Managed Incident Lightweight Exchange (MILE) Overview and Participation Kathleen Moriarty Global Lead Security Architect EMC Corporate CTO Office

Agenda  IETF’s Managed Incident Lightweight Exchange (MILE) –Overview and Scope –Charter & documents –Data formats –Transport  How can I help? –End users, developers, implementers, vendors, etc.

MILE: Solving Interoperable Exchanges  Share, consume, process, and amend indicator and incident data –Enable easy processing and use by ▪Incident Management Systems, ▪Security Information and Event Management systems (SIEM), ▪intrusion detection systems, etc. –Intelligence feeds for situational awareness –Enable risk-based prioritization for remediation and defensive actions –Intended as a wire format  Provide not only a common format, but also an architecture and protocol exchange –Enabling interoperable peer-to-peer, repository access, and federated exchanges with publish/subscribe capabilities Data

Scope of Data Formats Classes of DataDescription 1Cyber Intelligence Analysis Describes the characteristics of the threat 2Cyber Incident Reporting Describes a particular cyber event 3Cyber Event Mitigation Describes a proactive or reactive mitigation 4Cyber Information Sharing Describes the meta-data necessary to share information with a third party  Questions to refine the scope and updates to IODEF will be covered on the mailing list over the next 2 –The data tracker is in use to track issues, comments and feedback is requested on scope and issues. Please post them to the mailing list. Your contributions will shape IODEF v2. – –IODEF v2 is planned for publication January 2014! Chart presented by Roman Danyliw at IETF-87

Overview  Updated Charter: –  Current list of documents:  –RFC5070-bis –IODEF Enumeration Reference Format –Structured Cybersecurity Information (SCI) –IODEF Guidance –RESTful indicator exchange using IODEF/RID

IODEF Data Model Supports Enterprise, CSIRT, and Service Provider Operations Internationalization support –Various Encodings –Translations Data handling labels –Sensitivity (includes TLP) –Confidence Extensibility of attributes and adding new elements Predicate logic under review in IODEF Guidance document Commonly exchanged indicator data representation –e.g., IP addresses, ports, protocols, applications, etc. Context rich to support indicator and incident information –History and requested actions Exploit and vulnerability references –Enumeration draft Forensics information – is more needed? iodef:EventData iodef:Descriptioniodef:DetectTimeiodef:StartTimeiodef:EndTimeiodef:Contactiodef:Assessmentiodef:Methodiodef:Flowiodef:Expectationiodef:Recordiodef:EventDataiodef:AdditionalData IODEF:Incident iodef:IncidentIDiodef:AlternativeIDiodef:RelatedActivityiodef:DetectTimeiodef:StartTimeiodef:EndTimeiodef:ReportTimeiodef:Assessmentiodef:Methodiodef:Contactiodef:EventDataiodef:Historyiodef:AdditionalData

Structured Cybersecurity Information (SCI) and Enumeration Reference Format drafts Drafts are in final review stages and will be integrated into IODEF v2  SCI draft provides consistent extension points for stand- alone schemas to be embedded in IODEF as extensions. –Extension points include: ▪AttackPattern ▪Vulnerability ▪Weakness ▪Platform ▪EventReport ▪Verification ▪Remediation –Example schemas may include ▪MMDEF, XCCDF, ACEML, OVAL, etc.  Enumeration Reference Format draft provides a consistent format for parsing reference values, such as a vulnerability number, for example CVE

MILE Incident & Indicator Exchanges Communication and Searches from Providers & Trusted Entities Detection & Security Systems RID ROLIE Indicator System Incident Mgmt Partner, Peer, Service Provider Trusted Entity Analysis Center Sharing Group RFC6545 & RFC6546 Automate exchange ofwatch lists of indicators to address many use cases such as anti-phishing, DDoS, eCrime, etc.

How Can I help?  Participate in the IETF MILE working group: –Meetings are held three times a year ▪Meeting dates/times can be found at: ▪Participation can be in person or remote via MeetEcho ▪All decisions are finalized on the mailing list –Join mailing ▪Participate in an existing thread ▪Start a thread on any questions based on review of a draft ▪Start a thread on work to be proposed related to MILE  Review implementation list: –  Contribute to open source code: –  Provide feedback on code and associated RFCs and drafts