"Plain Text Char";
	mso-style-priority:99;
	mso-style-link:"Plain Text";
	font-family:Consolas;}
.MsoChpDefault
	{mso-style-type:export-only;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
 <o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
 <o:shapelayout v:ext="edit">
  <o:idmap v:ext="edit" data="1" />
 </o:shapelayout></xml><![endif]-->
</head>

<body lang=EN-US link=blue vlink=purple>

<div class=WordSection1>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal><b><span style='font-size:14.0pt;font-family:"Cambria","serif"'>Introducing
Security Content Automation Protocol (SCAP) to the Internet Engineering Task
Force (IETF)<o:p></o:p></span></b></p>

<p class=MsoNormal><b><span style='font-size:14.0pt;font-family:"Cambria","serif"'><o:p>&nbsp;</o:p></span></b></p>

<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Cambria","serif"'>Overview<o:p></o:p></span></b></p>

<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Cambria","serif"'><o:p>&nbsp;</o:p></span></b></p>

<p class=MsoNormal>From the beginning, the intent of the SCAP efforts has been
to standardize areas allowing for real interoperability between
security-related products.&nbsp; SCAP and its component open data exchange
specifications are being used in many different areas of network and computer
security today.&nbsp; From vulnerability management, to policy compliance,
system configuration validation, network access, and threat reporting, SCAP
usage is evolving and expanding. The security automation potential that SCAP
provides is a real opportunity for the computing community to create a
foundation of interoperability allowing much greater visibility into the state
of our devices and networks.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>The potential of SCAP is starting to be realized.&nbsp;
Independent testing labs have now validated SCAP compatibility in 40 products
offered by 30 separate software vendors.&nbsp; Numerous organizations are
successfully using these products to reduce costs while improving security.
&nbsp;SCAP content can be and has been localized and is being sold
globally.&nbsp; But the full value of SCAP will only come when it achieves
ubiquitous, worldwide adoption. <o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>Additional information about SCAP is available at <a
href="http://scap.nist.gov">http://scap.nist.gov</a>.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>For this reason, leaders in the SCAP community (including
NIST, NSA, MITRE, and commercial vendors) have decided to explore taking the
most stable and successful SCAP specifications to the IETF for adoption as
Standards Track RFCs.&nbsp; This is a natural next step in the maturation of
these efforts.<o:p></o:p></p>

<p class=MsoNormal>The IETF has a history of providing the structure and
community needed to make standards efforts successful on a global scale (e.g.
TCP, IP, HTTP, and TLS).&nbsp; The SCAP community has done a good job getting
the security automation component specifications to the level it has.&nbsp; It
is time however to widen the participation in these efforts and expand the
areas that security automation addresses. <o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>The SCAP specifications have been developed in a
&#8220;publicly open participation&#8221; model. Anyone can participate and
contribute. The intent was to assure all had a voice, from the commercial
vendors, to the open source community, to governmental organizations and even
to the individual contributors who just wanted to be a part of it.&nbsp; This
open dialog has assisted the community in assuring the SCAP specifications met
the goals of the efforts and allowed the security community to buy into SCAP
more quickly.&nbsp; We will continue to use this model for the development of
new SCAP specifications and capabilities.&nbsp; For mature, stable
specifications, IETF standardization will allow us to expand the circle of
participation and adoption more widely.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>Therefore, we invite all SCAP participants to join us in
this new stage of our effort.&nbsp; With your help, we can ensure that this
stage is a success and that all requirements are properly considered. Read on
to learn about the IETF and how you can be involved.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Cambria","serif"'>Introduction
to the IETF<o:p></o:p></span></b></p>

<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Cambria","serif"'><o:p>&nbsp;</o:p></span></b></p>

<p class=MsoNormal>The IETF has been a cornerstone for the development of
Internet protocols since 1986.&nbsp; On its web site it states:<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal style='margin-left:.5in'><i>The Internet Engineering Task
Force (IETF) is a large open international community of network designers,
operators, vendors, and researchers concerned with the evolution of the
Internet architecture and the smooth operation of the Internet. It is open to
any interested individual.<o:p></o:p></i></p>

<p class=MsoNormal style='margin-left:.5in'><i><o:p>&nbsp;</o:p></i></p>

<p class=MsoNormal style='margin-left:.5in'><i>The actual technical work of the
IETF is done in its working groups, which are organized by topic into several
areas (e.g., routing, transport, security, etc.). Much of the work is handled
via mailing lists. The IETF holds meetings three times per year.<o:p></o:p></i></p>

<p class=MsoNormal style='margin-left:.5in'><i><o:p>&nbsp;</o:p></i></p>

<p class=MsoNormal>The IETF&#8217;s approach to participation and general
structure are similar to the approaches SCAP development has used in the past
but a bit more elaborate, as behooves an international standards
body.&nbsp;&nbsp;&nbsp; Information for IETF newcomers is available at <a
href="http://www.ietf.org/newcomers.html">http://www.ietf.org/newcomers.html</a>.
As described there, the first step in starting an IETF effort is a Birds of a
Feather session, a BOF. Therefore, an SCAP BOF will be held at the next IETF
meeting.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Cambria","serif"'>BOF
Specifics: </span>SCAP - Synergy of SCAP Program and IETF Activities<o:p></o:p></b></p>

<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Cambria","serif"'><o:p>&nbsp;</o:p></span></b></p>

<p class=MsoNormal>BOF Chairs: Steve Hanna, Kent Landfield<o:p></o:p></p>

<p class=MsoNormal>Responsible AD: Sean Turner<o:p></o:p></p>

<p class=MsoNormal>Location: <a href="http://www.ietf.org/meeting/79/index.html">IETF
79 &#8211; Beijing, China</a><o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>Goal:<o:p></o:p></p>

<p class=MsoNormal>Introduce the IETF community to the Security Content
Automation Protocol (SCAP), discuss areas of synergy and overlap with IETF activities,
and consider whether this technology is sufficiently mature for
standardization. Finally, explore whether the IETF would be an appropriate
venue for such standardization when ready.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoPlainText><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Participating:<o:p></o:p></span></p>

<p class=MsoPlainText><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>The
BOF is scheduled for Tuesday, November 16th in the afternoon from 1520-1810,
China Standard Time (UTC+8).&nbsp; If you are unable to attend in person, but
are still interested in participating there will be an audio stream available
and a jabber room.&nbsp; Specifics for the audio stream and jabber room will be
made available in the near future.<o:p></o:p></span></p>

<p class=MsoPlainText><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p>&nbsp;</o:p></span></p>

<p class=MsoPlainText><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>We
recognize that the time zone and location for this BOF are not convenient for
many SCAP participants.&nbsp; Rest assured that this is just one step in a
lengthy process.&nbsp; Assuming we proceed to create an SCAP Working Group,
there will be many face-to-face meetings at IETF meetings around the
world.&nbsp; And the most important IETF activity happens on the email list
anyway.&nbsp; So there will be plenty of opportunities to participate even if
you can&#8217;t come to the Beijing BOF or participate by audio and jabber.<o:p></o:p></span></p>

<p class=MsoPlainText><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p>&nbsp;</o:p></span></p>

<p class=MsoPlainText><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Internet
Drafts:<o:p></o:p></span></p>

<p class=MsoNormal>Internet drafts (the first stage in the IETF standardization
process) are in development focusing on XCCDF 1.1.4 and enumeration formats for
CVE and CCE. We are targeting specifications for introduction to the IETF which
we believe are well understood in the SCAP community.&nbsp; For example, XCCDF
is very stable, well documented and implemented by multiple vendors. Formats
for the existing enumerations such as CVE and CCE are good candidates as well.&nbsp;
Note we are only talking about the actual enumeration formats, not the
operational uses/administration of the enumerations.&nbsp; That would remain
outside the IETF, as it is today.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>For more information on the BOF see the IETF BOFs page at <o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal><a
href="http://trac.tools.ietf.org/bof/trac/wiki/WikiStart#Security">http://trac.tools.ietf.org/bof/trac/wiki/WikiStart#Security</a><o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>To learn more about the IETF and its operations, take a look
at <a href="http://www.ietf.org/tao.html">http://www.ietf.org/tao.html</a>.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Cambria","serif"'>How
to participate<o:p></o:p></span></b></p>

