OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [cti-stix] Focusing our active discussions a little

I agree with Sean that we need to get Sightings and Relationships nailed down. However, I need to get this off my chest before I forget.

Soltra Marking Proposal for Discussion:

Issues (I will have Terry add these to the Issue tracker):
  1. XPath in Controlled_Structure does not work well for non-XML implementations of STIX
  2. STIX_Package level handling does not work well when you remove the objects from the STIX_Package (ie. Object reuse)
  3. Marking that is more granular than object level is difficult to implement (ie. 50% of this object is TLP White, 50% of this same object is TLP red).
Solution for Discussion.
  1. Remove Handling/Marking from STIX_Package Header
  2. Remove the concept of XPath Controlled_Structure
  3. Find a new home for Information Source, outside of Handling/Marking
  4. Create Simple Marking, TLP, and TOU marking as either attributes to each object or as elements within each object
Aharon Chernin
18301 Bermuda green Dr
Tampa, fl 33647
813.470.2173 | achernin@soltra.com

From: <cti-stix@lists.oasis-open.org> on behalf of "Jordan, Bret" <bret.jordan@bluecoat.com>
Date: Monday, November 9, 2015 at 12:48 PM
To: "Sean D. Barnum" <sbarnum@mitre.org>
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: [cti-stix] Focusing our active discussions a little

We seem to have a lot of momentum right now on Data Marking.  It would be a shame to lose that.  Might I suggest that we take the next 10 days and try and drive Data Markings to consensus?  



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Nov 9, 2015, at 08:51, Barnum, Sean D. <sbarnum@mitre.org> wrote:


I wanted to thank everyone for a lot of the great conversation that has been occurring over the last couple of weeks.
That is the good news.
On the not as good news front we haven’t really been able to drive to consensus on any specific concrete proposals yet.

I think that while these various conversations are great and seem to have some good exchange we are currently trying to keep up with and contribute to around 1/2 dozen issue topics rather than the two that we agreed to focus on. I have already heard from some parties that this level of diverse activity is difficult to keep up with in a well thought out way. I think this dilution is likely part (though certainly not all) of the reason we are still talking about things on some of these issues rather than having driven towards consensus solutions. I would also hate to have a situation where there is so much active conversation on so many different topics that people not working on this full time with enough cycles to keep up with everything are forced to choose only specific topics to be involved in and simply do not follow or contribute on others based on time.

May I suggest that we attempt to refocus on 1-2 issue topics, drive them to ground and then move to the others?

The two topics that we had agreed to be discussing are sightings and relationships. I think we have had some good discussion on sightings and if we can focus there without distraction for a bit we can hopefully drive to some consensus. If there is community desire to have the second active topic be one of these other issues being discussed (data marking application approach, data marking structure, ID format, request/response, etc.) rather than relationships please let us know and we can select one of these other topics and focus there.

Once again, thank you for your active contributions.


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]