Managed Incident Lightweight Exchange (mile)
--------------------------------------------

 Charter
 Last Modified: 2011-12-09

 Current Status: Active Working Group

 Chair(s):
     Kathleen Moriarty  <Kathleen.Moriarty@emc.com>
     Brian Trammell  <trammell@tik.ee.ethz.ch>

 Security Area Director(s):
     Stephen Farrell  <stephen.farrell@cs.tcd.ie>
     Sean Turner  <turners@ieca.com>

 Security Area Advisor:
     Sean Turner  <turners@ieca.com>

 Mailing Lists: 
     General Discussion:mile@ietf.org
     To Subscribe:      https://www.ietf.org/mailman/listinfo/mile
     Archive:           http://www.ietf.org/mail-archive/web/mile/

Description of Working Group:

The Managed Incident Lightweight Exchange (MILE) working group will
develop standards and extensions for the purpose of improving incident
information sharing and handling capabilities based on the work
developed in the IETF Extended INCident Handling (INCH) working group.
The Incident Object Description Exchange Format (IODEF) in RFC5070 and
Real-time Inter-network Defense (RID) in RFC6045 were developed in the
INCH working group by international Computer Security Incident Response
Teams (CSIRTs) and industry to meet the needs of a global community
interested in sharing, handling, and exchanging incident information.
The extensions and guidance created by the MILE working group assists
with the daily operations of CSIRTs at an organization, service
provider, law enforcement, and at the country level.  The application of
IODEF and RID to interdomain incident information cooperative exchange
and sharing has recently expanded and the need for extensions has become
more important. Efforts continue to deploy IODEF and RID, as well as to
extend them to support specific use cases covering reporting and
mitigation of current threats such as anti-phishing extensions.

An incident could be a benign configuration issue, IT incident, an
infraction to a service level agreement (SLA), a system compromise,
socially engineered phishing attack, or a denial-of-service (DoS)
attack, etc.  When an incident is detected, the response may include
simply filing a report, notification to the source of the incident, a
request to a third party for resolution/mitigation, or a request to
locate the source.  IODEF defines a data representation that provides a
standard format for sharing information commonly exchanged about
computer security incidents.  RID enables the secure exchange of
incident related information in an IODEF format providing options for
security, privacy, and policy setting.

MILE leverages collaboration and sharing experiences with the work
developed in the INCH working group which includes the data model
detailed in the IODEF, existing extensions to the IODEF for
Anti-phishing (RFC5901), and RID (RFC6045, RFC6046) for the secure
exchange of information.  MILE will also leverage the experience gained
in using IODEF and RID in operational contexts. Related work, drafted
outside of INCH will also be reviewed and includes RFC5941, Sharing
Transaction Fraud Data.

The MILE working group provides coordination for these various extension
efforts to improve the capabilities for exchanging incident information.
  MILE has several objectives with the first being a description a
subset of IODEF focused on ease of deployment and applicability to
current information security data sharing use cases.  MILE also
describes a generalization of RID for secure exchange of other
security-relevant XML formats.  MILE produces additional guidance needed
for the successful exchange of incident information for new use cases
according to policy, security, and privacy requirements.  Finally, MILE
produces a document template with guidance for defining IODEF extensions
to be followed when producing extensions to IODEF as appropriate, for:

  * labeling incident reports with data protection, data retention, and
    other policies, regulations, and
    laws restricting the handling of those reports
  * referencing structured security information from within incident
    reports
  * reporting forensic data generated during an incident investigation
    (computer or accounting)

The WG will produce the following:

  * An informational document on IODEF Guidance.
  * A Standards Track document specifying the Real-time Inter-network
    Defense (RID).
  * A Standards Track document specifying the transport for RID.
  * An informational template for extensions to IODEF.
  * A Standards Track document for IODEF Extensions in IANA XML Registry.
  * A Standards Track document for IODEF Extension to support
    structured cybersecurity information.
  * A Standards Track document for Labeling for data protection,
    retention, policies, and regulations.
  * A Standards Track document for GRC Report Exchange.
  * A Standards Track document for IODEF Extension to support forensics.

The drafts under consideration as WG items include:
   * Real-time Inter-network Defense (RID) bis:
      draft-moriarty-mile-rfc6045-bis-01
   * Transport of Real-time Inter-network Defense (RID) Messages bis:
      draft-trammell-mile-rfc6046-bis-00
   * Template for extensions to IODEF:
      draft-trammell-mile-template-01.txt
   * IODEF Extensions in IANA XML Registry:
      draft-trammell-mile-iodef-xmlreg-00.txt
   * GRC Report Exchange (Generalized RID for XML reports/documents):
      draft-moriarty-mile-grc-exchange-00.txt
   * IODEF-extension to support structured cybersecurity information:
      draft-takahashi-mile-sci-00.txt

 Goals and Milestones:

   Nov 2011       WGLC Real-time Inter-network Defense (RID) 

   Nov 2011       WGLC Transport for Real-time Inter-network Defense (RID) 

   Dec 2011       Submit Real-time Inter-network Defense (RID) to IESG for 
                consideration as Standards Track document 

   Dec 2011       Submit Transport Real-time Inter-network Defense (RID) to IESG 
                for consideration as Standards Track document 

   Dec 2011       WGLC Template for extensions to IODEF 

   Dec 2011       WGLC IODEF Extensions in IANA XML Registry 

   Dec 2011       WGLC IODEF Extension to support structured cybersecurity 
                information 

   Feb 2012       Submit Template for extensions to IODEF to IESG for 
                consideration as Informational document 

   Feb 2012       Submit IODEF Extensions in IANA XML Registry to IESG for 
                consideration as Standards Track document 

   Feb 2012       Submit IODEF Extension to support structured cybersecurity 
                information to IESG for consideration as Standards Track 
                document policies, and regulations 

   Mar 2012       WGLC IODEF Guidance 

   Apr 2012       Submit IODEF Extension Labeling for data protection, retention, 
                policies, and regulations to IESG for consideration as 
                Standards Track document 

   Apr 2012       Submit WGLC IODEF Guidance to IESG for consideration as 
                Informational document 

   May 2012       WGLC GRC Report Exchange 

   Jun 2012       Submit GRC Report Exchange to IESG for consideration as 
                Standards Track document 

   Jun 2012       WGLC Forensics extension 

   Jul 2012       Submit IODEF Forensics extension to IESG for consideration as 
                Standards Track document 


 Internet-Drafts:

Posted Revised         I-D Title   <Filename>
------ ------- --------------------------------------------
Nov 2011 Jan 2012   <draft-ietf-mile-rfc6045-bis-11.txt>
                Real-time Inter-network Defense (RID) 

Nov 2011 Jan 2012   <draft-ietf-mile-rfc6046-bis-09.txt>
                Transport of Real-time Inter-network Defense (RID) Messages 
                over HTTP/ TLS 

Nov 2011 Feb 2012   <draft-ietf-mile-template-02.txt>
                Guidelines for Defining Extensions to IODEF 

Dec 2011 Jan 2012   <draft-ietf-mile-sci-02.txt>
                IODEF-extension to support structured cybersecurity information 

 Request For Comments:

  None to date.