Technical Summary
Network security incidents, such as system compromises, worms, viruses,
phishing incidents, and denial of service, typically result in the loss of
service, data, and resources both human and system. To support
collaborative responses to such incidents, network providers and
Computer Security Incident Response Teams need tools and procedures
to support communications and tracing of security incidents. This
document series includes this specification and
draft-moriarty-post-inch-rid-transport.
This specification outlines an inter-network communication
method to facilitate sharing incident handling data while integrating
existing detection, tracing, source identification, and mitigation
mechanisms. Example procedures, which are not required for
conformance to this specification, are included to further describe
environments where this communication method may be used.
The companion document draft-moriarty-post-inch-rid-transport
outlines the transport of IODEF and RID messages over HTTP/TLS.
Working Group Summary
This documents is not the product of any IETF working group. The
document has been reviewed by IETF participants from several different
Areas, as well as prospective users of this specification outside of the
IETF. The document was previously submitted to the IESG for publication
on the Standards track but was not approved. These reviews have been
incorporated into this version of the specification, which is intended for
publication as an Informational RFC.
Protocol Quality
Tim Polk reviewed these specifications for the IESG.
Note to RFC Editor
(1) Append the following paragraph to the abstract:
RID has found use within the international research communities,
but has not been widely adopted in other sectors. This publication
provides the specification to those communities that have adopted
it, and communities currently considering solutions for real-time
inter-network defense. The specification may also accelerate
development of solutions where different transports or message
formats are required by leveraging the data elements and structures
specified here.
(2) Insert the following as the next to last paragraph in section 1.2:
At this point, RID has found use within the international research
communities, but has not been widely adopted in other sectors. This
publication provides the specification to those communities that have
adopted it, and communities currently considering solutions for real-time
inter-network defense. The specification may also accelerate
development of solutions where different transports or message
formats are required by leveraging the data elements and structures
specified here.