<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Cambria","serif"'><o:p>&nbsp;</o:p></span></b></p>

<p class=MsoNormal><b>Please join us!&nbsp; </b><b><o:p></o:p></b></p>

<p class=MsoNormal><b><o:p>&nbsp;</o:p></b></p>

<p class=MsoNormal>As a community, we need to assure the standards we depend on
are vetted and recognized internationally. Working within the IETF allows us to
build on the good work done within the SCAP community and establish a foundation
for a globally recognized security automation framework.&nbsp; <o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>We must ensure that the voices of experienced SCAP community
members are well represented within the IETF standardization efforts.&nbsp;
IETF operates on the principles of rough consensus and running code.&nbsp; We
applaud this practical engineering approach, which echoes the practical
approach taken with SCAP.&nbsp; In order to ensure that our experience and
expertise is properly considered during the IETF efforts, we MUST participate
actively in the IETF process.&nbsp; Therefore, it is essential for all of us
who have been actively participating in SCAP development to also participate in
the IETF SCAP effort moving forward.&nbsp; As such a mailing list has been set
up to discuss working with the IETF and to show your interest in the
effort.&nbsp; The IETF judges rough consensus based on email discussions NOT on
face-to-face meeting attendance or voting. Therefore, it is ESSENTIAL that you
join the SCAP mailing list and participate actively.&nbsp; The mailing list is
located at <a href="mailto:[email-masked]">[email-masked]</a>.
The IETF uses Mailman to manage its mailing lists so to subscribe, fill in your
information at <a href="https://www.ietf.org/mailman/listinfo/scap_interest">https://www.ietf.org/mailman/listinfo/scap_interest</a>.
You will then receive a confirmation message in your inbox you will need to
respond to in order to complete your subscription request.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal>Subscribe today!&nbsp; Participate actively, especially on
the email list!&nbsp; We need your continued support to advance SCAP and
security automation even further.<o:p></o:p></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

<p class=MsoNormal><span style='font-size:9.0pt;font-family:"Verdana","sans-serif"'>--</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>

<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";
color:#666666'>Kent Landfield</span></b><span style='font-size:10.0pt;
font-family:"Arial","sans-serif"'><br>
</span><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";
color:#666666'>Director, Content Strategy, Architecture and Standards </span><span
style='font-family:"Arial","sans-serif"'><br>
</span><b><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";
color:#CC0033'>McAfee, Inc.</span></b><span style='font-family:"Verdana","sans-serif";
color:#666666'><br>
</span><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";
color:#666666'>+1 972.963.7096 Direct</span><span style='font-size:9.0pt;
font-family:"Verdana","sans-serif"'><br>
</span><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";
color:#666666'>+1&nbsp;817.637.8026 Mobile</span><span style='font-size:7.5pt;
font-family:"Verdana","sans-serif"'><br>
<a href="mailto:[email-masked]">[email-masked]</a><o:p></o:p></span></p>

<p class=MsoNormal><o:p>&nbsp;</o:p></p>

</div>

</body>

</html>

--_000_B277F0D458571E469F8E7AD2DD8A210233D6EE5536AMERDALEXMB1c_--

Date: Fri, 08 Oct 2010 17:09:45 -0400
From: Sean Turner <[email-masked]>
To: "Baker, Jon" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [scap_interest] IETF 79: Session Time Slot

Are you asking whether you'll be able to call in and speak during the 
session?  We've run WebEx in the past, but we've had it only so that 
you can follow along with the slides.  When we've tried to allow 
remote participation with audio it's worked, well, very poorly.

