Re: [cti-taxii] Question about multiple trust group support

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

While I agree that every bullet you have below is important in an effective CTI sharing initiative - the problem is, almost every bullet is also very organization and tool-set specific.

The methodology and requirements I personally have to provide, or a toolset has to provide, in order to prove my identity at the FS-ISAC may not be the same as at IBM or ThreatLoop - in fact it is almost assuredly not the same. Similarly, at IBM trust groups may already exist as they are used throughout the organization, while at another organization trust groups will be specific to CTI. In one organization / tool-set, you may not "join" channels at all because you will be auto-assigned channels based on your role or the type of tool you are.

I can make similar points for most of these items.

This is the problem I have with trying to standardize this type of thing (users / groups) - if this is part of the standard, then the standard won't be able to be consumed.


Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


Terry MacDonald ---2015/09/28 11:00:56 PM--- Hi All In my humble opinion, having group membership is an important part of how

From: Terry MacDonald <terry.macdonald@threatloop.com>
To: Terry MacDonald <terry.macdonald@threatloop.com>, "Davidson II, Mark S" <mdavidson@mitre.org>, "Thompson, Dean" <Dean.Thompson@anz.com>, "cti-taxii@lists.oasis-open.org" <cti-taxii@lists.oasis-open.org>
Date: 2015/09/28 11:00 PM
Subject: Re: [cti-taxii] Question about multiple trust group support
Sent by: <cti-taxii@lists.oasis-open.org>

---

 Hi All

In my humble opinion, having group membership is an important part of how channel and group administrators will control access to channels. 

That said, having a channel's group ownership reflected in the REST API path isn't necessary, as long as there is another mechanism for reflecting that relationship. In fact, having a group within the REST path may in fact make the things more difficult, e.g. if the trustgroup name changes, then the REST endpoint will change. Removing the group name from within the REST API path is a good idea.

I still believe that the group discovery mechanisms are needed in order to ensure interoperability of different vendors implementations. How will a new organization be able all the channels a trustgroup offers otherwise? How will a new TAXII Client know:
• Where the nearest TAXII server is for a trustgroup
• How to join a trustgroup
• How to prove their identity
• How to be approved as a trustgroup member
• What channels the trustgroup offers
• What type of information is sent on each channel
• How to join a channel
• How to prove their identity
• How to be approved to access the channel
• Where else to connect to when the current TAXII server fails
• How to leave a channel
• Am I allowed to post data to the channel
• How to post data to the channel
• List who is receiving the data sent to the channel
Groups not only make the TAXII clients life easier, but they also make the TAXII server admins life easier. With groups a TAXII server admin can create a group and then give 'control' of that group to different user to administer. That user then can worry about making sure that only the 'right' people are given access to that group. Members of that trustgroup are then automatically allowed to access the channels that the group is responsible for. This system also would allow for trustgroup administration to be spread across multiple servers i.e. a trustgroup could be administered by two users on two different TAXII Servers - e.g. one on Soltra and the other on Intelworks. Ensuring a standard mechanism for sharing this information allows for this decentralization to occur.

It seems like a good idea to separate groups from channels, but I still think they are useful. I would like to see something like this:

GET /groups - Returns a list of available/accessible groups
GET /groups/<group-name>/ - Returns information about a group, including the channels available in the group

GET /channels - Returns a list of all publicly listed channels
GET /channels?group=<group-name> - Returns a list of channels that are part of an unlisted group
POST /channels?group=<group-name> - Returns a list of channels that are part of an unlisted group that requires authentication
GET /channels/<channel-name>/ - Returns info about a specific channel


Comments?

Cheers

Terry MacDonald | STIX, TAXII, CybOX Consultant

M: +61-407-203-026
E: terry.macdonald@threatloop.com
W: www.threatloop.com



Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers.

