[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: RE: [cti] EUROPE adopts STIX and TAXII
Dear all, The listing was based on Regulation (EU) No. 1025/2012 on European standardisation (http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:316:0012:0033:EN:PDF) that lays down in its Article 13 the procedure for the identification of ICT technical specifications which are not issued by European, international or national standardisation organisations but that still could be referenced in public procurement acts by public authorities, provided that these ICT specifications comply with the requirements set by Annex II of the Regulation. The process was supported by Freddy/EclecticIQ, Trey/NewContext and myself to cover the part of external expert consultation … of course we have governance procedures for this in EU as well ,-) This does not make use of STIX/TAXI as feature or using products being compliant to it mandatory but is the first step as it is now on the list of eligible features/supported spec to be evaluated as a decisive feature/functionality. First and important step to open an eco system. In addition to what Tony contributed form the ETSI perspective the I took similar steps within European standardization work (mandated by council and parliament) within Cyber Security Focus Group (see https://www.cencenelec.eu/standards/sectors/defencesecurityprivacy/security/pages/cybersecurity.aspx) and upcoming CEN/CENELEC TC 13 which is about strategic advisory on where/how to standardize in close cooperation with ENISA. Also keeping relation and exchange with ETSI but working based on a EU mandate. If STIX/TAXI would be already “accredited” by eligible national or international standard organization like NIST or ISO we could easily have it transferred into a matching European standard as we did already with some of the ISO standards on e.g. IT forensics. But actually as STIX/TAXI is more about protocol and structured language it still would have to be evaluated if it makes sense to lift it in this level of standardization or rather produce a more generic standard which could be met then by utilizing STIX/TAXI. Happy to elaborate further p2p or provide an overview on the European standardization landscape when possibly meeting f2f during RSA Conference in SF. Cheers from Germany, Joerg From: cti@lists.oasis-open.org [mailto:cti@lists.oasis-open.org] On Behalf Of Tony Rutkowski Jason, This occurred because those platforms were introduced at their inception into the ETSI Technical Committee on Cyber Security (TC CYBER) via the OASIS-ETSI MoU. TC CYBER took several steps. It included the platforms within a Technical Report on structured information sharing. See TR 103331. It then explicitly included the platforms in a published Technical Report that the platforms are essential to the EU implementation of the Network Information Security (NIS) Directive. See TR 103456. This was an especially significant step because of ETSI's formal relationship with the EU. Within the EU governance system, ETSI enjoys special status somewhat unique special status as (along with CEN/CENELEC) the designated standards body for sector standards among EU Member countries. It also published the specifications within two other published works (TR 103303 on critical infrastructure protection and TR103303, the Global Cyber Security Ecosystem encyclopedic work, worked jointly with ENISA to make a similar recommendation. Lastly, it also highlighted the platforms at the annual ETSI Security Week workshops over the past three years which include representatives from the EC and most EU Members. The work also continues. At the next plenary meeting in February, TR 103333 is being updated to include the latest OASIS CTI specification developments. All the documents are publicly, freely available and well-versioned with persistent identifiers at ETSI's document site. See https://portal.etsi.org/webapp/WorkProgram/SimpleSearch/QueryForm.asp --tony (ETSI-OASIS liaison, work item rapporteur, and ENISA expert at work) On 09-Jan-18 3:16 PM, Jason Keirstead wrote:
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]