Re: [cti-users] "Data Marking" syntaxes

["Jordan, Bret" <bret.jordan@bluecoat.com>]

I am not trying to re-invent the wheel, I am just trying to get us something simple and easy that will by good for at least 80% of the users... Then we can tweak and add as needed over time.  At lot of the other "standards" are so complex, that it may make STIX even harder to use.

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Nov 6, 2015, at 06:10, Trey Darley <trey@SOLTRA.COM> wrote:

On 06.11.2015 03:18:19, Jordan, Bret wrote:

So why not just say:

{
"share": "public || restricted",
"group": "group members if share==restricted",
"anonymize": "true || false"
}

Does this cover the very advanced stuff some group need. No. But
with it being JSON, the can just add their own text fields for extra
context. Since a human will need to read them anyway. But, does
something like this get us 60% or 70%, or 80% there?

Hey, Bret -

I think this is a pretty good strawman. As you note, we can't solve
all the world's data labeling challenges but it sure provides a lot
more ability than currently exists with TLP in a lightweight
representation.

Question being, are we reinventing the wheel? I'm still trying to find
time to look more deeply into SDN.801 Revision C (Thanks, Dave!) and
First's IEPF. Boy, do I need a time-stretcher! :-/


--
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"It Has To Work." --RFC 1925

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail