WAS Classification - Word Doc attached

[Mark Curphey <mark@curphey.com>]

Guys,

Following on from the email conversations about taking a thesaurus approach to classification, I took the liberty to move things along by creating a draft document which we can use for discussion tomorrow and hopefully as a framework to move forward. 

I tend to create headings and then filling the content so that’s what I did.

The themes I am focusing on are;

The purpose of this section of our work is to provide some common human language from which the XML can extend and for people to describe the same issue in an unambiguous manner. This will help searching through issues and provide a degree of order to the problem space.

The approach we are taking is;

Thesaurus of “grouped” issues
Use characteristics to group the issues

The next steps are;

Identify the groups and the issues
Identify the characteristics

We can them complete the textual descriptions that will ultimately be referenced in the XML (see VulnXML meta data).

This piece of XML will form a small (but important) sub-section of the final WAS XML that will include the description and the XML based test case.

Meeting Agenda for Thursday August 13th
Based on that I propose we use the meeting tomorrow to discuss the groups of issues and the characteristics. Given it is sometimes hard to articulate the issues in the phone, I would encourage people to read the document heading carefully and send thoughts and ideas or at least have them prepared to present to the group tomorrow.

We need to close out on the groups tomorrow and work on the characteristics very quickly. We can then generate the content which I think is easy if time consuming. 

Please let me know if this works.

Mark

OASIS Web Application Security.doc