Subject: [scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation

From: Tony Rutkowski <[email-masked]>
Date: Wed, 20 Oct 2010 16:30:20 -0400

Dear all,

At the ITU-T cybersecurity standards group (Q4/17)
interim meeting in Tokyo last week, the participants
noted the new effort to introduce into the IETF some of
the systems assurance standards under the general aegis
the SCAP BOF and this interest list.

An effort leveraging the same concepts and underlying
standardization work was started within the ITU-T last
year among an array of industry and government
participants and organizations for outlining ways of
sharing and exchanging structured information, that is
called the Cybersecurity Information Exchange Framework
or CYBEX for short.  CYBEX identified the entire array
of information assurance, incident response, forensics
and trust specifications - most of which were in use or
under development in the respective communities - as
part of this Framework.   The CYBEX framework is
scheduled for approval as as Recommendation ITU-T
X.1500, together with CVE and CVSS as X.1520 and X.1521
respectively.  Many others are in various stages of
maturity.  The editors of X.1500 include US DHS,
Japan's NICT, MITRE, Microsoft, FIRST, Cisco, and Yaana
Technologies.

Part of that framework of course includes the use of
security automation schemas such as SCAP as a means
to facilitate systems, services, devices of all kinds
to make them "measurably" secure as to potential
vulnerabilities and threats.  The U.S. federal
system implementation of SCAP is included as an
example in the X.1500 appendix, as is a similar
implementation in Japan known as JVN.

The vision includes the potential development, use, and
evolution of innumerable numbers of public and private
security automation schemas for innumerable systems,
services, and devices - similar in many ways to the
deployment of network management MIBs over the past 25
years.  The IETF is one of many standards bodies that
should be developing security content automation schemas,
and the BOF list plus a scheduled event at the upcoming
Beijing IETF meeting next month is an important step in
that direction.

This development was discussed at some length at the
Tokyo Interim Meeting and there was significant
enthusiasm for working with IETF (and many other
standards bodies) in developing these implementations
for their standards based protocols and services.
Also demonstrated in Tokyo was the rather remarkable
work demonstrated by the Japan network security
community of a RDF-based discovery mechanism for CYBEX
should be an essential mechanism for enabling use of
all the many distributed instances of security
automation schema.  The platform is part of a CYBEX
discovery specification designated X.cybex-discovery.
In addition, an entire new OID Arc 2.48 has been
allocated for cybersecurity information exchange
structured identity purposes.

Dr. Takehashi of NICT, as well as Q4/17 associate
rapporteur Dr. Kadobayashi of NAIST, who have been
developing CYBEX related concepts, tools, and
implementations within Japan's ICT security
community, will be present in Beijing for the IETF
meeting, and we hope can contribute to the SCAP BOF.

An introduction to CYBEX is attached that was presented
last week to the Japan ICT security technical community
hosted by ISOG-J prior to the ITU-T Interim Meeting.

--tony rutkowski, ITU-T Q.4/17 (cybersecurity) Rapporteur

---

From: Sean Turner <[email-masked]>
Date: Wed, 20 Oct 2010 16:48:09 -0400

Also note that there is the following draft:

https://datatracker.ietf.org/doc/draft-takahashi-cybex-intro/

spt

On 10/20/10 4:30 PM, Tony Rutkowski wrote:
> _______________________________________________
> scap_interest mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scap_interest

---

From: Michael Chernin <[email-masked]>
Date: Thu, 21 Oct 2010 13:01:47 -0400

Tony -

I am trying to wrap my head around the CYBEX standard. Is this standard 
creating new standards that replace existing SCAP standards ? Or is this 
standard using existing SCAP standards as it's core? Or does this standard 
simply not care what standard is being used at it's core, as long as its a 
standard? How does the CYBEX standard impact the SCAP interest list and 
SCAP's future with the IETF?

I viewed the presentation that was attached, but it was difficult to 
determine the message without hearing the details that were given during 
the presentation.

Aharon
---------------------------------------------------
Michael "Aharon" Chernin
Security Automation Program Manager
Corporate Information Security -Depository Trust & Clearing Corporation
[email-masked]

Tony Rutkowski <[email-masked]> 
Sent by: [email-masked]
10/20/2010 04:30 PM
Please respond to
[email-masked]

To
[email-masked]
cc
Malcolm Johnson <[email-masked]>, [email-masked]
Subject
[scap_interest] IETF SCAP and ITU-T CYBEX synergies and cooperation

Dear all,

<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are
confidential and intended solely for the use of the individual or
entity to whom they are addressed. If you have received this email
in error, please notify us immediately and delete the email and any
attachments from your system. The recipient should check this email
and any attachments for the presence of viruses.  The company
accepts no liability for any damage caused by any virus transmitted
by this email.</FONT>

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 21 Oct 2010 13:51:02 -0400

Hi Michael,

> I am trying to wrap my head around the CYBEX standard. Is this 
> standard creating new standards that replace existing SCAP standards ? 
> Or is this standard using existing SCAP standards as it's core? Or 
> does this standard simply not care what standard is being used at it's 
> core, as long as its a standard? How does the CYBEX standard impact 
> the SCAP interest list and SCAP's future with the IETF?

First, the CYBEX work is not trying to replace anything!
It's attempting to establish a rough global consensus on
1) a comprehensive, coherent conceptualization of
cybersecurity, and 2) an interoperable, extensible set
of related structured information exchange and associated
discovery and trust specifications

Second, we found over the past year that the term "SCAP
standards" was used very differently in diverse forums
and seems to constantly evolve.   So our ITU-T group chose
to refer to these various usages as "security automation"
schema use cases or tools, and we've begun to avoid
using SCAP.  This also avoids any conflicts with NIST's
SCAP implementation(s) for US federal networks and systems.

In addition, CYBEX clearly encompasses much more than
just security automation.

If one assumes that the SCAP interest list and the resulting
IETF work involves potential application of the various
MITRE/CNIS/FIRST specifications to implementations of IETF
protocols, there is mutual interest in adopting common
conceptualizations and approaches to the extent desired.

There is also value in looking at how other bodies and
user communities are innovating with and implementing
these specifications.  The Japan ISOG-J/NICT example
is a notable one.  Trusted discovery of all the autonomous,
diverse security automation schema is a major emerging
challenge they are especially focussing on.

For reference purposes, it's also useful to know that those
specifications are also being instantiated in ITU-T versions
that will be available in six languages, freely available
online, and evangelized for global cybersecurity use.

Hope this helps.

--tony