Managed Incident Lightweight Exchange
charter-ietf-mile-02-04

The Managed Incident Lightweight Exchange (MILE) working group develops
standards to support computer and network security incident management;
an incident is an unplanned event that occurs in an information
technology (IT) infrastructure. An incident could be a benign
configuration issue, IT incident, a system compromise, socially engineered
phishing attack, or a denial-of-service (DoS) attack, etc.  When an incident is
detected, or suspected, there may be a need for organizations to collaborate.
This collaboration effort may take several forms including joint analysis,
information dissemination, and/or a coordinated operational response.  Examples
of the response may include filing a report, notifying the source of the
incident, requesting that a third party resolve/mitigate the incident, sharing
select indicators of compromise, or requesting that the source be located. By
sharing indicators of compromise associated with an incident or possible
threat, the information becomes a proactive defense for others that may include
mitigation options. The Incident Object Description Exchange Format (IODEF)
defines an information framework to represent computer and network security
incidents; IODEF is defined in RFC 5070 and has been extended by RFC 5091 to
support phishing reports; RFC 6484 provides a template for defining extensions
to IODEF. Real-time Inter-network Defense (RID) defines a protocol to
facilitate sharing computer and network security incidents; RID is defined in
RFC 6545, and RID over HTTPS is defined in RFC 6546.

The MILE WG is focused on two areas: IODEF, the data format and extensions
to represent incident and indicator data, and RID, the policy and
transport for structured data.  With respect to IODEF, the working group
will:

- Revise the IODEF document to incorporate enhancements and extensions
based on operational experience. Use by Computer Security Incident
Response Teams (CSIRTs) and others has exposed the need to extend IODEF
to support industry specific extensions, use case specific content, and
representations to associate information related to represented threats
(system, threat actors, campaigns, etc.).  The value of information
sharing has been demonstrated and highlighted at an increasing rate
through the success of the Information Sharing and Analysis Centers
(ISACs) and the recent cyber security Executive Order in the US.
International groups, such as the Multinational Alliance for
Collaborative Cyber Situational Awareness (CCSA) have been running
experiments to determine what data is useful to exchange between
industries and nations to effectively mitigate threats.  The work of
these and other groups have identified or are working to develop data
representations relevant to their use cases that may compliment/extend
IODEF or be useful to exchange using RID and related transport protocols.

- Provide guidance on the implementation and use of IODEF to aid
implementers in developing interoperable specifications.

With respect to RID, the working group will:

- Define a resource-oriented approach to cyber security information
sharing that follows the REST architectural style. This mechanism will
allow CSIRTS to be more dynamic and agile in collaborating with a
broader, and varying constituency.

- Provide guidance on the implementation and use of RID transports based
on use cases.  The guidance document will show the relationship between
transport options (RID + RID transport and IODEF/RID + ROLIE) and may
identify the need for additional transport bindings.

- RID may require modifications to address data provenance, additional
policy options, or other changes now that there are multiple
interoperable implementations of RFC6545 and RFC6546.  With the RID
implementations in the open source community, increased use and
experimentation may demonstrate the need for a revision.