[cti] Slides, legislation and BoF (was) Re: [cti] F2F Update & Call for agenda

[Tony Rutkowski <tony@yaanatech.com>]

Dear all,

The objective of the Friday morning BOF
slot is to make is as interactive and useful
to CTI work as possible within the 30 minute
timeframe.  In BOF tradition, it will also be
informal and off the record.

Towards that end, the following blog article
may be helpful to provide an understanding
of the larger context and why TC CTI work
has a newly enhanced importance.  See
https://www.yaanatech.com/implementing-the-cybersecurity-act-of-2015-a-public-private-specifications-approach/
Note also that the entity diagram at
the end of the blog that is derived
from another analysis denominated
the "entity ontology" deconstruction
of the Act.

The BOF focus will necessarily be on the
slide 8 challenge questions (or more as
appropriate).   The idea is really to frame
the questions.  The answers are complex
and not going to be found in a few minute
discussion.

1. Is the deconstructed architecture
accurate, useful?

2. What information exchange requirements
exist at the three identified NCCIC interfaces?

3. What assumptions should be made about
the capabilities and architectures within these
three domains (federal, non-federal, international)?

4. What other other information exchange
interfaces among the enumerated entities?
Are there sector-specific interface sub-types
and what are they?

5. What are the required information sharing
expressions and other capabilities at these
interfaces, and to what extent can existing and
planned TC CTI specifications be mapped to
these requirements?

6. What entities transform threat intelligence
into defensive measures, e.g., to the Twenty
Controls?  How does the SACM work mate
with the CTI work?

7. What are the algorithms for the “personal
information of a specific individual or
information that identifies a specific individual”
filter function, and how/where is this work
going to occur?

8. Is it feasible to create an ad-hoc TC CTI
or OASIS group to assist in the Act’s implementation
similar to other compliance obligations?

--tony

ps. I'm also on the hook as the rapporteur for
ETSI TC CYBER's CTI work item to recommend
at its formal meeting in four weeks, how to sync
with CTI.  Appreciate any ideas for globalisation
of this work.