STIX 2.0 and the future versions

["Jordan, Bret" <bret.jordan@bluecoat.com>]

All,

It is becoming apparent on the various slack channels that we are once again flirting with scope creep and this idea that we need to solve every condition and every use case that exists.  I would argue that this is a dangerous and slipper slope.  

Some times I feel like we are Henry Ford's design team, and he wants us to design a Model-A, but some in the group are worried about carbon fiber manufacturing, policies for cross walks in front of schools, interconnected traffic lights and cameras, and earth quake proof bridges over the Bay in SF.  When what we have been asked to build is just a Model-A truck. 

We need to remember a few key things:

1) STIX 2.0 is a MVP release (aka minimal viable product)

2) People should plan on STIX 2.1 coming out +6-12 months after 2.0 is released.

3) Just because something is in the spec, does not mean it will EVER be in a product that an analyst will be able to use

4) So if we have 6-12 months between STIX 2.0 and STIX 2.1, we have a gap analysis that we need to do.  Meaning, what features will vendors or open-source projects actually implement in that time frame before STIX 2.1 is released.  

My guess is that vendors and open-source projects will have implemented a small fraction of what is in STIX 2.0 by the time STIX 2.1 is out.  So lets not out pace the market's ability to make use of this standard and design products to do something with it.  Even Soltra Edge today does not do all of STIX 1.1 that was officially released on 20 Feb 2014 (2 years ago).  

It is going to take time for products and vendors to implement STIX 2.0.  Lets not outpace them. Baby steps. One step at a time with shorter release cycles for dot releases.

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail