OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [cti] Missing MTI - what to do?

Eric Burger wrote this message on Mon, Feb 01, 2016 at 19:03 -0500:
> I agree with Bret here. The question is what do we do with mixed-level TLP. For example, the whole STIX document is TLP amber, but these elements are TLP red. While the TAXII server might pass or store the whole document, if someone with amber but not red access asks for the document, does the whole document fail? I would offer if the source took the effort to separately indicate amber vs. red, they mean to pass the amber stuff with their trusted TAXII server partner “doing the right thing” with the red elements.

To me, it seems like the document should be marked w/ the highest
classification that it contains, so if it has elements which are red,
then the document must be red...  If that's the case, then it should
be less of an issue...


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]