RE: [cti-cybox] vocabulary items in cybox network extensions

["Kemp, David P" <dpkemp@nsa.gov>]

The general rule should be to use standard vocabularies as they are defined by the authoritative source, rather than changing them to suit our preferences.

So for example the network-connection-object ipfix property would NOT say:  "each dictionary key MUST be a lowercase string version of the IPFIX element name".

The IETF approach is to be strict in what is sent and liberal in what is received.  Implementations should send vocabulary items as defined by the maintainer of the vocabulary (e.g., http://www.iana.org/assignments/ipfix/ipfix.xhtml) and CybOX senders would transmit octetDeltaCount.   Receivers would normalize vocabulary items before matching.    The general normalization rule for all vocabularies could be defined to accomplish both case-insensitive and dash/underscore-insensitive matching; I can't think of any vocabulary where both string-with-separators and string_with_separators would be defined to mean two different things.

Dave


-----Original Message-----
From: cti-cybox@lists.oasis-open.org [mailto:cti-cybox@lists.oasis-open.org] On Behalf Of Kirillov, Ivan A.
Sent: Wednesday, August 31, 2016 9:15 AM
To: Jordan, Bret <bret.jordan@bluecoat.com>; OASIS CTI TC CybOX SC list <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] vocabulary items in cybox network extensions

>> Should these vocabularies we converted to our "standard" and thus changed to use a dash?  

 

No. These vocabularies are very standardized across implementations of Berkeley sockets on Unix and Windows, so I do not think we should be replacing underscores with dashes, as this will make string comparisons more difficult. It’s also highly likely that we will have to make other exceptions like this in the future.

 

Regards,

Ivan  

 

From: <cti-cybox@lists.oasis-open.org> on behalf of Bret Jordan <bret.jordan@bluecoat.com>
Date: Tuesday, August 30, 2016 at 4:57 PM
To: OASIS CTI TC CybOX SC list <cti-cybox@lists.oasis-open.org>
Subject: [cti-cybox] vocabulary items in cybox network extensions

 

In the Network Socket Extension we have three controlled vocabularies listed.  It looks like the items from this list may have come from something like glibc or something.  Our normal document conventions is to have vocabulary terms separated with a dash not an underscore.  All of these terms in these vocabularies have underscores.

 

Should these vocabularies we converted to our "standard" and thus changed to use a dash?  

 

 

Thanks,

 

Bret

 

 

 

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."