Subject: [sacm] ROLIE vulnerability extension

From: Adam Montville <[email-masked]>
Date: Thu, 01 Jun 2017 14:41:46 +0000

Wondering if anyone is working on a ROLIE extension for vulnerability
detection data? Specifically for OVAL vulnerability definitions.

Thanks,

Adam

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Thu, 1 Jun 2017 16:53:01 +0000

Not yet. I am also interested in addressing vulnerability records, but I have been waiting for the outcome of the OASIS CVRF/CSAF work first.

We could collaborate if you are interested.

Regards,
Dave

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Thursday, June 01, 2017 10:42 AM
To: [email-masked]; <[email-masked]> <[email-masked]>
Subject: [sacm] ROLIE vulnerability extension

Wondering if anyone is working on a ROLIE extension for vulnerability detection data? Specifically for OVAL vulnerability definitions.

Thanks,

Adam

---

From: Adam Montville <[email-masked]>
Date: Thu, 01 Jun 2017 16:58:34 +0000

Is there anything already defined that would suit the more general need? In
other words, while it's true that ROLIE doesn't have a vulnerability record
or vulnerability detection data extension at this point, is there a
non-ROLIE capability filling that need already?

On Thu, Jun 1, 2017 at 11:53 AM Waltermire, David A. (Fed) <
[email-masked]> wrote:

> Not yet. I am also interested in addressing vulnerability records, but I
> have been waiting for the outcome of the OASIS CVRF/CSAF work first.
>
>
>
> *From:* sacm [mailto:[email-masked]] *On Behalf Of *Adam Montville
> *Sent:* Thursday, June 01, 2017 10:42 AM
> *To:* [email-masked]; <[email-masked]> <[email-masked]>
> *Subject:* [sacm] ROLIE vulnerability extension
>
>
>

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Thu, 1 Jun 2017 18:14:18 +0000

I am not aware of anything that is providing a syndication approach for vulnerability information. I am also not aware of a general standardized model for vulnerabilities that can be used cradle to grave for a vulnerability. This is something we have been discussing in OASIS CSAF. At NIST we have a vulnerability model we use with the National Vulnerability Database, but it isn’t anything near a standard at this point.

One way to approach the fact that we don’t have a standardized format is to not attempt to pick any at this time. The ROLIE vulnerability extension can define a number of information types that relate to vulnerabilities (e.g., vulnerability records, vulnerability checks, etc.) and then stay silent on the use of the ROLIE format element which can be used to specify which model (e.g., CVRF, CSAF, STIX, OVAL, etc.) is used for a given entry. Defining information types in this way provides a good degree of value by allowing organizations to publish vulnerability information using ROLIE. Do you think that this may be enough to start with for now?

Regards,
Dave

From: Adam Montville [mailto:[email-masked]]
Sent: Thursday, June 01, 2017 12:59 PM
To: Waltermire, David A. (Fed) <[email-masked]>; [email-masked]; <[email-masked]> <[email-masked]>
Subject: Re: [sacm] ROLIE vulnerability extension

Is there anything already defined that would suit the more general need? In other words, while it's true that ROLIE doesn't have a vulnerability record or vulnerability detection data extension at this point, is there a non-ROLIE capability filling that need already?

On Thu, Jun 1, 2017 at 11:53 AM Waltermire, David A. (Fed) <[email-masked]<mailto:[email-masked]>> wrote:
Not yet. I am also interested in addressing vulnerability records, but I have been waiting for the outcome of the OASIS CVRF/CSAF work first.

Regards,
Dave

From: sacm [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Adam Montville
Sent: Thursday, June 01, 2017 10:42 AM
To: [email-masked]<mailto:[email-masked]>; <[email-masked]<mailto:[email-masked]>> <[email-masked]<mailto:[email-masked]>>
Subject: [sacm] ROLIE vulnerability extension

Thanks,

Adam

---

From: Jerome Athias <[email-masked]>
Date: Fri, 02 Jun 2017 02:03:57 -0400

Yes, we are in 2017 and the industry still not yet cam up with a standardized common model for Vulnerability...

I could be ok with David proposed approach.

Just to point out how it was envisioned in STIX v1
https://stixproject.github.io/data-model/1.2/indicator/TestMechanismsType/

3. OVAL: The OVAL test mechanism allows for the specification of an OVAL definition through importing the OVAL schemas. The type is named OVALTestMechanismType and is in the http://stix.mitre.org/extensions/TestMechanism#OVAL-1 namespace. The extension is defined in the file extensions/test_mechanism/oval-5.10.1_test_mechanism.xsd or at the URL http://stix.mitre.org/XMLSchema/extensions/test_mechanism/oval-5.10.1/1.2/oval-5.10.1_test_mechanism.xsd.