On 28 September 2015 at 22:28, Davidson II, Mark S <mdavidson@mitre.org> wrote:
Are there any comments on this? If not, I’d like to assert that this represents the (for now) general feelings of the group and take the following actions:

 

·         Update the REST API [1] to: remove groups, add the concept of an API Base, document the DNS SRV concept

·         Update the REST API to call out the removed capabilities: General group discovery and no common convention for API Base beyond the “well known value”

·         Attempt to describe trust groups in a way that would be in the spec (e.g., say they exist, but say that they are explicitly not in the spec)

 

If we are in rough agreement about the REST API (I think we are – but please speak up if you have concerns/comments that are not accounted for), working through the scenario Bret’s offered would be a good way to validate the REST API’s current state, at least for one use-case/workflow.

 

Thank you.

-Mark

 

[1] https://github.com/TAXIIProject/TAXII-Specifications/wiki/HTTP-REST-API-for-TAXII-2.0

 

From: cti-taxii@lists.oasis-open.org [mailto:cti-taxii@lists.oasis-open.org] On Behalf Of Davidson II, Mark S
Sent: Thursday, September 24, 2015 8:26 AM
To: Thompson, Dean <Dean.Thompson@anz.com>; 'cti-taxii@lists.oasis-open.org' <cti-taxii@lists.oasis-open.org>

Subject: RE: [cti-taxii] Question about multiple trust group support
 

I realize my email gets down into the design a bit, but here’s what I’m thinking:

 

·         Trust groups are a thing, they just don’t belong inside the scope of the spec.

·         The REST API gets updated to remove the “/groups/<groupname>/” layer, and only has the “/channels/<channelname>” part

·         Multiple instances of the REST API can exist on a server

·         Each instance of the REST API has something called an “API Base” (we can probably pick a better name) that is the root of the REST API instance. One server can have as many “API Bases” as they like.

 

I see there being two basic cases for TAXII integration: configuration-based, and auto-discovery.

 

In the auto-discovery case, discovery would probably be based off of a DNS SRV record. A DNS SRV record would advertise something like “The TAXII server I want you to use is at $hostname:$port” (Note: You can NOT specify a URL in DNS SRV records). The spec could have an algorithm for coming up with a well-known “API Base” from DNS – notionally https://$hostname:$port/well-known-value/. For this to work, there’d have to be a requirement/expectation that any TAXII Server advertised in DNS has this well-known API base. I see this as a critical enabler for plug-and-play capabilities.

 

In the configuration-based case, I think all you have to do is configure a client to use the API Base – e.g., if I had an online threat portal, I could say “If you want to use my threat portal, use https://example.com:443/my_portal_api_base/ as your API base”. This would of course require other products to allow a configurable API Base (and possible multiple configurable API bases for integrating with multiple TAXII Servers).

 

This idea draws a boundary around channel groupings, but without specifying a group concept in the spec. If your implementation only needs one API base – go for it. If you want multiple API bases for multiple some other reason (multiple groups, sub-groups, etc), you can have that.

 

I do see a couple drawbacks to this design, as compared to groups being in the spec:

 

·         No more auto-discovery of groups
o   This could be mitigated by somehow adding another feature (maybe)
·         There might not be a common convention for multiple API bases (e.g., I might use hostnames, you might use ports, somebody else might use URLs).
o   Hopefully this is mitigated by having the API base be an opaque string.
 

Thoughts? I’m particularly interested in drawbacks I didn’t call out.

 

Thank you.

-Mark

 

 

From: cti-taxii@lists.oasis-open.org [mailto:cti-taxii@lists.oasis-open.org] On Behalf Of Thompson, Dean
Sent: Thursday, September 24, 2015 6:14 AM
To: 'cti-taxii@lists.oasis-open.org' <cti-taxii@lists.oasis-open.org>
Subject: RE: [cti-taxii] Question about multiple trust group support

 

 

Hi!,

 

I tend to agree with Trey’s comments with each vendor and technology implementation basically making their own interpretation of what a trust group is and hence it could lead to a number of issues with coding and implementations.  Is another way to approach the problem (and maybe more true to form of what I think TAXII is when I think of it) to use something like PKI in the body of the TAXII message and hence you can only use the data if you have a valid key which belongs to a certain trust group.  This doesn’t get around the problem of key exchange and identifying/ensuring trust relationships although you could potentially add some verbage to the TAXII syntax to allow for key exchange. 

