OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti-stix] Proposal - Top Level Relationship Object


" One option is if we could get authentication channel-binding in place between TAXII and STIX and STIX and CybOX then we could do the authentication down in TAXII land and just pass that information up the stack."

I totally agree...! What I would like to see is common agreement at the CTI level as to what an "entity identifier" (where "entity" is a person, company, group, etc) looks like - be it a UUID, URL, URN, or whatever. Once that is agreed upon, we can then explore in TAXII how authentication protocol works, with the agreement that the artifact of authentication would be a collection of said entity identifiers for authorization (I authenticate and I get an identifier for myself and also one for each group I belong to). STIX can then use the entity identifier to enumerate access controls at the various object levels (I have an object and can tag it with "people with this identifier have read access, people with this identifier have read/write access)".

This would go a long way to solve the TLP-originated deficiencies in STIX 1.X. And it also opens the door to having a public registry of these entity identifiers somewhere - that TAXII can presumably authenticate against. This then solves the "how do I know that this user actually belongs to the organization they claim to belong to" problem as well.


-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


Inactive hide details for "Jordan, Bret" ---2015/07/28 05:30:30 PM---Now we are designing and working together!!!! I like these"Jordan, Bret" ---2015/07/28 05:30:30 PM---Now we are designing and working together!!!! I like these ideas... One option is if we could get a

From: "Jordan, Bret" <bret.jordan@bluecoat.com>
To: "Wunder, John A." <jwunder@mitre.org>
Cc: JG on CTI-TC <jg@ctin.us>, "Chris O'Brien" <COBrien@cert.gov.uk>, "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Date: 2015/07/28 05:30 PM
Subject: Re: [cti-stix] Proposal - Top Level Relationship Object
Sent by: <cti-stix@lists.oasis-open.org>





Now we are designing and working together!!!!

I like these ideas... One option is if we could get authentication channel-binding in place between TAXII and STIX and STIX and CybOX then we could do the authentication down in TAXII land and just pass that information up the stack.


Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
[attachment "signature.asc" deleted by Jason Keirstead/CanEast/IBM]




[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]