Re: [cti] Some additional thoughts on combining STIX and CybOX

[JG on CTI-TC <jg@ctin.us>]

All:

I like John Wunder's proposal.  It also opens the path for eventually moving MAEC over to OASIS, as well.

Jane

I also agree Cybox should be a separate work product, because it has lots of usefulness outside of STIX (including the potential to create a common cyber-threat correlation language).

I am not in agreement however that CTI Common should be a separate work product (as on the ballot).

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com


>I'm strongly in favor of keeping the two separate.  Having separate documents makes it easier to deal with when switching between writing tools that deal with threat actor attribution instead of crimes that merely happen to involve computers.
>
>Jeffrey Mates, Civ DC3/DCCI
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>Computer Scientist
>Defense Cyber Crime Institute
>jeffrey.mates@dc3.mil
>410-694-4335
>

-- 
Jane Ginn, MSIA, MRP
Cyber Threat Intelligence Network, Inc.
jg@ctin.us