1. INCH Requirements Glenn Mansfield Keeni Cyber Solutions Inc
IDS 研究会
14/12/99　　
INCH Requirements
Glenn Mansfield Keeni
Cyber Solutions Inc
Hiroyuki Ohno
Wide Project
IETF-55 Atlanta,
November, 2002
Glenn　M.

2. Based on a review of RFC3067 CERT Processes IDWG requirements IDS 研究会
14/12/99　　
Based on a review of RFC3067
CERT Processes
IDWG requirements
Glenn　M.

3. Operational Model CSIRT Other CSIRTs Incident Report Database IDS 研究会
14/12/99　　
Operational Model
Other CSIRTs
CSIRT
Incident
Report
Database
Glenn　M.

4. Operational Model-2 Alerts, Reports Statistics CSIRT Other CSIRTs
IDS 研究会
14/12/99　　
Operational Model-2
Other CSIRTs
CSIRT
Incident
Report
Database
Alerts, Reports
Statistics
Glenn　M.

5. Incident Report Handling Requirements: Changes from RFC3067
IDS 研究会
14/12/99　　
Incident Report Handling Requirements: Changes from RFC3067
Alerts
Incident Reports
Sensor
Human
Cryptic (codes etc.)
Descriptive
May contain Alerts
Manager
& Humans
Standard based app.
Standard ?
Glenn　M.

6. Intent of the IR Data Model
IDS 研究会
Intent of the IR Data Model
14/12/99　　
controlled exchange and sharing
clear and unambiguous semantics even across regional/national boundaries
(as far as possible)
well defined syntax
(atleast for parts of it)
enable categorization and statistical analysis
ensure integrity and the authenticity
Glenn　M.

7. Requirements: General Format Communication Contents Process IDS 研究会
14/12/99　　
Requirements:
General
Format
Communication
Contents
Process
Glenn　M.

8. IR Format Requirements:
IDS 研究会
14/12/99　　
IR Format Requirements:
Internationalization & Localization
Structured
Well defined semantics for the components
Unambiguous and reducible time references
Record of time development
Access control (who will have to access what ) different components, users
Globally unique identification (for IR )
Extensibility
Glenn　M.

9. IR Communication Requirements:
IDS 研究会
14/12/99　　
IR Communication Requirements:
Must have no effect on integrity, authenticity
Glenn　M.

10. IR Content Requirements:
IDS 研究会
14/12/99　　
IR Content Requirements:
Various facets of the entities involved
Not only network related information
Various naming rules for the entities
Globally unique identifier 　(components)
Classification scheme (enumerated)
Several classifications
Originator, Owner, Contacts, History,
Reference to advisories
Description of the incident
Glenn　M.

11. IR Content Requirements:
IDS 研究会
14/12/99　　
IR Content Requirements:
Multiple versions (in different languages)
Indication of “original” vs “translated copies”
IDMEF Alerts Logs, Dumps
Additional references/pointers
Impact
(Guidelines for uniform description)
Actions taken
Authenticity, Integrity verification info
Glenn　M.

12. IR Process Requirements:
IDS 研究会
14/12/99　　
IR Process Requirements:
Must be deployed real soon !
Glenn　M.