Hi All,
The attached document discusses the pros and cons of two options for extending data markings. There is no blocking issue here â just two alternatives that we would like to present before we finalize the spec.
Some tweaks to the spec would need to be made with either option.
The first one is based on the extension type âproperties-extensionâ. It necessitates making optional the two properties, definition and definition-type that were previously used for new marking definitions.
This option is what is currently suggested. The second option continues to use those properties, introducing a new extension type, ânew-markingâ, to the extension facility of section 7.3.
Neither is ideal. The first one makes extensions uniform across all STIX objects. However, the second is consistent with existing TLP and statement marking definitions.
Please comment if you have a preference. The editors will assume that if you donât comment, you would like to continue with option 1.
Thanks!
Rich
--
Rich Piazza
Lead Cyber Security Engineer
The MITRE Corporation
781-271-3760
