Re: [cti-stix] Re: [cti-cybox] Re: [cti-stix] CybOX Versions in STIX?

[Trey Darley <trey@soltra.com>]

On 12.05.2016 11:41:25, Mark Davidson wrote:
>
> I think the approach of allowing multiple versions of CybOX makes
> conformance difficult. I do agree that CybOX could move faster than
> STIX (especially if “adding an object” requires a revision to
> CybOX), and that should be addressed by the CTI TC.
> 

Agreed.

> 
> Allowing a new version of CybOX to be used in conjunction with an
> existing version of STIX would mean that even though two
> implementations supports "STIX 2.1”, one implementation might
> actually have substantially different capabilities because it
> supports a newer version of CybOX.
> 

One potential solution would be:

  * STIX 2.0 depends on CybOX 3.0.
  * CybOX 3.1 is released with a bunch of shiny new objects.
  * STIX 2.0.1 is released, with no other change but to iterate CybOX
    3.0 to 3.1.
  * Rinse and repeat...

-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"Every networking problem always takes longer to solve than it seems
like it should." --RFC 1925

Attachment: signature.asc
Description: Digital signature