-------- Original Message --------
Subject: Re: [sacm] ROLIE vulnerability extension
Local Time: June 1, 2017 9:14 PM
UTC Time: June 1, 2017 6:14 PM
From: [email-masked]
To: Adam Montville <[email-masked]>, [email-masked] <[email-masked]>, [email-masked]

Regards,

Dave

On Thu, Jun 1, 2017 at 11:53 AM Waltermire, David A. (Fed) <[email-masked]> wrote:

Regards,

Dave

Thanks,

Adam

---

From: Adam Montville <[email-masked]>
Date: Fri, 02 Jun 2017 11:29:32 +0000

Thanks for your perspective, Jerome. When I originally asked the question,
I was asking with an eye toward STIX and more specifically, TAXII. It seems
that TAXII doesn't have the syndication that ROLIE does, but that it may
(I'm not a TAXII expert) provide an appropriate mechanism. That's not to
say ROLIE wouldn't need something, but I did want to understand how high a
priority it was to start looking at this type of ROLIE extension.

Adam

On Fri, Jun 2, 2017 at 1:04 AM Jerome Athias <[email-masked]>
wrote:

> Yes, we are in 2017 and the industry still not yet cam up with a
> standardized common model for Vulnerability...
>
> 3. OVAL: The OVAL test mechanism allows for the specification of an OVAL
> definition through importing the OVAL schemas. The type is named
> OVALTestMechanismType and is in the
> http://stix.mitre.org/extensions/TestMechanism#OVAL-1 namespace. The
> extension is defined in the file
> extensions/test_mechanism/oval-5.10.1_test_mechanism.xsd or at the URL
> http://stix.mitre.org/XMLSchema/extensions/test_mechanism/oval-5.10.1/1.2/oval-5.10.1_test_mechanism.xsd
> .
>
>
>
> I am not aware of anything that is providing a syndication approach for
> vulnerability information. I am also not aware of a general standardized
> model for vulnerabilities that can be used cradle to grave for a
> vulnerability. This is something we have been discussing in OASIS CSAF. At
> NIST we have a vulnerability model we use with the National Vulnerability
> Database, but it isn’t anything near a standard at this point.
>
>
>
> One way to approach the fact that we don’t have a standardized format is
> to not attempt to pick any at this time. The ROLIE vulnerability extension
> can define a number of information types that relate to vulnerabilities
> (e.g., vulnerability records, vulnerability checks, etc.) and then stay
> silent on the use of the ROLIE format element which can be used to specify
> which model (e.g., CVRF, CSAF, STIX, OVAL, etc.) is used for a given entry.
> Defining information types in this way provides a good degree of value by
> allowing organizations to publish vulnerability information using ROLIE. Do
> you think that this may be enough to start with for now?
>
>
>
> Regards,
>
> Dave
>
>
>
> *From:* Adam Montville [mailto:[email-masked]]
> *Sent:* Thursday, June 01, 2017 12:59 PM
> *To:* Waltermire, David A. (Fed) <[email-masked]>;
> [email-masked]; <[email-masked]> <[email-masked]>
> *Subject:* Re: [sacm] ROLIE vulnerability extension
>
>
>
> Is there anything already defined that would suit the more general need?
> In other words, while it's true that ROLIE doesn't have a vulnerability
> record or vulnerability detection data extension at this point, is there a

---

From: Jerome Athias <[email-masked]>
Date: Fri, 02 Jun 2017 08:35:52 -0400

Regarding TAXII comparison, that would be a Resource-oriented vs Message-oriented architecture discussion. (that we had in late 2015 in CTI)
Back then TAXII v1 were just transporting STIXv1, and STIXv1 had that (OVAL) in its information model.
Now STIXv2 (current) does not have that (OVAL) in its current information model anymore, but TAXII v2 now intends to provide what ROLIE does (via Atom) via a REST API

-------- Original Message --------
Subject: Re: [sacm] ROLIE vulnerability extension
Local Time: June 2, 2017 2:29 PM
UTC Time: June 2, 2017 11:29 AM
From: [email-masked]
To: Jerome Athias <[email-masked]>, "Waltermire, David A. (Fed)" <[email-masked]>
[email-masked] <[email-masked]>, [email-masked] <[email-masked]>

Thanks for your perspective, Jerome. When I originally asked the question, I was asking with an eye toward STIX and more specifically, TAXII. It seems that TAXII doesn't have the syndication that ROLIE does, but that it may (I'm not a TAXII expert) provide an appropriate mechanism. That's not to say ROLIE wouldn't need something, but I did want to understand how high a priority it was to start looking at this type of ROLIE extension.

Adam

On Fri, Jun 2, 2017 at 1:04 AM Jerome Athias <[email-masked]> wrote:
Yes, we are in 2017 and the industry still not yet cam up with a standardized common model for Vulnerability...

-------- Original Message --------
Subject: Re: [sacm] ROLIE vulnerability extension
Local Time: June 1, 2017 9:14 PM
UTC Time: June 1, 2017 6:14 PM
From: [email-masked]
To: Adam Montville <[email-masked]>, [email-masked] <[email-masked]>, [email-masked]

Regards,

Dave

Regards,

Dave

Thanks,

Adam