Re: [cti-users] Publication of another threat intelligence standard: Open Threat Partner eXchange (OpenTPX)

[Patrick Maroney <Pmaroney@Specere.org>]

[This thread has become bifurcated so there's no good place to insert this...]

This also directly relates/applies to the concept of Source Pathway Traceability.  The ability for one to establish a non-attributional pathway through Aggregators, ISACs/ISAOs, Third Party entities like the NCI (National Council of ISACs), etc.

I also forgot to highlight the critical need to establish non-attributional Source Identifiers for all objects  (e.g. One way hash of NameSpace and Indicator/Attribute to generate GUID).  So updated suggetion is

In my view we should be sharing:

(1)  Facts about sightings/observations.

(2) Analysis results along with methods to "show your work" for any hypothesis and/or subjective conclusions.

(3) Non-Attributional Source Path Traceability for directing RFIs and Details on Sightings to the original Source(s). 

(4) Non-attributional Source Identifiers for all objects 

BTW: Inserting a comment specific to the arguments there is a need for "Voting on 'Stuff'":  This fits directly and precisely within 2.  You wish to publish/share your Ratings...this is ultimately the product of subjective analysis.  

There's no difference in whether this analysis and related findings come from an individual Analyst, an entire organization, an aggregator, or value added intelligence service.

Patrick Maroney

President

Integrated Networking Technologies, Inc.

Office:  (856)983-0001

Cell:      (609)841-5104

From: <cti-users@lists.oasis-open.org> on behalf of Sean Barnum <sbarnum@mitre.org>
Date: Monday, October 26, 2015 at 1:10 PM
To: Jerome Athias <athiasjerome@gmail.com>
Cc: John Wunder <jwunder@mitre.org>, "cti-users@lists.oasis-open.org" <cti-users@lists.oasis-open.org>
Subject: Re: [cti-users] Publication of another threat intelligence standard: Open Threat Partner eXchange (OpenTPX)

The following is a comment received from a member of the community who is not currently at liberty to post directly. They wished to contribute a thought to the thread. The comment is provided as is with no editing.

"A Trust Community Broker (entity that is authorized by two sharing communities to broker information between the two communities) is also in a unique position to assign useful scores because a broker understands the following about both communities it serves:

• the context of the originator and/or the originating community (which may not be allowed to be visible externally) plus
• the context and business needs of the consumer community"