INCH Requirements Glenn Mansfield Keeni Cyber Solutions Inc IDS 研究会 14/12/99　　 INCH Requirements Glenn Mansfield Keeni Cyber Solutions Inc (glenn@cysols.com) Hiroyuki Ohno Wide Project (hohno@wide.ad.jp) IETF-55 Atlanta, November, 2002 Glenn　M.

Based on a review of RFC3067 CERT Processes IDWG requirements IDS 研究会 14/12/99　　 Based on a review of RFC3067 CERT Processes IDWG requirements Glenn　M.

Operational Model CSIRT Other CSIRTs Incident Report Database IDS 研究会 14/12/99　　 Operational Model Other CSIRTs CSIRT Incident Report Database Glenn　M.

Operational Model-2 Alerts, Reports Statistics CSIRT Other CSIRTs IDS 研究会 14/12/99　　 Operational Model-2 Other CSIRTs CSIRT Incident Report Database Alerts, Reports Statistics Glenn　M.

Incident Report Handling Requirements: Changes from RFC3067 IDS 研究会 14/12/99　　 Incident Report Handling Requirements: Changes from RFC3067 Alerts Incident Reports Sensor Human Cryptic (codes etc.) Descriptive May contain Alerts Manager & Humans Standard based app. Standard ? Glenn　M.

Intent of the IR Data Model IDS 研究会 Intent of the IR Data Model 14/12/99　　 controlled exchange and sharing clear and unambiguous semantics even across regional/national boundaries (as far as possible) well defined syntax (atleast for parts of it) enable categorization and statistical analysis ensure integrity and the authenticity Glenn　M.

Requirements: General Format Communication Contents Process IDS 研究会 14/12/99　　 Requirements: General Format Communication Contents Process Glenn　M.

IR Format Requirements: IDS 研究会 14/12/99　　 IR Format Requirements: Internationalization & Localization Structured Well defined semantics for the components Unambiguous and reducible time references Record of time development Access control (who will have to access what ) different components, users Globally unique identification (for IR ) Extensibility Glenn　M.

IR Communication Requirements: IDS 研究会 14/12/99　　 IR Communication Requirements: Must have no effect on integrity, authenticity Glenn　M.

IR Content Requirements: IDS 研究会 14/12/99　　 IR Content Requirements: Various facets of the entities involved Not only network related information Various naming rules for the entities Globally unique identifier 　(components) Classification scheme (enumerated) Several classifications Originator, Owner, Contacts, History, Reference to advisories Description of the incident Glenn　M.

IR Content Requirements: IDS 研究会 14/12/99　　 IR Content Requirements: Multiple versions (in different languages) Indication of “original” vs “translated copies” IDMEF Alerts Logs, Dumps Additional references/pointers Impact (Guidelines for uniform description) Actions taken Authenticity, Integrity verification info Glenn　M.

IR Process Requirements: IDS 研究会 14/12/99　　 IR Process Requirements: Must be deployed real soon ! Glenn　M.