RE: [cti-cybox] Network Connection Object TCP Extension

["Kemp, David P" <dpkemp@nsa.gov>]

An artifact containing a pcap is standard.   +1 for stealing xxxxxxx reusing what has already been standardized.



-----Original Message-----
From: cti-cybox@lists.oasis-open.org [mailto:cti-cybox@lists.oasis-open.org] On Behalf Of Trey Darley
Sent: Wednesday, August 31, 2016 8:24 AM
To: Patrick Maroney <Pmaroney@Specere.org>
Cc: Jordan, Bret <bret.jordan@bluecoat.com>; OASIS CTI TC CybOX SC list <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] Network Connection Object TCP Extension

On 31.08.2016 12:17:18, Patrick Maroney wrote:
> 
> We need to ensure we can express this type of data in a standard 
> community format. Note that I'm not arguing to extend this now, just 
> that we leave our options open for doing so down the road.
> 

Right you are, Pat. On the other hand, as a standards committee we're always going to be behind the curve in terms of our ability to characterize all the weird protocol abuses that attackers will dream up in future. o_O

--
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"There are two types of people: those who fit into my taxonomy and those who do not." --anonymous