spt

Baker, Jon wrote:
> Will there be a conference call to support this?
> 
> Jon 
> 
> ======================
> Jonathan O. Baker
> G022 - IA Industry Collaboration
> The MITRE Corporation
> Email: [email-masked]
> 
> 
>> -----Original Message-----
>> From: [email-masked] [mailto:scap_interest-
>> [email-masked]] On Behalf Of Sean Turner
>> Sent: Friday, October 08, 2010 3:23 PM
>> To: Gary Gapinski
>> Cc: [email-masked]
>> Subject: Re: [scap_interest] IETF 79: Session Time Slot
>>
>> Gary Gapinski wrote:
>>> On 10/08/2010 02:27 PM, Sean Turner wrote:
>>>> The most up to date agenda for IETF 79 can be found here:
>>>> http://www.ietf.org/meeting/79/index.html.  It currently has the SCAP
>>>> BOF scheduled for Tuesday afternoon from 1520-1810.
>>>>
>>> Is that 1520-1810 UTC+8 (Beijing)?
>> The time listed is local Beijing time.  From the EST, I think it'll be
>> 13 hours ahead when the session happens.
>>
>> spt
>> _______________________________________________
>> scap_interest mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/scap_interest
> 

From: "Baker, Jon" <[email-masked]>
To: Sean Turner <[email-masked]>
Date: Fri, 8 Oct 2010 16:22:42 -0400
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [scap_interest] IETF 79: Session Time Slot

Will there be a conference call to support this?

Jon 

============================================
Jonathan O. Baker
G022 - IA Industry Collaboration
The MITRE Corporation
Email: [email-masked]

>-----Original Message-----
>From: [email-masked] [mailto:scap_interest-
>[email-masked]] On Behalf Of Sean Turner
>Sent: Friday, October 08, 2010 3:23 PM
>To: Gary Gapinski
>Cc: [email-masked]
>Subject: Re: [scap_interest] IETF 79: Session Time Slot
>
>Gary Gapinski wrote:
>> On 10/08/2010 02:27 PM, Sean Turner wrote:
>>> The most up to date agenda for IETF 79 can be found here:
>>> http://www.ietf.org/meeting/79/index.html.  It currently has the SCAP
>>> BOF scheduled for Tuesday afternoon from 1520-1810.
>>>
>>
>> Is that 1520-1810 UTC+8 (Beijing)?
>
>The time listed is local Beijing time.  From the EST, I think it'll be
>13 hours ahead when the session happens.
>
>spt
>_______________________________________________
>scap_interest mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/scap_interest

Date: Fri, 08 Oct 2010 15:22:36 -0400
From: Sean Turner <[email-masked]>
To: Gary Gapinski <[email-masked]>
Cc: [email-masked]
Subject: Re: [scap_interest] IETF 79: Session Time Slot

Gary Gapinski wrote:
> On 10/08/2010 02:27 PM, Sean Turner wrote:
>> The most up to date agenda for IETF 79 can be found here: 
>> http://www.ietf.org/meeting/79/index.html.  It currently has the SCAP 
>> BOF scheduled for Tuesday afternoon from 1520-1810.
>>   
> 
> Is that 1520-1810 UTC+8 (Beijing)?

The time listed is local Beijing time.  From the EST, I think it'll be 
13 hours ahead when the session happens.

spt

Date: Fri, 8 Oct 2010 14:50:00 -0400
From: Gary Gapinski <[email-masked]>
To: <[email-masked]>
Subject: Re: [scap_interest] IETF 79: Session Time Slot

On 10/08/2010 02:27 PM, Sean Turner wrote:
> The most up to date agenda for IETF 79 can be found here: 
> http://www.ietf.org/meeting/79/index.html.  It currently has the SCAP 
> BOF scheduled for Tuesday afternoon from 1520-1810.
>   

Is that 1520-1810 UTC+8 (Beijing)?

Date: Fri, 08 Oct 2010 14:27:12 -0400
From: Sean Turner <[email-masked]>
To: [email-masked]
Subject: [scap_interest] IETF 79: Session Time Slot

The most up to date agenda for IETF 79 can be found here: 
http://www.ietf.org/meeting/79/index.html.  It currently has the SCAP 
BOF scheduled for Tuesday afternoon from 1520-1810.  If you are unable 
to attend in person, but are still interested in participating there 
will be an audio stream available and a jabber room.  Specifics for 
the audio stream and jabber room will follow.

spt