I have to agree with Terry... Option 1 but with MUST rather than MAY.
On 15 December 2015 at 19:32, Terry MacDonald <
> wrote:
Hi Bret,
I'm rarely a fan of
MAY
in standards, unless it is absolutely necessary. Is it possible to tweak Option 1 so that it becomes:
Option 1: A compliant TAXII server MUST implement either the message broker solution, the cyber information repository solution, or both.
Then it would get my vote. I envisage some TAXII servers just acting as a distribution mechanism to share the threat intelligence around (e.g. within threat intel sharing trustgroups, just like their mailing list servers do now) and others acting as threat intel repository (e.g. Soltra and EclecticIQ) and others being both. But I also want to ensure that at least one of them MUST be implemented in order for the TAXII Server to call itself a compliant TAXII Server.
Cheers
Terry MacDonald?
--
Adam Cooper
Identity Assurance Programme Government Digital Service 125 Kingsway, London, WC2B 6NH
Tel: 07973 123 038 official:
official sensitive:
