No, I was talking about some non-normative text that says something like the reason both of of the src_ref and dst_ref are not required is organizations may on be able to share part of that information. Or something like that. Help people understand why we decided what we did. It will prevent people from asking the question in the future.
Thanks,
Bret Bret Jordan CISSPDirector of Security Architecture and Standards | Office of the CTO Symantec PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
It’s already there: A Network Connection Object MUST contain protocols and at least one of src_ref OR dst_ref and SHOULD contain src_port and dst_port. Regards, Ivan Okay. We should probably make a note of that in the description of the object. I find that this helps people down the road. Bret Jordan CISSP Director of Security Architecture and Standards | Office of the CTO PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." There are use cases where you only have one side of the equation. Also, and likely more importantly, there are many uses cases where you will only want to SHARE one side of the equation. Many organizations can not and will not share information about their internal IP space. - Jason Keirstead STSM, Product Architect, Security Intelligence, IBM Security Systems www.ibm.com/security | www.securityintelligence.comWithout data, all you are is just another person with an opinion - Unknown <graycol.gif> "Jordan, Bret" ---09/15/2016 11:30:02 AM---What is the use case for these two fields being optional? When would you NOT have something in themFrom: "Jordan, Bret" <bret.jordan@bluecoat.com>To: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>Date: 09/15/2016 11:30 AMSubject: [cti-cybox] Network Connection src and dst refsSent by: <cti-cybox@lists.oasis-open.org>
What is the use case for these two fields being optional? When would you NOT have something in them? Does it make since to send this object without these fields?
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Symantec
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
[attachment "signature.asc" deleted by Jason Keirstead/CanEast/IBM]
|