OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti-cybox message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti-cybox] IP Address Notation (or: I Love CIDR When It's Talking About More Than One IP Address)


What are you saying?  Please give details and examples of what you are asking for.  This will greatly help make sure the specification can accommodate it.  


Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Jan 16, 2016, at 10:47, Patrick Maroney <Pmaroney@Specere.org> wrote:

As always, these musings are intended to illuminate a given topic with related use cases/world views.

I would argue that the conveyance of different types of IP Address representations have very specific meaning and contexts.  If I'm asserting a specific Subnet exists as part of a Black/Grey/White Hat TTP this has very specific meaning (v.s. enumerating some or all individual IP Adressess within that subnet).  These distinctions extend to those use cases where one is trying to map the logical/physical infrastructure and routing tables/pathways that form the basis of Black/Grey/White Hat TTPs.

It is also important to consider the importance of the context of Namespaces/Domains for such representations. A private ipV4 address of 10.10.10.1 may have a very specific immutable meaning within a given localized context.

There are also temporal aspects to IP Address representations.  For example it is very useful/neccessary in some use cases to express that a given physical asset had a given DHCP IP Address from a specific start/end period (and details for any other assignments over the entire period of concern).  Similarly, attributes like "x-forwarded-for" have important meaning.  

From a serialization format perspective it is also very useful to be able to express/convey IP Address constructs in different encoding (i.e., Long Integer representation of ipV4 addreses and address ranges).

So to summarize assertion: the different standard and de facto* forms of representation of IP Addresses should be explicitly defined along with the relevant properties/sub-properties of each of these representation forms.

       * i.e., Cisco reverse subnet mask representation convention.

Patrick Maroney





On Fri, Jan 15, 2016 at 3:43 PM -0800, "Paul Patrick" <ppatrick@isightpartners.com> wrote:

I think is a good way forward

Sent from my iPhone

On Jan 15, 2016, at 3:44 PM, Terry MacDonald <terry@soltra.com> wrote:

This also makes great sense to me…

 

Terry MacDonald
Senior STIX Subject Matter Expert
SOLTRA | An FS-ISAC and DTCC Company
+61 (407) 203 206 | terry@soltra.com

 

 

From: cti-cybox@lists.oasis-open.org [mailto:cti-cybox@lists.oasis-open.org] On Behalf Of Barnum, Sean D.
Sent: Saturday, 16 January 2016 1:41 AM
To: Kirillov, Ivan A. <ikirillov@mitre.org>; Foley, Alexander - GIS <alexander.foley@bankofamerica.com>; Jordan, Bret <bret.jordan@bluecoat.com>
Cc: cti-cybox@lists.oasis-open.org
Subject: Re: [cti-cybox] IP Address Notation (or: I Love CIDR When It's Talking About More Than One IP Address)

 

+1 :-)

 

From: <cti-cybox@lists.oasis-open.org> on behalf of Steve Cell <ikirillov@mitre.org>
Date: Friday, January 15, 2016 at 9:25 AM
To: "Foley, Alexander - GIS" <alexander.foley@bankofamerica.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>
Cc: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] IP Address Notation (or: I Love CIDR When It's Talking About More Than One IP Address)

 

I rather agree with Alex that a lot of these Objects are created by hand today and likely will be for the foreseeable future, so I'm OK with specifying that if no CIDR block is found, the IP Address is implicitly /32 (or /128 for IPv6). However, this is something we’ll need to make very clear in the specification and documentation. Are there any other thoughts on this?

 

Regards,
Ivan

 

From: <cti-cybox@lists.oasis-open.org> on behalf of Alexander Foley <alexander.foley@bankofamerica.com>
Date: Friday, January 15, 2016 at 6:50 AM
To: Bret Jordan <bret.jordan@bluecoat.com>
Cc: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: RE: [cti-cybox] IP Address Notation (or: I Love CIDR When It's Talking About More Than One IP Address)

 

People will be creating these objects by hand.  However, if the standard allows for the lack of /32 to mean an individual IP address I think that’s great.

 

Had the group ever considered the addition of a CIDR-specific object?

 

Thanks,

 

Alex

 

From: Jordan, Bret [mailto:bret.jordan@bluecoat.com] 
Sent: Thursday, January 14, 2016 11:28 PM
To: Foley, Alexander - GIS
Cc: cti-cybox@lists.oasis-open.org
Subject: Re: [cti-cybox] IP Address Notation (or: I Love CIDR When It's Talking About More Than One IP Address)

 

I think it is completely reasonable for the UI tool to add a /32 to an address.  People should not be creating these objects by hand.  Further, I also think it is also reasonable to to say that if no /32 is found, then it is just an IP address and the standard should allow for that.  Hopefully, long term, all tools will just do that for the user behind the scenes, but until then, I think it is okay for the standard to just allow it.  
 
Thanks,

 

Bret

 

 

 

Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

 

On Jan 14, 2016, at 15:13, Foley, Alexander - GIS <alexander.foley@bankofamerica.com> wrote:

 

I thought I’d provide some context of how everyday threat intelligence analysts share IP addresses.  On one fairly popular email list with ~650 active participants, there were about 5,370 messages that contained tens of thousands of indicators of compromise (IOCs).  In these messages:

 

·        Analysts shared individual IP addresses 4,695 times
·        Analysts shared a CIDR block 124 times
·        Of these 124 times, only 6 times were they referring to an individual IP address
·        Of these 6 individual CIDR blocks with /32, they were only one analyst ever referred to an IP this way

 

I continue to believe that, while it’s certainly a fine way to represent an individual IP address, most analysts don’t think to add it at the end when they’re talking about an individual IP.  My personal preference would be for the language to assume that if an IP address object doesn’t have a slash in the address or a CIDR property that it is assumed to be an individual IP address and neither the user nor the tool needs to know to write /32 at the end of it.

 

I’m not intentionally trying to start a flame war, but I do continue to believe that (at least as long as people are still developing the tools that use CybOX / STIX) we will have humans making it or consuming it manually / by hand.

 

Alex

This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

 


This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]