Re: [cti-cybox] What exactly CybOX?

["Jordan, Bret" <bret.jordan@bluecoat.com>]

I think this represents a good line in the sand and should remove a lot of the confusion people have been having recently.  

Higher level languages like STIX and MAEC will use CybOX in similar but different ways.  And that is OKAY.  

There needs to be a line in the sand between what is CybOX and what is STIX..  And to some extent there should be a Chinese wall between them.  To oft we are pushing STIX-ish ideals down stream on to CybOX, and that needs to stop.  

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Apr 4, 2016, at 16:22, John-Mark Gurney <jmg@newcontext.com> wrote:

Hello,

As there has been discussions on Slack on what is covered by CybOX,
we need to make sure we decide what is in scope and what is not.

IMO, a CybOX object/instance describe exactly one instances of WHAT
happened.  It does not contain other information about who, when, why
or where.

There might be some disagreement on not including where, but I am
defining where, as what company/organization observed/created the
object.  It could be said that where defines the IP/machine of where
it happened, but I include that as part of the WHAT, and SHOULD be
described as part of the CybOX object.  The where does not describe
whos machine it was that it happened on.  (Though w/ the AS object,
there may be some of the where included too.)

I have made some minor modifications to the Overview section.  Part
of the modification removes attack pattern characterization and sharing
of indicators of compromise from the list, as both of these should be
described in STIX or another standard that uses CybOX, as other users
of CybOX may not have a need for these.

I am mostly happy w/ the text in the Overview section of the Cybox
3.0 Spec pre-draft document at:
https://docs.google.com/document/d/1DdS-NrVTjGJ3wvCJ7dbSlhYeiaWS6G6dOXu2F3POpUs/edit#

But if there are things that would make this more clear, please ask,
or best of all, suggest normative text.

--
John-Mark

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail