Re: [cti] MVP Discussion

[Aharon Chernin <achernin@soltra.com>]

I want to express my support for Bret’s comments and add my own.

1. There has been no decision to “end of support” or “end of life” STIX 1.2. For the foreseeable future, vendors and their customers can continue to use STIX 1.2 until such a time that products have adopted STIX 2.x. If we (and the vendor community) do this correctly, customers may not even notice the difference when a product moves to STIX 2.x. 
2. Voting for something to be in STIX 2.x, instead of 2.0, is not the same as voting “I don’t think this is important”. It’s simply saying that the feature does not need to be in the very first release of STIX 2.0.
3. The more features we pack into STIX 2.0 MVP the further into the future STIX 2.0 becomes. It also increases the chance of disagreement and continued discussions on minutiae further delaying MVP.
4. With STIX 1.2 we started with an almost full and completed spec, before we created software. Once we got “code on the ground” is when we really started to see its difficiencies. If we can agree to a real minimum viable STIX 2.0, we can write software that will help us identify and answer questions on how we would implement the more advanced features needed for STIX 2.x.

And finally, I will support the community’s decision when it comes to however large STIX 2.0 becomes or however limited STIX 2.0 is decided to be. I am only expressing my opinion in hopes that others can gain some insight. 

Aharon

From: <cti@lists.oasis-open.org> on behalf of "Jordan, Bret" <bret.jordan@bluecoat.com>
Date: Tuesday, April 5, 2016 at 12:30 PM
To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [cti] MVP Discussion

All,

I have a few concerns with the current MVP items as discussed on the call today

1) We need a statistically significant number of people to vote, before we can decide if it is in or out.

2) I feel that some of the items in the list are not well understood, and thus we got mixed voting.

3) I think this voting needs to be moved to a SurveyMonkey and we need to add the options of "abstain" and "I do not know what this means".    

4) Things that have 100% votes, should be in, and we should do those first.  

5) If the feature is not used in mass today, then it probably does not warrant being an MVP item.  Not used == not used.  I am sure between Soltra and EclecticIQ they can give us some great metrics. 

6) The current list represents a LOT of stuff.  Keep in mind that it may take groups 2-5 years to full support everything in that list.  That means in the mean time you will have a lot of products that are NOT compatible with each other.  Can you imaging the conformance issues that this will cause?  Keep in mind that even Soltra Edge does not fully support STIX 1.2 and how long ago did that come out.

7) If the 2.0 MVP does not have everything that a group needs, say the USG.  Then they can keep using STIX 1.2 until such a time that the 2.x tree does have what they need. I do not believe any of us are saying that people need to switch from STIX 1.2 to STIX 2.0 on day one.  

8) For orgs that are currently using STIX 1.2.  You will probably not want to switch to the 2.x family until about 2.2 or 2.3, would be my finger to the wind guess.

9) For orgs that are not yet doing anything with STIX yet, what is the bare minimum that you need to make a solution work.  

10) Things we do not understand well or that are not really used should be pushed to a 2.x release.  

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."