Protocol Requirements Brainstorm

["Davidson II, Mark S" <mdavidson@mitre.org>]

All,

 

Bret and I have put together an initial set of Protocol Requirements [1] for TAXII. What we’d like to do is try and refine these protocol requirements and, by the end of the next community call, try to come up with a consensus short-list of protocol(s). I have included the initial list below.

 

As some of you might know, Bret, Jasen (one of my MITRE colleagues) and myself are all currently working on different TAXII prototypes using different technologies. The prototypes aren’t mature enough to share (yet), and getting a better understanding of where the community is leaning in terms of protocols will help mature the prototypes, and thus mature the thinking of the TAXII Subcommittee.

 

Please let the subcommittee know where you agree/disagree with this list, or if the thinking around a requirement needs to be clarified. This should represent our consensus thoughts around what a protocol should be and do, so speak up!

 

Protocol Requirements

1. Minimal changes to existing firewall deployments
   1. If everyone and their brother has to add a firewall rule to let TAXII traffic through, that's a bad thing.
2. Robust ecosystem of TAXII Server platforms
   1. Picking a protocol should not have the effect of also picking a particular broker/server.
   2. Proxy measurement could be number of tagged questions on SO (e.g.,http://stackoverflow.com/questions/tagged/http)
3. Ubiquitous, well supported client libraries.
4. Well understood by the software development community
   1. If most developers have to learn a new protocol just to do TAXII, that's a bad thing
5. Supportable in cloud infrastructures
6. Integration within existing vendor communication channels
   1. We should make sure we fit in nicely with the way vendor products currently communicate with other vendor products to reduce the cost of entry
   2. Having something that product managers already understand will increase adoption
7. Ability to push information from a server to a client

 

Thank you.

-Mark

 

[1] https://github.com/TAXIIProject/TAXII-Specifications/wiki/TAXII-2.0-Requirements#protocol-requirements