 

It would also potentially deal with trust repositories where other 3^rd parties whether they are channels or brokers hold onto the data or act as a conduit for them.  Whilst in transit the indicators are protected and as long as the 3^rd party broker or channel management knows how to read the header information can ensure delivery of the message.  It also potentially removes the need to have multiple channels setup for different trust groups.  Various trust groups could exist on the one channel, it is the consumer that needs to have the key to unlock and use the data.

 

Just an idea.

 

Regards,

 

Dean

 

From: cti-taxii@lists.oasis-open.org [mailto:cti-taxii@lists.oasis-open.org] On Behalf Of Trey Darley
Sent: Thursday, 24 September 2015 6:08 PM
To: Adam Cooper; Jason Keirstead
Cc: Jordan, Bret; cti-taxii@lists.oasis-open.org
Subject: Re: [cti-taxii] Question about multiple trust group support

 

I agree that trust groups are likely to remain vendor-specific and hence it's pointless trying to formalize trust groups per se in TAXII 2.0.

 

At the same time, TAXII 2.0 *should* have a mechanism for exchange of trust group data between compatible systems. If you grok a vendor's notion of trustgroups, you can do something with it. Otherwise, you can safely ignore it. 

 

I envisage this as an optional block, a la (total strawman):

 

<trustgroups>

  <soltra>

    ...

  </soltra>

  <intelworks>

    ...

  </intelworks>

<trustgroups>

 

Cheers,

Trey

--

Trey Darley

Senior Security Engineer

Soltra | An FS-ISAC & DTCC Company

www.soltra.com

 




---


From: cti-taxii@lists.oasis-open.org <cti-taxii@lists.oasis-open.org> on behalf of Adam Cooper <adam.cooper@digital.cabinet-office.gov.uk>
Sent: Thursday, September 24, 2015 08:37
To: Jason Keirstead
Cc: Jordan, Bret; cti-taxii@lists.oasis-open.org
Subject: Re: [cti-taxii] Question about multiple trust group support

 

I have to agree with Jason: trust groups can be implemented in many ways and are often vendor or technology specific. Limiting implementation options through specification under TAXII adds nothing to the core purpose of TAXII in my mind and may actually limit adoption in COTS products. 

 

Perhaps I am looking at this from a slightly purist approach but there are two things at play here: 1) the TAXII protocol, and 2) TAXII servers. The protocol should in my opinion should NOT be implementation specific and focus on the primary purpose of TAXII i.e. the exchange of cyber threat information. A TAXII server, again in my opinion, should be something that implements the protocol but can do so in any way the developer/vendor chooses provided it is compliant with the protocol standard. The TAXII server (implementation) is then able to implement things like trust groups freely. 

 

Thanks,

 

Adam

 

 




---


This e-mail and any attachments to it (the "Communication") is, unless otherwise stated, confidential, may contain copyright material and is for the use only of the intended recipient. If you receive the Communication in error, please notify the sender immediately by return e-mail, delete the Communication and the return e-mail, and do not read, copy, retransmit or otherwise deal with it. Any views expressed in the Communication are those of the individual sender only, unless expressly stated to be those of Australia and New Zealand Banking Group Limited ABN 11 005 357 522, or any of its related entities including ANZ Bank New Zealand Limited (together "ANZ"). ANZ does not accept liability in connection with the integrity of or errors in the Communication, computer virus, data corruption, interference or delay arising from or in respect of the Communication.