Re: [cti-taxii] Items in scope vs out of scope

[Terry MacDonald <terry.macdonald@threatloop.com>]

I personally don't hold a lot of value in the use of EV Certs. Certificate Authorities have a long history of getting social engineered, hacked, and so forth. I think if people are super concerned with validation of certificates then that will happen either with phone calls to repeat the fingerprints of certs, or for super secret trustgroups people will use their own shared PKI solution (e.g. separate offline trustgroup root cert, with a trustgroup run issuing server for all participants). Vendors will of course issue client certs through their vendor portals, or just accept the user auth as confirmation of the TAXII clients identity.

IMHO taxii client implementations will need to support certificate pinning to stop fake sites impersonating the real ones. I'm thinking of man in the middle style attacks to try and steal or alter threat intel. It would not be a good look if a threat intel platform had all of its info stolen because we didn't restrict interaction enough. Or if  someone malicious started modifying it in transit so that large ISPs automatically started blocking valid customers ranges or websites....

Cheers

Terry MacDonald | STIX, TAXII, CybOX Consultant

M: +61-407-203-026

E: terry.macdonald@threatloop.com

W: www.threatloop.com

Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My opinions do not necessarily reflect those of Threatloop.com.

On 16 October 2015 at 09:06, Tony Rutkowski <tony@yaanatech.com> wrote:

Great graphic.

Has anyone considered the potential use of EVcerts
in conjunction with TAXII?

--tony

On 2015-10-15 1:28 PM, Jordan, Bret wrote:

All,

As we begin work on writing the specification for TAXII 2.0 I want to make sure we are diligent about capturing your ideas, questions, comments, and concerns.  I also want to try and be very clear on where things might fall in the scope discussion.  By doing this I believe we will remove confusion and allow us to focus on specific scoping concerns that people might have.  

To this end I would like to propose that we document the decisions we have already made in this SC and how they relate to scope in a manner that looks something like the following graphic.....  BTW, this is an early rough draft with only the most basic information..  

Please let us know if you find this kind of visual easy to follow and understand, and most importantly if it will help you understand where things fall in relation to scoping.