Re: [cti-users] "Data Marking" syntaxes

[Trey Darley <trey@soltra.com>]

On 06.11.2015 03:18:19, Jordan, Bret wrote:
> 
> So why not just say:
> 
> {
> 	"share": "public || restricted",
> 	"group": "group members if share==restricted",
> 	"anonymize": "true || false"
> }
> 
> Does this cover the very advanced stuff some group need. No. But
> with it being JSON, the can just add their own text fields for extra
> context. Since a human will need to read them anyway. But, does
> something like this get us 60% or 70%, or 80% there?
> 

Hey, Bret -

I think this is a pretty good strawman. As you note, we can't solve
all the world's data labeling challenges but it sure provides a lot
more ability than currently exists with TLP in a lightweight
representation.

Question being, are we reinventing the wheel? I'm still trying to find
time to look more deeply into SDN.801 Revision C (Thanks, Dave!) and
First's IEPF. Boy, do I need a time-stretcher! :-/


-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"It Has To Work." --RFC 1925

Attachment: signature.asc
Description: PGP signature