1. INCident Handling BOF (INCH) 0900-1130 Thursday, March 21. 2002 IETF 53

2. March 21. 2002IETF 532 INCH BOF Agenda PREAMBLE 1. Agenda Bashing, Introduction, Minutes Taker – Danyliw -- 5 min. 2. INCH Status Report and News – Danyliw – 5 min. PRESENTATIONS 3. Terena IODEF Working Group Status Report – Meijer – 15 min 4. DMTF Common Support Schema – Rafalowi – 20 min FUTURE 5. Discuss requirement document (RFC 3067, new requirements) – 30 min 6. Discuss data model document (IODEF, high-level data elements) – 45 min 7. Discussions and Plans for the Future – 15 min

3. March 21. 2002IETF 533 INCH Status (Timeline) 12/10/2001 : IETF 52 – BOF #1 12/17 – 01/21/2002 : Charter Discussion 01/21/2002 : Charter Submitted 03/21/2002 : IETF 53 – BOF #2 We wait for IESG approval …

4. March 21. 2002IETF 534 Charter Review: Goals Define data formats for communication between –a CSIRT and its constituency (e.g., users, customers, trusted reporters) which reports system misuse; –a CSIRT and parties involved in an incident investigation (e.g., law enforcement, attacking site); and –collaborating CSIRTs sharing information.

5. March 21. 2002IETF 535 Charter Review: Deliverables 1. A document describing the high-level functional requirements of a data format … 2. A specification of the extensible, incident data language that describes the data formats that satisfy the requirements. 3. Guidelines for implementing the data format 4. A set of sample incident reports …

6. March 21. 2002IETF 536 Other News Terena IODEF-WG disbanded W3C XML signing standard

7. March 21. 2002IETF 537 Requirements Document Are we happy with RFC 3067? –Reuse outright? –Reuse and Modify? –Ignore and start over? –Others? Volunteers?

8. March 21. 2002IETF 538 Mailing List Lifetime of a document instance Is an archiving format? Wire-format?

9. March 21. 2002IETF 539 Data Model Is it premature to discuss without the requirements? Reuse of IODEF –Reuse outright? –Reuse and Modify? –Ignore and start over? –Others?

10. March 21. 2002IETF 5310 Mailing List -- General Represent analysis results Represent vulnerability reports Sanitization Diverse Evidence Support

11. March 21. 2002IETF 5311 Mailing List -- IODEF Degree of IDMEF compatibility Self-documentation (History class) Setting restrictions on data usage Constructs to support document updates Impact and Confidence representation “Purpose” (attribute) of an incident

12. March 21. 2002IETF 5312 Mailing List Post: inch@nic.surfnet.nl Archive: http://listserv.surfnet.nl/archives/inch.html Subscribe: send mail to listserv@nic.surfnet.nl with "subscribe inch " in the body