cti-stix — archive

Re: [cti-stix] Applying data markings

From: Patrick Maroney <[email protected]>
To: [email protected]
Date: Fri, 11 Dec 2015 18:47:00 -0000

Jason, I see many discussions that seem to conflate and confuse a number of topics like "Data Markings" as well. A core tenet of the TAXII Standard has always been the following: 5.2.1 TAXII is Content Agnostic T he TAXII specifications do not provide details about the underlying content formats of records within TAXII. All content formats are a "black-box" as far as TAXII is concerned - none of the behaviors required to process TAXII at the message level require inspection of any information stored within message content. While TAXII Back-ends can have very different processing paths and requirements for different types of information , TAXII Services, Messages, and Exchanges are agnostic as to the information they convey. This allows TAXII to be usable for a wide array of sharing scenarios. Discussions around "Back-Ends" and STIX "Repositories" are very much implementation specific details from my perspective. Patrick Maroney Office: (856)983-0001 Cell: (609)841-5104 President Integrated Networking Technologies, Inc. PO Box 569 Marlton, NJ 08053 From: < [email protected] > on behalf of Jason Keirstead < [email protected] > Date: Friday, December 11, 2015 at 1:24 PM To: John Wunder < [email protected] > Cc: "Chernin, Aharon" < [email protected] >, " [email protected] " < [email protected] >, Jason Keirstead < [email protected] >, Marlon Taylor < [email protected] >, Sean Barnum < [email protected] > Subject: RE: [cti-stix] Applying data markings There is something I still to this day don't grock about partial makings, especially the ill-defined "TLP". I feel like not enough thought is placed into how the consumer, specifically a TAXII server, is supposed to implement support for the markings. If I have a STIX document and it is marked in such a way that I can see 1/2 of that document but not the other, when that document is published to a TAXII channel that I am privy to, what do I receive as a consumer? Do I receive a partial document? Do I not receive the document at all? If it is the former, then what is the point of having Level 2 markings, and furthermore, how can we ensure the document is not incomplete (for example what if an Indicator I have access to has an observable reference that I do not)? If it is the latter, how can that be done by the TAXII server without changing the digital signature of the document? - Jason Keirstead Product Architect, Security Intelligence, IBM Security Systems www.ibm.com/security www.securityintelligence.com Without data, all you are is just another person with an opinion - Unknown